Imported WebKit commit 8ff1f22783a32de82fee915abd55bd1b298f2644 (http://svn.webkit.org/repository/webkit/trunk@122325)

New snapshot that should work with the latest Qt build system changes

103 files changed, 753 insertions, 657 deletions

diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index db8ce367d..494f866b0 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -198,4 +198,8 @@ bool RuntimeEnabledFeatures::isStyleScopedEnabled = false;
 bool RuntimeEnabledFeatures::isInputTypeDateEnabled = true;
 #endif
 
+#if ENABLE(DIALOG_ELEMENT)
+bool RuntimeEnabledFeatures::isDialogElementEnabled = false;
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 6f4914316..a17688909 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -231,6 +231,11 @@ public:
     static void setInputTypeDateEnabled(bool isEnabled) { isInputTypeDateEnabled = isEnabled; }
 #endif
 
+#if ENABLE(DIALOG_ELEMENT)
+    static bool dialogElementEnabled() { return isDialogElementEnabled; }
+    static void setDialogElementEnabled(bool isEnabled) { isDialogElementEnabled = isEnabled; }
+#endif
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -304,6 +309,10 @@ private:
 #if ENABLE(INPUT_TYPE_DATE)
     static bool isInputTypeDateEnabled;
 #endif
+
+#if ENABLE(DIALOG_ELEMENT)
+    static bool isDialogElementEnabled;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/gobject/GNUmakefile.am b/Source/WebCore/bindings/gobject/GNUmakefile.am
index c7025286d..fa0454203 100644
--- a/Source/WebCore/bindings/gobject/GNUmakefile.am
+++ b/Source/WebCore/bindings/gobject/GNUmakefile.am
@@ -66,6 +66,10 @@ webkitgtk_gdom_built_sources += \
 	DerivedSources/webkit/WebKitDOMFileList.cpp \
 	DerivedSources/webkit/WebKitDOMFileListPrivate.h \
 	DerivedSources/webkit/WebKitDOMFilePrivate.h \
+	DerivedSources/webkit/WebKitDOMGamepad.cpp \
+	DerivedSources/webkit/WebKitDOMGamepadList.cpp \
+	DerivedSources/webkit/WebKitDOMGamepadListPrivate.h \
+	DerivedSources/webkit/WebKitDOMGamepadPrivate.h \
 	DerivedSources/webkit/WebKitDOMGeolocation.cpp \
 	DerivedSources/webkit/WebKitDOMGeolocationPrivate.h \
 	DerivedSources/webkit/WebKitDOMHistory.cpp \
@@ -295,6 +299,8 @@ webkitgtk_built_h_api += \
 	DerivedSources/webkit/WebKitDOMBlob.h \
 	DerivedSources/webkit/WebKitDOMFile.h \
 	DerivedSources/webkit/WebKitDOMFileList.h \
+	DerivedSources/webkit/WebKitDOMGamepad.h \
+	DerivedSources/webkit/WebKitDOMGamepadList.h \
 	DerivedSources/webkit/WebKitDOMGeolocation.h \
 	DerivedSources/webkit/WebKitDOMHTMLAnchorElement.h \
 	DerivedSources/webkit/WebKitDOMHTMLAppletElement.h \
@@ -428,7 +434,6 @@ webkitgtk_gdom_built_sources += \
 	DerivedSources/webkit/WebKitDOMHTMLPropertiesCollectionPrivate.h
 endif
 
-
 if ENABLE_WEB_TIMING
 webkitgtk_built_h_api += \
 	$(top_builddir)/DerivedSources/webkit/WebKitDOMPerformance.h \
diff --git a/Source/WebCore/bindings/js/GCController.cpp b/Source/WebCore/bindings/js/GCController.cpp
index 96dadf373..79509687f 100644
--- a/Source/WebCore/bindings/js/GCController.cpp
+++ b/Source/WebCore/bindings/js/GCController.cpp
@@ -38,7 +38,7 @@ namespace WebCore {
 
 static void collect(void*)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
 }
 
@@ -63,7 +63,7 @@ void GCController::garbageCollectSoon()
     // down into WTF so that more platforms can take advantage of it, we will be 
     // able to use reportAbandonedObjectGraph on more platforms.
 #if USE(CF)
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     JSDOMWindow::commonJSGlobalData()->heap.reportAbandonedObjectGraph();
 #else
     if (!m_GCTimer.isActive())
@@ -80,7 +80,7 @@ void GCController::gcTimerFired(Timer<GCController>*)
 
 void GCController::garbageCollectNow()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     if (!JSDOMWindow::commonJSGlobalData()->heap.isBusy())
         JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
 }
@@ -104,7 +104,7 @@ void GCController::setJavaScriptGarbageCollectorTimerEnabled(bool enable)
 
 void GCController::discardAllCompiledCode()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     JSDOMWindow::commonJSGlobalData()->heap.deleteAllCompiledCode();
 }
 
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index 66b4a7f43..8b94f6497 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -120,6 +120,7 @@
 #include "JSMessageEventCustom.cpp"
 #include "JSMessagePortCustom.cpp"
 #include "JSMutationCallbackCustom.cpp"
+#include "JSMutationObserverCustom.cpp"
 #include "JSNamedNodeMapCustom.cpp"
 #include "JSNodeCustom.cpp"
 #include "JSNodeFilterCondition.cpp"
@@ -158,7 +159,6 @@
 #include "JSWebKitAnimationListCustom.cpp"
 #include "JSWebKitCSSKeyframeRuleCustom.cpp"
 #include "JSWebKitCSSKeyframesRuleCustom.cpp"
-#include "JSWebKitMutationObserverCustom.cpp"
 #include "JSWebKitPointCustom.cpp"
 #include "JSWebSocketCustom.cpp"
 #include "JSWorkerContextBase.cpp"
diff --git a/Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 17bd910a6..34c28e9ce 100644
--- a/Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -48,7 +48,7 @@ bool JSSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLEr
 
     RefPtr<JSSQLStatementErrorCallback> protect(this);
 
