src/webkit side of webkit merge 38760:38800

Review URL: http://codereview.chromium.org/13034

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@6325 0039d316-1c4b-4281-b951-d872f2087c98

11 files changed, 333 insertions, 109 deletions

diff --git a/webkit/build/V8Bindings/SConscript b/webkit/build/V8Bindings/SConscript
index afccfc7..45ea1bf 100644
--- a/webkit/build/V8Bindings/SConscript
+++ b/webkit/build/V8Bindings/SConscript
@@ -329,6 +329,7 @@ inputs = [
     '$PORT_DIR/bindings/v8/npruntime.cpp',
     '$PORT_DIR/bindings/v8/RGBColor.cpp',
     '$PORT_DIR/bindings/v8/ScriptCallContextV8.cpp',
+    '$PORT_DIR/bindings/v8/ScriptInstance.cpp',
     '$PORT_DIR/bindings/v8/ScriptValue.cpp',
     '$PORT_DIR/bindings/v8/v8_custom.cpp',
     '$PORT_DIR/bindings/v8/v8_events.cpp',
diff --git a/webkit/build/V8Bindings/V8Bindings.vcproj b/webkit/build/V8Bindings/V8Bindings.vcproj
index 53198a2..6be81da 100644
--- a/webkit/build/V8Bindings/V8Bindings.vcproj
+++ b/webkit/build/V8Bindings/V8Bindings.vcproj
@@ -2521,6 +2521,14 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\port\bindings\v8\ScriptInstance.cpp"
+			>
+		</File>
+		<File
+			RelativePath="..\..\port\bindings\v8\ScriptInstance.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\port\bindings\v8\ScriptSourceCode.h"
 			>
 		</File>
diff --git a/webkit/port/bindings/v8/ScriptController.cpp b/webkit/port/bindings/v8/ScriptController.cpp
index c286b8c..2d45354 100644
--- a/webkit/port/bindings/v8/ScriptController.cpp
+++ b/webkit/port/bindings/v8/ScriptController.cpp
@@ -363,16 +363,16 @@ bool ScriptController::isEnabled() const
     return m_proxy->isEnabled();
 }
 
-JSInstanceHandle ScriptController::createScriptInstanceForWidget(Widget* widget)
+PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widget)
 {
     ASSERT(widget != 0);
 
     if (widget->isFrameView())
-        return JSInstanceHolder::EmptyInstance();
+        return 0;
 
     NPObject* npObject = ChromiumBridge::pluginScriptableObject(widget);
     if (!npObject)
-        return JSInstanceHolder::EmptyInstance();
+        return 0;
 
     // Frame Memory Management for NPObjects
     // -------------------------------------
@@ -404,8 +404,7 @@ JSInstanceHandle ScriptController::createScriptInstanceForWidget(Widget* widget)
     // Track the plugin object.  We've been given a reference to the object.
     m_pluginObjects.set(widget, npObject);
 
-    JSInstance instance = wrapper;
-    return instance;
+    return V8ScriptInstance::create(wrapper);
 }
 
 void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
@@ -496,62 +495,4 @@ void ScriptController::updateDocument()
     m_proxy->updateDocument();
 }
 
-
-JSInstanceHolder::JSInstanceHolder()
-{
-}
-
-JSInstanceHolder::JSInstanceHolder(JSInstanceHandle instance)
-{
-    *this = instance;
-}
-
-JSInstanceHolder::~JSInstanceHolder()
-{
-    Clear();
-}
-
-bool JSInstanceHolder::IsEmpty()
-{
-    return m_instance.IsEmpty();
-}
-
-JSInstance JSInstanceHolder::Get()
-{
-    return v8::Local<v8::Object>::New(m_instance);
-}
-
-void JSInstanceHolder::Clear()
-{
-    if (m_instance.IsEmpty())
-        return;
-    v8::HandleScope scope;
-    v8::Persistent<v8::Object> handle(m_instance);
-#ifndef NDEBUG
-    V8Proxy::UnregisterGlobalHandle(this, handle);
-#endif
-    handle.Dispose();
-    m_instance.Clear();
-}
-
-JSInstance JSInstanceHolder::EmptyInstance()
-{
-    return v8::Local<v8::Object>();
-}
-
-JSInstanceHolder& JSInstanceHolder::operator=(JSInstanceHandle instance)
-{
-    Clear();
-    if (instance.IsEmpty())
-        return *this;
-
-    v8::Persistent<v8::Object> handle =
-        v8::Persistent<v8::Object>::New(instance);
-    m_instance = handle;
-#ifndef NDEBUG
-    V8Proxy::RegisterGlobalHandle(JSINSTANCE, this, handle);
-#endif
-    return *this;
-}
-
 }  // namespace WebCpre
diff --git a/webkit/port/bindings/v8/ScriptController.h b/webkit/port/bindings/v8/ScriptController.h
index c7daeb8..00c6e0c 100644
--- a/webkit/port/bindings/v8/ScriptController.h
+++ b/webkit/port/bindings/v8/ScriptController.h
@@ -35,6 +35,7 @@
 