-    JSC::JSLock lock(SilenceAssertionsOnly);
+    JSC::JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
diff --git a/Source/WebCore/bindings/js/JSCustomVoidCallback.cpp b/Source/WebCore/bindings/js/JSCustomVoidCallback.cpp
index f830f5cdd..5d421badd 100644
--- a/Source/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/Source/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -63,7 +63,7 @@ void JSCustomVoidCallback::handleEvent()
 
     RefPtr<JSCustomVoidCallback> protect(this);
         
-    JSC::JSLock lock(SilenceAssertionsOnly);
+    JSC::JSLockHolder lock(m_data->globalObject()->globalData());
     MarkedArgumentBuffer args;
     m_data->invokeCallback(args);
 }
diff --git a/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index bdaf0d553..a897b6fbc 100644
--- a/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -67,7 +67,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 {
     ASSERT(m_customResolver);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     ExecState* exec = m_globalObject->globalExec();
         
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index d278a802a..c60e07d61 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -281,32 +281,53 @@ enum ParameterDefaultPolicy {
         return toJS(exec, globalObject, ptr.get());
     }
 
+    template <class T>
+    struct Traits {
+        static inline JSC::JSValue arrayJSValue(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, const T& value)
+        {
+            return toJS(exec, globalObject, WTF::getPtr(value));
+        }
+    };
+
+    template<>
+    struct Traits<String> {
+        static inline JSC::JSValue arrayJSValue(JSC::ExecState* exec, JSDOMGlobalObject*, const String& value)
+        {
+            return jsString(exec, stringToUString(value));
+        }
+    };
+
+    template<>
+    struct Traits<float> {
+        static inline JSC::JSValue arrayJSValue(JSC::ExecState*, JSDOMGlobalObject*, const float& value)
+        {
+            return JSC::jsNumber(value);
+        }
+    };
+
+    template<>
+    struct Traits<unsigned long> {
+        static inline JSC::JSValue arrayJSValue(JSC::ExecState*, JSDOMGlobalObject*, const unsigned long& value)
+        {
+            return JSC::jsNumber(value);
+        }
+    };
+
     template <typename T, size_t inlineCapacity>
     JSC::JSValue jsArray(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<T, inlineCapacity>& iterator)
     {
         JSC::MarkedArgumentBuffer list;
-        typename Vector<T, inlineCapacity>::const_iterator end = iterator.end();
+        typename Vector<T, inlineCapacity>::const_iterator end = iterator.end();        
+        typedef Traits<T> TraitsType;
 
         for (typename Vector<T, inlineCapacity>::const_iterator iter = iterator.begin(); iter != end; ++iter)
-            list.append(toJS(exec, globalObject, WTF::getPtr(*iter)));
+            list.append(TraitsType::arrayJSValue(exec, globalObject, *iter));
 
         return JSC::constructArray(exec, globalObject, list);
     }
 
     JSC::JSValue jsArray(JSC::ExecState*, JSDOMGlobalObject*, PassRefPtr<DOMStringList>);
 
-    template<>
-    inline JSC::JSValue jsArray(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<String>& iterator)
-    {
-        JSC::MarkedArgumentBuffer array;
-        Vector<String>::const_iterator end = iterator.end();
-
-        for (Vector<String>::const_iterator it = iterator.begin(); it != end; ++it)
-            array.append(jsString(exec, stringToUString(*it)));
-
-        return JSC::constructArray(exec, globalObject, array);
-    }
-
     template <class T>
     Vector<T> toNativeArray(JSC::ExecState* exec, JSC::JSValue value)
     {
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2d17465e0..bb3d79125 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -116,10 +116,10 @@ static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, PropertyName p
     ASSERT(document);
     ASSERT(document->isHTMLDocument());
 
-    HTMLCollection* collection = document->windowNamedItems(propertyNameToAtomicString(propertyName));
+    RefPtr<HTMLCollection> collection = document->windowNamedItems(propertyNameToAtomicString(propertyName));
     if (collection->hasExactlyOneItem())
         return toJS(exec, thisObj, collection->item(0));
-    return toJS(exec, thisObj, collection);
+    return toJS(exec, thisObj, WTF::getPtr(collection));
 }
 
 bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/js/JSErrorHandler.cpp b/Source/WebCore/bindings/js/JSErrorHandler.cpp
index e292d2930..5b4b59f8f 100644
--- a/Source/WebCore/bindings/js/JSErrorHandler.cpp
+++ b/Source/WebCore/bindings/js/JSErrorHandler.cpp
@@ -63,7 +63,7 @@ void JSErrorHandler::handleEvent(ScriptExecutionContext* scriptExecutionContext,
 
     ErrorEvent* errorEvent = static_cast<ErrorEvent*>(event);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptExecutionContext->globalData());
 
     JSObject* jsFunction = this->jsFunction(scriptExecutionContext);
     if (!jsFunction)
diff --git a/Source/WebCore/bindings/js/JSEventCustom.cpp b/Source/WebCore/bindings/js/JSEventCustom.cpp
index b891f8938..fdc75c7da 100644
--- a/Source/WebCore/bindings/js/JSEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSEventCustom.cpp
@@ -54,7 +54,7 @@ JSValue JSEvent::clipboardData(ExecState* exec) const
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     if (!event)
         return jsNull();
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index ab28ca813..0a557f7d4 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -75,7 +75,7 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
     if (!scriptExecutionContext || scriptExecutionContext->isJSExecutionForbidden())
         return;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptExecutionContext->globalData());
 
     JSObject* jsFunction = this->jsFunction(scriptExecutionContext);
     if (!jsFunction)
diff --git a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index fddc5a5d1..5e2f35efd 100644
--- a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -62,9 +62,9 @@ JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, PropertyNa
     JSHTMLDocument* thisObj = jsCast<JSHTMLDocument*>(asObject(slotBase));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
 
-    HTMLCollection* collection = document->documentNamedItems(propertyNameToAtomicString(propertyName));
+    RefPtr<HTMLCollection> collection = document->documentNamedItems(propertyNameToAtomicString(propertyName));
 
-    if (!collection->hasAnyItem())
+    if (collection->isEmpty())
         return jsUndefined();
 
     if (collection->hasExactlyOneItem()) {
@@ -77,7 +77,7 @@ JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, PropertyNa
         return toJS(exec, thisObj->globalObject(), node);
     } 
 
-    return toJS(exec, thisObj->globalObject(), collection);
+    return toJS(exec, thisObj->globalObject(), WTF::getPtr(collection));
 }
 
 // Custom attributes
diff --git a/Source/WebCore/bindings/js/JSIDBAnyCustom.cpp b/Source/WebCore/bindings/js/JSIDBAnyCustom.cpp
index cf545d300..3f907ac75 100644
--- a/Source/WebCore/bindings/js/JSIDBAnyCustom.cpp
+++ b/Source/WebCore/bindings/js/JSIDBAnyCustom.cpp
@@ -64,6 +64,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, IDBAny* idbAny)
         return jsUndefined();
     case IDBAny::NullType:
         return jsNull();
+    case IDBAny::StringType:
+        return jsString(exec, idbAny->string());
     case IDBAny::DOMStringListType:
         return toJS(exec, globalObject, idbAny->domStringList());
     case IDBAny::IDBCursorType:
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index a1d286a74..3f0935240 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -82,7 +82,7 @@ Node* InjectedScriptHost::scriptValueAsNode(ScriptValue value)
 
 ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(state);
     return ScriptValue(state->globalData(), toJS(state, deprecatedGlobalObjectForPrototype(state), node));
 }
 
@@ -95,7 +95,7 @@ JSValue JSInjectedScriptHost::inspectedObject(ExecState* exec)
     if (!object)
         return jsUndefined();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     ScriptValue scriptValue = object->get(exec);
     if (scriptValue.hasNoValue())
         return jsUndefined();
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
index 138193bba..b23774474 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
@@ -51,7 +51,7 @@ namespace WebCore {
 
 ScriptObject InjectedScriptManager::createInjectedScript(const String& source, ScriptState* scriptState, int id)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
 
     SourceCode sourceCode = makeSource(stringToUString(source));
     JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
@@ -81,7 +81,7 @@ ScriptObject InjectedScriptManager::createInjectedScript(const String& source, S
 
 bool InjectedScriptManager::canAccessInspectedWindow(ScriptState* scriptState)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     JSDOMWindow* inspectedWindow = toJSDOMWindow(scriptState->lexicalGlobalObject());
     if (!inspectedWindow)
         return false;
diff --git a/Source/WebCore/bindings/js/JSLazyEventListener.cpp b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
index 64f9cb9c0..8879727e2 100644
--- a/Source/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -108,7 +108,7 @@ JSObject* JSLazyEventListener::initializeJSFunction(ScriptExecutionContext* exec
     if (m_originalNode) {
         if (!wrapper()) {
             // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
-            JSLock lock(SilenceAssertionsOnly);
+            JSLockHolder lock(exec);
             // FIXME: Should pass the global object associated with the node
             setWrapper(exec->globalData(), asObject(toJS(exec, globalObject, m_originalNode)));
         }
diff --git a/Source/WebCore/bindings/js/JSMainThreadExecState.cpp b/Source/WebCore/bindings/js/JSMainThreadExecState.cpp
index 00bc170d2..0ef0b593e 100644
--- a/Source/WebCore/bindings/js/JSMainThreadExecState.cpp
+++ b/Source/WebCore/bindings/js/JSMainThreadExecState.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 #include "JSMainThreadExecState.h"
-#include "WebKitMutationObserver.h"
+#include "MutationObserver.h"
 
 #if ENABLE(INDEXED_DATABASE)
 #include "IDBPendingTransactionMonitor.h"
@@ -38,11 +38,13 @@ JSC::ExecState* JSMainThreadExecState::s_mainThreadState = 0;
 void JSMainThreadExecState::didLeaveScriptContext()
 {
 #if ENABLE(INDEXED_DATABASE)
-    IDBPendingTransactionMonitor::abortPendingTransactions();   
+    // Indexed DB requires that transactions are created with an internal |active| flag
+    // set to true, but the flag becomes false when control returns to the event loop.
+    IDBPendingTransactionMonitor::deactivateNewTransactions();
 #endif
 
 #if ENABLE(MUTATION_OBSERVERS)
-    WebKitMutationObserver::deliverAllMutations();
+    MutationObserver::deliverAllMutations();
 #endif
 }
 
diff --git a/Source/WebCore/bindings/js/JSMainThreadExecState.h b/Source/WebCore/bindings/js/JSMainThreadExecState.h
index b9af0669a..838e3edb3 100644
--- a/Source/WebCore/bindings/js/JSMainThreadExecState.h
+++ b/Source/WebCore/bindings/js/JSMainThreadExecState.h
@@ -73,6 +73,7 @@ public:
     static JSC::JSValue evaluate(JSC::ExecState* exec, JSC::ScopeChainNode* chain, const JSC::SourceCode& source, JSC::JSValue thisValue, JSC::JSValue* exception)
     {
         JSMainThreadExecState currentState(exec);
+        JSC::JSLockHolder lock(exec);
         return JSC::evaluate(exec, chain, source, thisValue, exception);
     };
 
diff --git a/Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp b/Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp
index 4375ce417..e3de7b794 100644
--- a/Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp
@@ -34,8 +34,9 @@
 
 #include "JSMutationCallback.h"
 
+#include "JSDOMWindowBase.h"
+#include "JSMutationObserver.h"
 #include "JSMutationRecord.h"
-#include "JSWebKitMutationObserver.h"
 #include "ScriptExecutionContext.h"
 #include <runtime/JSLock.h>
 
@@ -43,14 +44,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool JSMutationCallback::handleEvent(MutationRecordArray* mutations, WebKitMutationObserver* observer)
+bool JSMutationCallback::handleEvent(MutationRecordArray* mutations, MutationObserver* observer)
 {
     if (!canInvokeCallback())
         return true;
 