 #include "HashMap.h"
 #include "MessagePort.h"
+#include "ScriptInstance.h"
 #include "ScriptValue.h"
 #include "SecurityOrigin.h"
 
@@ -164,7 +165,7 @@ public:
 
     NPRuntimeFunctions* functions();
 
-    JSInstanceHandle createScriptInstanceForWidget(Widget*);
+    PassScriptInstance createScriptInstanceForWidget(Widget*);
 
     void clearPluginObjects();
     void disconnectFrame();
@@ -281,26 +282,6 @@ private:
 #endif
 };
 
-// JSInstance is an abstraction for a wrapped C class.  JSC and V8
-// have very different implementations.
-class JSInstanceHolder {
-public:
-    JSInstanceHolder();
-    JSInstanceHolder(JSInstanceHandle);
-    ~JSInstanceHolder();
-    // Returns true if the holder is empty.
-    bool IsEmpty();
-    // Get the contained JSInstance.
-    JSInstance Get();
-    // Clear the contained JSInstance.
-    void Clear();
-    JSInstanceHolder& operator=(JSInstanceHandle);
-    static JSInstance EmptyInstance();
-
-private:
-    JSPersistentInstance m_instance;
-};
-
 }  // namespace WebCore
 
 #endif  // ScriptController_h
diff --git a/webkit/port/bindings/v8/ScriptInstance.cpp b/webkit/port/bindings/v8/ScriptInstance.cpp
new file mode 100644
index 0000000..4c9f64b
--- /dev/null
+++ b/webkit/port/bindings/v8/ScriptInstance.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (c) 2008, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptInstance.h"
+
+#include "v8_proxy.h"
+#include <wtf/Assertions.h>
+
+namespace WebCore {
+
+V8ScriptInstance::V8ScriptInstance()
+{
+}
+
+V8ScriptInstance::V8ScriptInstance(v8::Handle<v8::Object> instance)
+{
+    set(instance);
+}
+
+V8ScriptInstance::~V8ScriptInstance()
+{
+    clear();
+}
+
+v8::Persistent<v8::Object> V8ScriptInstance::instance()
+{
+    return m_instance;
+}
+
+void V8ScriptInstance::clear()
+{
+    if (m_instance.IsEmpty())
+        return;
+#ifndef NDEBUG
+    V8Proxy::UnregisterGlobalHandle(this, m_instance);
+#endif
+    m_instance.Dispose();
+    m_instance.Clear();
+}
+
+void V8ScriptInstance::set(v8::Handle<v8::Object> instance)
+{
+    clear();
+    if (instance.IsEmpty())
+        return;
+
+    m_instance = v8::Persistent<v8::Object>::New(instance);
+#ifndef NDEBUG
+    V8Proxy::RegisterGlobalHandle(SCRIPTINSTANCE, this, m_instance);
+#endif
+
+}
+
+
+} // namespace WebCore
diff --git a/webkit/port/bindings/v8/ScriptInstance.h b/webkit/port/bindings/v8/ScriptInstance.h
new file mode 100644
index 0000000..b45c87b
--- /dev/null
+++ b/webkit/port/bindings/v8/ScriptInstance.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2008, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptInstance_h
+#define ScriptInstance_h
+
+#include "v8.h"
+#include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class V8ScriptInstance : public RefCounted<V8ScriptInstance> {
+public:
+    static PassRefPtr<V8ScriptInstance> create(v8::Handle<v8::Object> instance)
+    {
+        return adoptRef(new V8ScriptInstance(instance));
+    }
+    V8ScriptInstance();
+    V8ScriptInstance(v8::Handle<v8::Object>);
+    ~V8ScriptInstance();