     RefPtr<JSMutationCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
 
diff --git a/Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp b/Source/WebCore/bindings/js/JSMutationObserverCustom.cpp
index 41ffafc36..ab5560d80 100644
--- a/Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMutationObserverCustom.cpp
@@ -32,17 +32,17 @@
 
 #if ENABLE(MUTATION_OBSERVERS)
 
-#include "JSWebKitMutationObserver.h"
+#include "JSMutationObserver.h"
 
 #include "JSMutationCallback.h"
-#include "WebKitMutationObserver.h"
+#include "MutationObserver.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-EncodedJSValue JSC_HOST_CALL JSWebKitMutationObserverConstructor::constructJSWebKitMutationObserver(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL JSMutationObserverConstructor::constructJSMutationObserver(ExecState* exec)
 {
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createNotEnoughArgumentsError(exec));
@@ -53,9 +53,9 @@ EncodedJSValue JSC_HOST_CALL JSWebKitMutationObserverConstructor::constructJSWeb
         return JSValue::encode(jsUndefined());
     }
 
-    JSWebKitMutationObserverConstructor* jsConstructor = jsCast<JSWebKitMutationObserverConstructor*>(exec->callee());
+    JSMutationObserverConstructor* jsConstructor = jsCast<JSMutationObserverConstructor*>(exec->callee());
     RefPtr<MutationCallback> callback = JSMutationCallback::create(object, jsConstructor->globalObject());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), WebKitMutationObserver::create(callback.release()))));
+    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), MutationObserver::create(callback.release()))));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp b/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 120f63873..7d01b9f58 100644
--- a/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -40,7 +40,7 @@ JSNodeFilterCondition::JSNodeFilterCondition(JSGlobalData&, NodeFilter* owner, J
 
 short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     if (!m_filter)
         return NodeFilter::FILTER_ACCEPT;
diff --git a/Source/WebCore/bindings/js/JSRequestAnimationFrameCallbackCustom.cpp b/Source/WebCore/bindings/js/JSRequestAnimationFrameCallbackCustom.cpp
index c6be647f8..eb2ab3c56 100644
--- a/Source/WebCore/bindings/js/JSRequestAnimationFrameCallbackCustom.cpp
+++ b/Source/WebCore/bindings/js/JSRequestAnimationFrameCallbackCustom.cpp
@@ -40,7 +40,7 @@ bool JSRequestAnimationFrameCallback::handleEvent(DOMTimeStamp time)
 
     RefPtr<JSRequestAnimationFrameCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     MarkedArgumentBuffer args;
     args.append(jsNumber(time));
diff --git a/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 13b4c008a..40c329b73 100644
--- a/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -39,6 +39,7 @@
 #include "HTMLDocument.h"
 #include "InspectorInstrumentation.h"
 #include "JSArrayBuffer.h"
+#include "JSArrayBufferView.h"
 #include "JSBlob.h"
 #include "JSDOMFormData.h"
 #include "JSDOMWindowCustom.h"
@@ -126,6 +127,8 @@ JSValue JSXMLHttpRequest::send(ExecState* exec)
             impl()->send(toDOMFormData(val), ec);
         else if (val.inherits(&JSArrayBuffer::s_info))
             impl()->send(toArrayBuffer(val), ec);
+        else if (val.inherits(&JSArrayBufferView::s_info))
+            impl()->send(toArrayBufferView(val), ec);
         else
             impl()->send(ustringToString(val.toString(exec)->value(exec)), ec);
     }
diff --git a/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp b/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp
index 29b739987..3aefad167 100644
--- a/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp
+++ b/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp
@@ -30,6 +30,7 @@
 #include "JavaScriptCallFrame.h"
 
 #include "JSDOMBinding.h"
+#include "JSDOMWindowBase.h"
 #include "PlatformString.h"
 #include <debugger/DebuggerCallFrame.h>
 #include <runtime/Completion.h>
@@ -106,7 +107,7 @@ JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception)
     if (!m_isValid)
         return jsNull();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
     return m_debuggerCallFrame.evaluate(script, exception);
 }
 
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
index 10bb8c8f6..ff0aeefb5 100755
--- a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
@@ -110,7 +110,7 @@ void PageScriptDebugServer::removeListener(ScriptDebugListener* listener, Page*
 
 void PageScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     // If JavaScript stack is not empty postpone recompilation.
     if (JSDOMWindow::commonJSGlobalData()->dynamicGlobalObject)
         recompileAllJSFunctionsSoon();
diff --git a/Source/WebCore/bindings/js/ScheduledAction.cpp b/Source/WebCore/bindings/js/ScheduledAction.cpp
index 1906905f0..c469bf829 100644
--- a/Source/WebCore/bindings/js/ScheduledAction.cpp
+++ b/Source/WebCore/bindings/js/ScheduledAction.cpp
@@ -94,7 +94,7 @@ void ScheduledAction::execute(ScriptExecutionContext* context)
 void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSValue thisValue, ScriptExecutionContext* context)
 {
     ASSERT(m_function);
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(context->globalData());
 
     CallData callData;
     CallType callType = getCallData(m_function.get(), callData);
diff --git a/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp b/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 2100c6b02..9cf4e99ce 100644
--- a/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -46,7 +46,7 @@ namespace WebCore {
 
 ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     ScriptController* scriptController = frame->script();
     ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
@@ -67,7 +67,7 @@ ScriptCachedFrameData::~ScriptCachedFrameData()
 
 void ScriptCachedFrameData::restore(Frame* frame)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     ScriptController* scriptController = frame->script();
     ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
@@ -95,7 +95,7 @@ void ScriptCachedFrameData::clear()
     if (m_windows.isEmpty())
         return;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
     m_windows.clear();
     gcController().garbageCollectSoon();
 }
diff --git a/Source/WebCore/bindings/js/ScriptCallStackFactory.cpp b/Source/WebCore/bindings/js/ScriptCallStackFactory.cpp
index ccf673fd4..3bb69f42c 100644
--- a/Source/WebCore/bindings/js/ScriptCallStackFactory.cpp
+++ b/Source/WebCore/bindings/js/ScriptCallStackFactory.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,6 +34,7 @@
 
 #include "InspectorInstrumentation.h"
 #include "JSDOMBinding.h"
+#include "JSMainThreadExecState.h"
 #include "ScriptArguments.h"
 #include "ScriptCallFrame.h"
 #include "ScriptCallStack.h"
@@ -51,9 +53,25 @@ namespace WebCore {
 
 class ScriptExecutionContext;
 
-PassRefPtr<ScriptCallStack> createScriptCallStack(size_t, bool)
+PassRefPtr<ScriptCallStack> createScriptCallStack(size_t maxStackSize, bool emptyIsAllowed)
 {
-    return 0;
+    Vector<ScriptCallFrame> frames;
+    if (JSC::ExecState* exec = JSMainThreadExecState::currentState()) {
+        Vector<StackFrame> stackTrace;
+        Interpreter::getStackTrace(&exec->globalData(), stackTrace);
+        for (Vector<StackFrame>::const_iterator iter = stackTrace.begin(); iter < stackTrace.end(); iter++) {
+            frames.append(ScriptCallFrame(iter->friendlyFunctionName(exec), iter->friendlySourceURL(), iter->friendlyLineNumber()));
+            if (frames.size() >= maxStackSize)
+                break;
+        }
+    }
+    if (frames.isEmpty() && !emptyIsAllowed) {
+        // No frames found. It may happen in the case where
+        // a bound function is called from native code for example.
+        // Fallback to setting lineNumber to 0, and source and function name to "undefined".
+        frames.append(ScriptCallFrame("undefined", "undefined", 0));
+    }
+    return ScriptCallStack::create(frames);
 }
 
 PassRefPtr<ScriptCallStack> createScriptCallStack(JSC::ExecState* exec, size_t maxStackSize)
diff --git a/Source/WebCore/bindings/js/ScriptController.cpp b/Source/WebCore/bindings/js/ScriptController.cpp
index 7999502bd..06c799640 100644
--- a/Source/WebCore/bindings/js/ScriptController.cpp
+++ b/Source/WebCore/bindings/js/ScriptController.cpp
@@ -133,7 +133,7 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
     const String* savedSourceURL = m_sourceURL;
     m_sourceURL = &sourceURL;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     RefPtr<Frame> protect = m_frame;
 
@@ -177,7 +177,7 @@ void ScriptController::clearWindowShell(bool goingIntoPageCache)
     if (m_windowShells.isEmpty())
         return;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
         JSDOMWindowShell* windowShell = iter->second.get();
@@ -209,7 +209,7 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 {
     ASSERT(!m_windowShells.contains(world));
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(world->globalData());
 
     JSDOMWindowShell* windowShell = createWindowShell(world);
 
@@ -284,9 +284,10 @@ void ScriptController::updateDocument()
     if (!m_frame->document())
         return;
 
-    JSLock lock(SilenceAssertionsOnly);
-    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
+        JSLockHolder lock(iter->first->globalData());
         iter->second->window()->updateDocument();
+    }
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -300,7 +301,7 @@ Bindings::RootObject* ScriptController::cacheableBindingRootObject()
         return 0;
 
     if (!m_cacheableBindingRootObject) {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
         m_cacheableBindingRootObject = Bindings::RootObject::create(0, globalObject(pluginWorld()));
     }
     return m_cacheableBindingRootObject.get();
@@ -312,7 +313,7 @@ Bindings::RootObject* ScriptController::bindingRootObject()
         return 0;
 
     if (!m_bindingRootObject) {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
         m_bindingRootObject = Bindings::RootObject::create(0, globalObject(pluginWorld()));
     }
     return m_bindingRootObject.get();
@@ -335,10 +336,15 @@ void ScriptController::setCaptureCallStackForUncaughtExceptions(bool)
 {
 }
 
-void ScriptController::collectIsolatedContexts(Vector<std::pair<JSC::ExecState*, SecurityOrigin*> >&)
+void ScriptController::collectIsolatedContexts(Vector<std::pair<JSC::ExecState*, SecurityOrigin*> >& result)
 {
-    // FIXME(85709): support isolated contexts inspection for JSC.
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
+        JSC::ExecState* exec = iter->second->window()->globalExec();
+        SecurityOrigin* origin = iter->second->window()->impl()->securityOrigin();
+        result.append(std::pair<ScriptState*, SecurityOrigin*>(exec, origin));
+    }
 }
+
 #endif
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
@@ -349,9 +355,9 @@ NPObject* ScriptController::windowScriptNPObject()
         if (canExecuteScripts(NotAboutToExecuteScript)) {
             // JavaScript is enabled, so there is a JavaScript window object.
             // Return an NPObject bound to the window object.
-            JSC::JSLock lock(SilenceAssertionsOnly);
-            JSObject* win = windowShell(pluginWorld())->window();
+            JSDOMWindow* win = windowShell(pluginWorld())->window();
             ASSERT(win);
+            JSC::JSLockHolder lock(win->globalExec());
             Bindings::RootObject* root = bindingRootObject();
             m_windowScriptNPObject = _NPN_CreateScriptObject(0, win, root);
         } else {
@@ -383,8 +389,8 @@ JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
         return 0;
 