+    v8::Persistent<v8::Object> instance();
+
+private:
+    void clear();
+    void set(v8::Handle<v8::Object>);
+    mutable v8::Persistent<v8::Object> m_instance;
+};
+
+typedef RefPtr<V8ScriptInstance> ScriptInstance;
+typedef PassRefPtr<V8ScriptInstance> PassScriptInstance;
+
+} // namespace WebCore
+
+#endif // ScriptInstance_h
diff --git a/webkit/port/bindings/v8/v8_custom.cpp b/webkit/port/bindings/v8/v8_custom.cpp
index 15028a5..c5cdc34 100644
--- a/webkit/port/bindings/v8/v8_custom.cpp
+++ b/webkit/port/bindings/v8/v8_custom.cpp
@@ -101,6 +101,7 @@
 #include "RenderWidget.h"
 #include "ScheduledAction.h"
 #include "ScriptCallContext.h"
+#include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "StyleSheetList.h"
@@ -1794,10 +1795,15 @@ NAMED_PROPERTY_GETTER(HTMLPlugInElement) {
   INC_STATS("DOM.HTMLPlugInElement.NamedPropertyGetter");
   HTMLPlugInElement* imp =
       V8Proxy::DOMWrapperToNode<HTMLPlugInElement>(info.Holder());
-  v8::Local<v8::Object> instance =
-      v8::Local<v8::Object>::New(imp->getInstance());
-  if (instance.IsEmpty()) return v8::Handle<v8::Object>();
-  return NPObjectGetNamedProperty(instance, name);
+  ScriptInstance script_instance = imp->getInstance();
+  if (script_instance) {
+    v8::Local<v8::Object> instance =
+        v8::Local<v8::Object>::New(script_instance->instance());
+    if (!instance.IsEmpty()) {
+      return NPObjectGetNamedProperty(instance, name);
+    }
+  }
+  return v8::Handle<v8::Object>();
 }
 
 
@@ -1805,13 +1811,15 @@ NAMED_PROPERTY_SETTER(HTMLPlugInElement) {
   INC_STATS("DOM.HTMLPlugInElement.NamedPropertySetter");
   HTMLPlugInElement* imp =
       V8Proxy::DOMWrapperToNode<HTMLPlugInElement>(info.Holder());
-  v8::Local<v8::Object> instance =
-      v8::Local<v8::Object>::New(imp->getInstance());
-  if (instance.IsEmpty()) {
-    return v8::Handle<v8::Value>();  // do not block the call
+  ScriptInstance script_instance = imp->getInstance();
+  if (script_instance) {
+    v8::Local<v8::Object> instance =
+        v8::Local<v8::Object>::New(script_instance->instance());
+    if (!instance.IsEmpty()) {
+      return NPObjectSetNamedProperty(instance, name, value);
+    }
   }
-
-  return NPObjectSetNamedProperty(instance, name, value);
+  return v8::Handle<v8::Value>();  // do not block the call
 }
 
 
@@ -1825,10 +1833,15 @@ INDEXED_PROPERTY_GETTER(HTMLPlugInElement) {
   INC_STATS("DOM.HTMLPlugInElement.IndexedPropertyGetter");
   HTMLPlugInElement* imp =
       V8Proxy::DOMWrapperToNode<HTMLPlugInElement>(info.Holder());
-  v8::Local<v8::Object> instance =
-      v8::Local<v8::Object>::New(imp->getInstance());
-  if (instance.IsEmpty()) return v8::Handle<v8::Object>();
-  return NPObjectGetIndexedProperty(instance, index);
+  ScriptInstance script_instance = imp->getInstance();
+  if (script_instance) {
+    v8::Local<v8::Object> instance =
+        v8::Local<v8::Object>::New(script_instance->instance());
+    if (!instance.IsEmpty()) {
+      return NPObjectGetIndexedProperty(instance, index);
+    }
+  }
+  return v8::Handle<v8::Object>();
 }
 