     // Create a JSObject bound to this element
-    JSLock lock(SilenceAssertionsOnly);
     JSDOMWindow* globalObj = globalObject(pluginWorld());
+    JSLockHolder lock(globalObj->globalExec());
     // FIXME: is normal okay? - used for NP plugins?
     JSValue jsElementValue = toJS(globalObj->globalExec(), globalObj, plugin);
     if (!jsElementValue || !jsElementValue.isObject())
@@ -418,7 +424,7 @@ void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
 
 void ScriptController::clearScriptObjects()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     RootObjectMap::const_iterator end = m_rootObjects.end();
     for (RootObjectMap::const_iterator it = m_rootObjects.begin(); it != end; ++it)
diff --git a/Source/WebCore/bindings/js/ScriptControllerMac.mm b/Source/WebCore/bindings/js/ScriptControllerMac.mm
index 50a5a7e71..66210c7df 100644
--- a/Source/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/Source/WebCore/bindings/js/ScriptControllerMac.mm
@@ -111,7 +111,7 @@ WebScriptObject* ScriptController::windowScriptObject()
         return 0;
 
     if (!m_windowScriptObject) {
-        JSC::JSLock lock(JSC::SilenceAssertionsOnly);
+        JSC::JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
         JSC::Bindings::RootObject* root = bindingRootObject();
         m_windowScriptObject = [WebScriptObject scriptObjectForJSObject:toRef(windowShell(pluginWorld())) originRootObject:root rootObject:root];
     }
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index f2227c745..9ace82d93 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -222,7 +222,7 @@ void ScriptDebugServer::dispatchDidPause(ScriptDebugListener* listener)
     {
         if (m_currentCallFrame->isValid() && globalObject->inherits(&JSDOMGlobalObject::s_info)) {
             JSDOMGlobalObject* domGlobalObject = jsCast<JSDOMGlobalObject*>(globalObject);
-            JSLock lock(SilenceAssertionsOnly);
+            JSLockHolder lock(state);
             jsCallFrame = toJS(state, domGlobalObject, m_currentCallFrame.get());
         } else
             jsCallFrame = jsUndefined();
diff --git a/Source/WebCore/bindings/js/ScriptEventListener.cpp b/Source/WebCore/bindings/js/ScriptEventListener.cpp
index 390fde117..7216b6f36 100644
--- a/Source/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/Source/WebCore/bindings/js/ScriptEventListener.cpp
@@ -98,7 +98,7 @@ String eventListenerHandlerBody(Document* document, EventListener* eventListener
     ASSERT(jsListener);
     if (!jsListener)
         return "";
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(jsListener->isolatedWorld()->globalData());
     JSC::JSObject* jsFunction = jsListener->jsFunction(document);
     if (!jsFunction)
         return "";
@@ -112,7 +112,7 @@ bool eventListenerHandlerLocation(Document* document, EventListener* eventListen
     ASSERT(jsListener);
     if (!jsListener)
         return false;
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(jsListener->isolatedWorld()->globalData());
     JSC::JSObject* jsObject = jsListener->jsFunction(document);
     if (!jsObject)
         return false;
diff --git a/Source/WebCore/bindings/js/ScriptFunctionCall.cpp b/Source/WebCore/bindings/js/ScriptFunctionCall.cpp
index 83b0e45b1..54778259a 100644
--- a/Source/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/Source/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -58,19 +58,19 @@ void ScriptCallArgumentHandler::appendArgument(const ScriptValue& argument)
 
 void ScriptCallArgumentHandler::appendArgument(const String& argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsString(m_exec, argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(const JSC::UString& argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsString(m_exec, argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(const char* argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsString(m_exec, UString(argument)));
 }
 
@@ -81,31 +81,31 @@ void ScriptCallArgumentHandler::appendArgument(JSC::JSValue argument)
 
 void ScriptCallArgumentHandler::appendArgument(long argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(long long argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(unsigned int argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(unsigned long argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(int argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
@@ -125,7 +125,7 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
 {
     JSObject* thisObject = m_thisObject.jsObject();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
 
     JSValue function = thisObject->get(m_exec, Identifier(m_exec, stringToUString(m_name)));
     if (m_exec->hadException()) {
@@ -163,7 +163,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
 {
     JSObject* thisObject = m_thisObject.jsObject();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
 
     JSObject* constructor = asObject(thisObject->get(m_exec, Identifier(m_exec, stringToUString(m_name))));
     if (m_exec->hadException()) {
@@ -205,7 +205,7 @@ ScriptValue ScriptCallback::call()
 
 ScriptValue ScriptCallback::call(bool& hadException)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
 
     CallData callData;
     CallType callType = getCallData(m_function.jsValue(), callData);
diff --git a/Source/WebCore/bindings/js/ScriptObject.cpp b/Source/WebCore/bindings/js/ScriptObject.cpp
index 0cfb82b6e..bf9140d07 100644
--- a/Source/WebCore/bindings/js/ScriptObject.cpp
+++ b/Source/WebCore/bindings/js/ScriptObject.cpp
@@ -67,7 +67,7 @@ static bool handleException(ScriptState* scriptState)
 
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     scriptState->lexicalGlobalObject()->putDirect(scriptState->globalData(), Identifier(scriptState, name), value.jsObject());
     return handleException(scriptState);
 }
@@ -75,7 +75,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const S
 #if ENABLE(INSPECTOR)
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorFrontendHost* value)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
     globalObject->putDirect(scriptState->globalData(), Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
@@ -83,7 +83,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
 
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InjectedScriptHost* value)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
     globalObject->putDirect(scriptState->globalData(), Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
@@ -92,7 +92,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Injecte
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     JSValue jsValue = scriptState->lexicalGlobalObject()->get(scriptState, Identifier(scriptState, name));
     if (!jsValue)
         return false;
@@ -106,7 +106,7 @@ bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptO
 
 bool ScriptGlobalObject::remove(ScriptState* scriptState, const char* name)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     scriptState->lexicalGlobalObject()->methodTable()->deleteProperty(scriptState->lexicalGlobalObject(), scriptState, Identifier(scriptState, name));
     return handleException(scriptState);
 }
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index 57685354f..782eac86b 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -38,6 +38,7 @@ namespace WebCore {
 
 class ExternalArrayVisitor;
 class ExternalStringVisitor;
+class MemoryInstrumentation;
 class NodeWrapperVisitor;
 class Page;
 class ScriptObject;
@@ -75,8 +76,10 @@ public:
     static bool hasHeapProfiler() { return false; }
     // FIXME: Implement this counter for JSC. See bug 73936 for more details.
     static void visitNodeWrappers(NodeWrapperVisitor*) { }
+    // FIXME: Support these methods for JSC. See bug 90358.
     static void visitExternalStrings(ExternalStringVisitor*) { }
     static void visitExternalArrays(ExternalArrayVisitor*) { }
+    static void collectBindingMemoryInfo(MemoryInstrumentation*) { }
     static size_t profilerSnapshotsSize() { return 0; }
 };
 
diff --git a/Source/WebCore/bindings/js/ScriptValue.cpp b/Source/WebCore/bindings/js/ScriptValue.cpp
index fd32872c7..83dfd5fb8 100644
--- a/Source/WebCore/bindings/js/ScriptValue.cpp
+++ b/Source/WebCore/bindings/js/ScriptValue.cpp
@@ -49,7 +49,7 @@ bool ScriptValue::getString(ScriptState* scriptState, String& result) const
 {
     if (!m_value)
         return false;
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     UString ustring;
     if (!m_value.get().getString(scriptState, ustring))
         return false;
@@ -175,6 +175,7 @@ static PassRefPtr<InspectorValue> jsToInspectorValue(ScriptState* scriptState, J
 
 PassRefPtr<InspectorValue> ScriptValue::toInspectorValue(ScriptState* scriptState) const
 {
+    JSC::JSLockHolder holder(scriptState);
     return jsToInspectorValue(scriptState, m_value.get(), InspectorValue::maxDepth);
 }
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
index e2e607d95..9bfde8f2a 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
@@ -64,7 +64,7 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
 
 WorkerScriptController::~WorkerScriptController()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(globalData());
     m_workerContextWrapper.clear();
     m_globalData.clear();
 }
@@ -73,7 +73,7 @@ void WorkerScriptController::initScript()
 {
     ASSERT(!m_workerContextWrapper);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_globalData.get());
 
     // Explicitly protect the global object's prototype so it isn't collected
     // when we allocate the global object. (Once the global object is fully
@@ -117,7 +117,7 @@ void WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
     ScriptValue exception;
     evaluate(sourceCode, &exception);
     if (exception.jsValue()) {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(globalData());
         reportException(m_workerContextWrapper->globalExec(), exception.jsValue());
     }
 }
@@ -128,9 +128,9 @@ void WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode, Script
         return;
 
     initScriptIfNeeded();
-    JSLock lock(SilenceAssertionsOnly);
 
     ExecState* exec = m_workerContextWrapper->globalExec();
+    JSLockHolder lock(exec);
 
     m_workerContextWrapper->globalData().timeoutChecker.start();
 
@@ -191,7 +191,7 @@ bool WorkerScriptController::isExecutionForbidden() const
 void WorkerScriptController::disableEval()
 {
     initScriptIfNeeded();
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(globalData());
 
     m_workerContextWrapper->setEvalEnabled(false);
 }
diff --git a/Source/WebCore/bindings/objc/WebScriptObject.mm b/Source/WebCore/bindings/objc/WebScriptObject.mm
index aeef94131..cf55e7415 100644
--- a/Source/WebCore/bindings/objc/WebScriptObject.mm
+++ b/Source/WebCore/bindings/objc/WebScriptObject.mm
@@ -84,6 +84,9 @@ void removeJSWrapper(JSObject* impl)
 
 id createJSWrapper(JSC::JSObject* object, PassRefPtr<JSC::Bindings::RootObject> origin, PassRefPtr<JSC::Bindings::RootObject> root)
 {
+    // NSMap is not thread safe, hold the JSC API lock; also synchronize this vs. release.
+    JSC::JSLockHolder holder(JSDOMWindowBase::commonJSGlobalData());
+
     if (id wrapper = getJSWrapper(object))
         return [[wrapper retain] autorelease];
     return [[[WebScriptObject alloc] _initWithJSObject:object originRootObject:origin rootObject:root] autorelease];
@@ -122,13 +125,12 @@ static void addExceptionToConsole(ExecState* exec)
 
 static void _didExecute(WebScriptObject *obj)
 {
-    ASSERT(JSLock::lockCount() > 0);
-    
     RootObject* root = [obj _rootObject];
     if (!root)
         return;
 
     ExecState* exec = root->globalObject()->globalExec();
+    ASSERT(exec->globalData().apiLock().currentThreadIsHoldingLock());
     KJSDidExecuteFunctionPtr func = Instance::didExecuteFunction();
     if (func)
         func(exec, root->globalObject());
@@ -146,6 +148,9 @@ static void _didExecute(WebScriptObject *obj)
     _private->rootObject = rootObject.leakRef();
     _private->originRootObject = originRootObject.leakRef();
 
+    // NSMap is not thread safe, hold the JSC API lock.
+    JSC::JSLockHolder holder(JSDOMWindowBase::commonJSGlobalData());
+
     WebCore::addJSWrapper(self, imp);
 
     if (_private->rootObject)
@@ -224,14 +229,26 @@ static void _didExecute(WebScriptObject *obj)
     return jsCast<JSDOMWindowBase*>(root->globalObject())->allowsAccessFrom(_private->originRootObject->globalObject());
 }
 
+- (oneway void)release
+{
+    {
+        // NSMap is not thread safe, hold the JSC API lock; also synchronize this vs. getJSWrapper.
+        JSC::JSLockHolder holder(JSDOMWindowBase::commonJSGlobalData());
+
+        // If we're releasing the last reference to this object, remove if from the map,
+        // this will prevent this object from being returned by getJSWrapper.
+        if (_private->imp && [self retainCount] == 1)
+            WebCore::removeJSWrapper(_private->imp);
+    }
+
+    [super release];
+}
+
 - (void)dealloc
 {
     if (WebCoreObjCScheduleDeallocateOnMainThread([WebScriptObject class], self))
         return;
 
-    if (_private->imp)
-        WebCore::removeJSWrapper(_private->imp);
-
     if (_private->rootObject && _private->rootObject->isValid())
         _private->rootObject->gcUnprotect(_private->imp);
 
@@ -281,10 +298,9 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     if (![self _isSafeScript])
         return nil;
 
-    JSLock lock(SilenceAssertionsOnly);
-    
     // Look up the function object.
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
+    JSLockHolder lock(exec);
     ASSERT(!exec->hadException());
 