 
@@ -1836,13 +1849,15 @@ INDEXED_PROPERTY_SETTER(HTMLPlugInElement) {
   INC_STATS("DOM.HTMLPlugInElement.IndexedPropertySetter");
   HTMLPlugInElement* imp =
       V8Proxy::DOMWrapperToNode<HTMLPlugInElement>(info.Holder());
-  v8::Local<v8::Object> instance =
-      v8::Local<v8::Object>::New(imp->getInstance());
-  if (instance.IsEmpty()) {
-    return v8::Handle<v8::Value>();  // do not block the call
+  ScriptInstance script_instance = imp->getInstance();
+  if (script_instance) {
+    v8::Local<v8::Object> instance =
+        v8::Local<v8::Object>::New(script_instance->instance());
+    if (!instance.IsEmpty()) {
+      return NPObjectSetIndexedProperty(instance, index, value);
+    }
   }
-
-  return NPObjectSetIndexedProperty(instance, index, value);
+  return v8::Handle<v8::Value>();  // do not block the call
 }
 
 NAMED_PROPERTY_GETTER(StyleSheetList) {
diff --git a/webkit/port/bindings/v8/v8_npobject.cpp b/webkit/port/bindings/v8/v8_npobject.cpp
index 060f982..f26f510 100644
--- a/webkit/port/bindings/v8/v8_npobject.cpp
+++ b/webkit/port/bindings/v8/v8_npobject.cpp
@@ -61,9 +61,13 @@ static v8::Handle<v8::Value> NPObjectInvokeImpl(
     // The holder object is a subtype of HTMLPlugInElement.
     HTMLPlugInElement* imp =
         V8Proxy::DOMWrapperToNode<HTMLPlugInElement>(args.Holder());
-    v8::Handle<v8::Object> instance = imp->getInstance();
-    npobject = V8Proxy::ToNativeObject<NPObject>(
-        V8ClassIndex::NPOBJECT, instance);
+    ScriptInstance script_instance = imp->getInstance();
+    if (script_instance) {
+      npobject = V8Proxy::ToNativeObject<NPObject>(
+          V8ClassIndex::NPOBJECT, script_instance->instance());
+    } else {
+      npobject = NULL;
+    }
 
   } else {
     // The holder object is not a subtype of HTMLPlugInElement, it
diff --git a/webkit/port/bindings/v8/v8_proxy.h b/webkit/port/bindings/v8/v8_proxy.h
index 724222f..c63dbf4 100644
--- a/webkit/port/bindings/v8/v8_proxy.h
+++ b/webkit/port/bindings/v8/v8_proxy.h
@@ -86,8 +86,8 @@ void log_info(Frame* frame, const String& msg, const String& url);
   V(SCHEDULED_ACTION)           \
   V(EVENT_LISTENER)             \
   V(NODE_FILTER)                \
-  V(SCRIPTVALUE)                \
-  V(JSINSTANCE)
+  V(SCRIPTINSTANCE)             \
+  V(SCRIPTVALUE)                
 
 
 // Host information of persistent handles.
diff --git a/webkit/tools/layout_tests/test_lists/tests_fixable.txt b/webkit/tools/layout_tests/test_lists/tests_fixable.txt
index 16e0c6e..ca0d1db 100644
--- a/webkit/tools/layout_tests/test_lists/tests_fixable.txt
+++ b/webkit/tools/layout_tests/test_lists/tests_fixable.txt
@@ -1474,6 +1474,128 @@ LINUX WIN : LayoutTests/editing/pasteboard/subframe-dragndrop-1.html = FAIL
 
 DEBUG : LayoutTests/svg/dynamic-updates/SVGEllipseElement-svgdom-cy-prop.html = CRASH
 
+// MERGE 38760:38800: New tests
+LayoutTests/fast/workers/use-machine-stack.html = TIMEOUT
+LayoutTests/animations/transform-animation-event-destroy-element.html = CRASH
+LayoutTests/transitions/transform-transition-event-destroy-element.html = CRASH
+
+// MERGE 38760:38800: Expectations changed upstream
+LayoutTests/svg/custom/SVGNumber-interface.svg = FAIL
+LayoutTests/svg/custom/SVGPoint-interface.svg = FAIL
+LayoutTests/svg/custom/SVGRect-interface.svg = FAIL
+LayoutTests/svg/custom/attribute-namespace-check.svg = FAIL
+LayoutTests/svg/custom/class-baseValue.svg = FAIL
+LayoutTests/svg/custom/class-selector.svg = FAIL
+LayoutTests/svg/custom/clip-path-child-changes.svg = FAIL
+LayoutTests/svg/custom/clip-path-href-changes.svg = FAIL
+LayoutTests/svg/custom/clip-path-units-changes.svg = FAIL
+LayoutTests/svg/custom/clip-path-with-transform.svg = FAIL
+LayoutTests/svg/custom/conditional-processing-outside-switch.svg = FAIL
+LayoutTests/svg/custom/create-metadata-element.svg = FAIL
+LayoutTests/svg/custom/css-pixels-dpi.svg = FAIL
+LayoutTests/svg/custom/display-none.svg = FAIL
+LayoutTests/svg/custom/dynamic-viewBox.svg = FAIL
+LayoutTests/svg/custom/empty-merge.svg = FAIL
+LayoutTests/svg/custom/evt-onload.svg = FAIL
+LayoutTests/svg/custom/feDisplacementMap-01.svg = FAIL
+LayoutTests/svg/custom/fill-update.svg = FAIL
+LayoutTests/svg/custom/filter-source-alpha.svg = FAIL
+LayoutTests/svg/custom/fractional-rects.svg = FAIL
+LayoutTests/svg/custom/gradient-add-stops.svg = FAIL
+LayoutTests/svg/custom/gradient-attr-update.svg = FAIL
+LayoutTests/svg/custom/grayscale-gradient-mask.svg = FAIL
+LayoutTests/svg/custom/hover-default-fill.svg = FAIL
+LayoutTests/svg/custom/image-with-aspect-ratio-stretch.svg = FAIL
+LayoutTests/svg/custom/inner-percent.svg = FAIL
+LayoutTests/svg/custom/inner-svg-hit-test.svg = FAIL
+LayoutTests/svg/custom/invalid-transforms.svg = FAIL
+LayoutTests/svg/custom/js-late-mask-and-object-creation.svg = FAIL
+LayoutTests/svg/custom/js-late-mask-creation.svg = FAIL
+LayoutTests/svg/custom/js-update-bounce.svg = FAIL
+LayoutTests/svg/custom/js-update-container.svg = FAIL
+LayoutTests/svg/custom/js-update-container2.svg = FAIL
+LayoutTests/svg/custom/js-update-gradient.svg = FAIL
+LayoutTests/svg/custom/js-update-pattern-child.svg = FAIL
+LayoutTests/svg/custom/js-update-pattern.svg = FAIL
+LayoutTests/svg/custom/js-update-polygon-changes.svg = FAIL
+LayoutTests/svg/custom/js-update-polygon-removal.svg = FAIL
+LayoutTests/svg/custom/js-update-stop.svg = FAIL
+LayoutTests/svg/custom/js-update-style.svg = FAIL
+LayoutTests/svg/custom/js-update-transform-addition.svg = FAIL
+LayoutTests/svg/custom/js-update-transform-changes.svg = FAIL
+LayoutTests/svg/custom/marker-child-changes.svg = FAIL
+LayoutTests/svg/custom/marker-viewBox-changes.svg = FAIL
+LayoutTests/svg/custom/mask-changes.svg = FAIL
+LayoutTests/svg/custom/mask-child-changes.svg = FAIL
+LayoutTests/svg/custom/mask-excessive-malloc.svg = FAIL
+LayoutTests/svg/custom/mask-inside-defs.svg = FAIL
+LayoutTests/svg/custom/path-update.svg = FAIL
+LayoutTests/svg/custom/pattern-in-defs.svg = FAIL
+LayoutTests/svg/custom/percentage-rect.svg = FAIL
+LayoutTests/svg/custom/percentage-rect2.svg = FAIL
+LayoutTests/svg/custom/poly-identify.svg = FAIL
+LayoutTests/svg/custom/polyline-invalid-points.svg = FAIL
+LayoutTests/svg/custom/polyline-setattribute-points-null.svg = FAIL
+LayoutTests/svg/custom/prevent-default.svg = FAIL
+LayoutTests/svg/custom/recursive-clippath.svg = FAIL
+LayoutTests/svg/custom/repaint-on-image-bounds-change.svg = FAIL
+LayoutTests/svg/custom/rgbcolor-syntax.svg = FAIL
+LayoutTests/svg/custom/root-container-opacity-clip-viewBox.svg = FAIL
+LayoutTests/svg/custom/rootelement.svg = FAIL
+LayoutTests/svg/custom/rounded-rects.svg = FAIL
+LayoutTests/svg/custom/scroll-hit-test.xhtml = FAIL
+LayoutTests/svg/custom/sheet-title.svg = FAIL
+LayoutTests/svg/custom/svg-absolute-children.svg = FAIL
+LayoutTests/svg/custom/svgpolyparser-extra-space.svg = FAIL
+LayoutTests/svg/custom/text-gradient-no-content.svg = FAIL
+LayoutTests/svg/custom/transform-ignore-after-invalid.svg = FAIL
+LayoutTests/svg/custom/transform-invalid.svg = FAIL
+LayoutTests/svg/custom/transform-removeAttributeNS.svg = FAIL
+LayoutTests/svg/custom/transform-scale-parse.svg = FAIL
+LayoutTests/svg/custom/transform-with-ending-space.svg = FAIL
+LayoutTests/svg/custom/use-clipped-transform.svg = FAIL
+LayoutTests/svg/custom/use-forward-refs.svg = FAIL
+LayoutTests/svg/custom/use-nested-transform.svg = FAIL
+LayoutTests/svg/custom/use-symbol-overflow.svg = FAIL
+LayoutTests/svg/custom/viewBox-hit.svg = FAIL
+LayoutTests/svg/custom/viewport-clip.svg = FAIL
+LayoutTests/svg/custom/viewport-no-width-height.svg = FAIL
+LayoutTests/svg/custom/viewport-update.svg = FAIL
+LayoutTests/svg/custom/viewport-update2.svg = FAIL
+LayoutTests/svg/custom/visibility-override-clip.svg = FAIL
+LayoutTests/svg/custom/visibility-override-filter.svg = FAIL
+LayoutTests/svg/custom/visibility-override-mask.svg = FAIL
+LayoutTests/svg/custom/visibility-override.svg = FAIL
+LayoutTests/svg/custom/xml-stylesheet.svg = FAIL
+LayoutTests/svg/dom/SVGRectElement/rect-modify-rx.svg = FAIL
+LayoutTests/svg/hixie/cascade/001-broken.xml = FAIL
+LayoutTests/svg/hixie/cascade/002.xml = FAIL
+LayoutTests/svg/hixie/data-types/001.xml = FAIL
+LayoutTests/svg/hixie/dynamic/003.xml = FAIL
+LayoutTests/svg/hixie/dynamic/004.xml = FAIL
+LayoutTests/svg/hixie/dynamic/005.xml = FAIL
+LayoutTests/svg/hixie/dynamic/006.xml = FAIL
+LayoutTests/svg/hixie/error/001.xml = FAIL
+LayoutTests/svg/hixie/error/007.xml = FAIL
+LayoutTests/svg/hixie/error/008.xml = FAIL
+LayoutTests/svg/hixie/error/009.xml = FAIL
+LayoutTests/svg/hixie/error/014-test.xml = FAIL
+LayoutTests/svg/hixie/error/014.xml = FAIL
+LayoutTests/svg/hixie/error/015.xml = FAIL
+LayoutTests/svg/hixie/error/016.xml = FAIL
+LayoutTests/svg/hixie/links/001.xml = FAIL
+LayoutTests/svg/hixie/painting/001.xml = FAIL
+LayoutTests/svg/hixie/processing-model/005.xml = FAIL
+LayoutTests/svg/hixie/rendering-model/001.xml = FAIL
+LayoutTests/svg/hixie/rendering-model/002.xml = FAIL
+LayoutTests/svg/hixie/rendering-model/003a.xml = FAIL
+LayoutTests/svg/hixie/transform/001.xml = FAIL
+LayoutTests/svg/hixie/use/001.xml = FAIL
+LayoutTests/svg/hixie/use/002-test.xml = FAIL
+LayoutTests/svg/hixie/use/002.xml = FAIL
+LayoutTests/svg/hixie/viewbox/001.xml = FAIL
+LayoutTests/svg/hixie/viewbox/004.xml = FAIL
+
 // Not sure why this started failing, but it does.
 LINUX WIN : LayoutTests/svg/custom/acid3-test-77.html = FAIL
 
diff --git a/webkit/webkit.xcodeproj/project.pbxproj b/webkit/webkit.xcodeproj/project.pbxproj
index 4a95530..1038732 100644
--- a/webkit/webkit.xcodeproj/project.pbxproj
+++ b/webkit/webkit.xcodeproj/project.pbxproj
@@ -39,6 +39,7 @@
 
 /* Begin PBXBuildFile section */
 		416F45220ED7697D008215B6 /* FrameLoaderClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416F45210ED7697D008215B6 /* FrameLoaderClient.cpp */; };
+		41AF32C60EE5E6ED00BF6361 /* ScriptInstance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41AF32C40EE5E6ED00BF6361 /* ScriptInstance.cpp */; };
 		4D11C5520E9AC23100EF7617 /* RenderThemeMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E49E50DE0E65E33200AD47F7 /* RenderThemeMac.mm */; };
 		4D1637CC0EBFA49E008F024E /* SQLiteAuthorizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4D1637C30EBFA49E008F024E /* SQLiteAuthorizer.cpp */; };
 		4D1637CD0EBFA49E008F024E /* SQLiteDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4D1637C40EBFA49E008F024E /* SQLiteDatabase.cpp */; };
@@ -1434,6 +1435,8 @@
 /* Begin PBXFileReference section */
 		046192AA0EA5476500FB37B0 /* BitmapImageSingleFrameSkia.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BitmapImageSingleFrameSkia.h; sourceTree = "<group>"; };
 		416F45210ED7697D008215B6 /* FrameLoaderClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FrameLoaderClient.cpp; sourceTree = "<group>"; };
+		41AF32C40EE5E6ED00BF6361 /* ScriptInstance.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptInstance.cpp; sourceTree = "<group>"; };
+		41AF32C50EE5E6ED00BF6361 /* ScriptInstance.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptInstance.h; sourceTree = "<group>"; };
 		4D1637C30EBFA49E008F024E /* SQLiteAuthorizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLiteAuthorizer.cpp; sourceTree = "<group>"; };
 		4D1637C40EBFA49E008F024E /* SQLiteDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLiteDatabase.cpp; sourceTree = "<group>"; };
 		4D1637C50EBFA49E008F024E /* SQLiteDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLiteDatabase.h; sourceTree = "<group>"; };
@@ -4516,6 +4519,8 @@
 				E40063600EA907510055B38E /* ScriptCallContextV8.cpp */,
 				E40060D90EA69E0B0055B38E /* ScriptController.h */,
 				E40060DA0EA69E0B0055B38E /* ScriptController.cpp */,
+				41AF32C50EE5E6ED00BF6361 /* ScriptInstance.h */,
+				41AF32C40EE5E6ED00BF6361 /* ScriptInstance.cpp */,
 				934CC3570EDCCEFE00A658F2 /* ScriptValue.cpp */,
 				934CC3580EDCCEFE00A658F2 /* ScriptValue.h */,
 				7B0095DB0DAFF0DC00F72082 /* v8_binding.h */,
@@ -8166,6 +8171,7 @@
 				7B0095F30DAFF0DD00F72082 /* np_v8object.cpp in Sources */,
 				7B0095F50DAFF0DD00F72082 /* npruntime.cpp in Sources */,
 				934CC2280EDCC37600A658F2 /* RGBColor.cpp in Sources */,
+				41AF32C60EE5E6ED00BF6361 /* ScriptInstance.cpp in Sources */,
 				934CC3590EDCCEFE00A658F2 /* ScriptValue.cpp in Sources */,
 				7B0091390DAFEFBE00F72082 /* SVGElementFactory.cpp in Sources */,
 				7B00913B0DAFEFBE00F72082 /* SVGNames.cpp in Sources */,