     JSValue function = [self _imp]->get(exec, Identifier(exec, stringToUString(String(name))));
@@ -325,7 +341,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     
     [self _rootObject]->globalObject()->globalData().timeoutChecker.start();
     JSValue returnValue = JSMainThreadExecState::evaluate(exec, [self _rootObject]->globalObject()->globalScopeChain(), makeSource(String(script)), JSC::JSValue(), 0);
@@ -346,7 +362,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     PutPropertySlot slot;
     [self _imp]->methodTable()->put([self _imp], exec, Identifier(exec, stringToUString(String(key))), convertObjcValueToValue(exec, &value, ObjcObjectType, [self _rootObject]), slot);
@@ -372,7 +388,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
         // Need to scope this lock to ensure that we release the lock before calling
         // [super valueForKey:key] which might throw an exception and bypass the JSLock destructor,
         // leaving the lock permanently held
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         
         JSValue result = [self _imp]->get(exec, Identifier(exec, stringToUString(String(key))));
         
@@ -388,7 +404,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     if ([resultObj isKindOfClass:[WebUndefined class]])
         resultObj = [super valueForKey:key];    // defaults to throwing an exception
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     _didExecute(self);
     
     return resultObj;
@@ -402,7 +418,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     [self _imp]->methodTable()->deleteProperty([self _imp], exec, Identifier(exec, stringToUString(String(key))));
 
     if (exec->hadException()) {
@@ -421,7 +437,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     BOOL result = [self _imp]->hasProperty(exec, Identifier(exec, stringToUString(String(key))));
 
     if (exec->hadException()) {
@@ -441,8 +457,8 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
         return @"Undefined";
     }
 
-    JSLock lock(SilenceAssertionsOnly);
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
+    JSLockHolder lock(exec);
     
     id result = convertValueToObjcValue(exec, [self _imp], ObjcObjectType).objectValue;
 
@@ -461,7 +477,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSValue result = [self _imp]->get(exec, index);
 
     if (exec->hadException()) {
@@ -485,7 +501,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     [self _imp]->methodTable()->putByIndex([self _imp], exec, index, convertObjcValueToValue(exec, &value, ObjcObjectType, [self _rootObject]), false);
 
     if (exec->hadException()) {
@@ -515,7 +531,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
 {
     if (value.isObject()) {
         JSObject* object = asObject(value);
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(rootObject->globalObject()->globalData());
 
         if (object->inherits(&JSHTMLElement::s_info)) {
             // Plugin elements cache the instance internally.
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index e45e762db..31c164bf0 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -1260,10 +1260,18 @@ sub GenerateParametersCheckExpression
             $usedArguments{$parameterIndex} = 1;
         } elsif (IsArrayType($type)) {
             # FIXME: Add proper support for T[], T[]?, sequence<T>
-            push(@andExpression, "(${value}.isNull() || (${value}.isObject() && asObject(${value})->inherits(&JSArray::s_info)))");
+            if ($parameter->isNullable) {
+                push(@andExpression, "(${value}.isNull() || (${value}.isObject() && isJSArray(${value})))");
+            } else {
+                push(@andExpression, "(${value}.isObject() && isJSArray(${value}))");
+            }
             $usedArguments{$parameterIndex} = 1;
         } elsif (!IsNativeType($type)) {
-            push(@andExpression, "(${value}.isNull() || (${value}.isObject() && asObject(${value})->inherits(&JS${type}::s_info)))");
+            if ($parameter->isNullable) {
+                push(@andExpression, "(${value}.isNull() || (${value}.isObject() && asObject(${value})->inherits(&JS${type}::s_info)))");
+            } else {
+                push(@andExpression, "(${value}.isObject() && asObject(${value})->inherits(&JS${type}::s_info))");
+            }
             $usedArguments{$parameterIndex} = 1;
         }
         $parameterIndex++;
@@ -2346,7 +2354,7 @@ sub GenerateImplementation
                 $rootString .= "    void* root = WebCore::root(element);\n";
             } elsif ($interfaceName eq "CanvasRenderingContext") {
                 $rootString  = "    void* root = WebCore::root(js${implClassName}->impl()->canvas());\n";
-            } elsif ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
+            } elsif (GetGenerateIsReachable($dataNode) eq "ImplBaseRoot") {
                 $rootString  = "    void* root = WebCore::root(js${implClassName}->impl()->base());\n";
             } else {
                 $rootString  = "    void* root = WebCore::root(js${implClassName}->impl());\n";
@@ -2745,7 +2753,7 @@ END
             push(@implContent, "    if (!canInvokeCallback())\n");
             push(@implContent, "        return true;\n\n");
             push(@implContent, "    RefPtr<$className> protect(this);\n\n");
-            push(@implContent, "    JSLock lock(SilenceAssertionsOnly);\n\n");
+            push(@implContent, "    JSLockHolder lock(m_data->globalObject()->globalData());\n\n");
             push(@implContent, "    ExecState* exec = m_data->globalObject()->globalExec();\n");
             push(@implContent, "    MarkedArgumentBuffer args;\n");
 
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 254ec9396..3b0115bdf 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -214,12 +214,14 @@ void V8${implClassName}::visitDOMWrapper(DOMDataStore* store, void* object, v8::
 END
     if (GetGenerateIsReachable($dataNode) eq  "ImplElementRoot" ||
         GetGenerateIsReachable($dataNode) eq  "ImplOwnerRoot" ||
-        GetGenerateIsReachable($dataNode) eq  "ImplOwnerNodeRoot") {
+        GetGenerateIsReachable($dataNode) eq  "ImplOwnerNodeRoot" ||
+        GetGenerateIsReachable($dataNode) eq  "ImplBaseRoot") {
 
         my $methodName;
         $methodName = "element" if (GetGenerateIsReachable($dataNode) eq "ImplElementRoot");
         $methodName = "owner" if (GetGenerateIsReachable($dataNode) eq "ImplOwnerRoot");
         $methodName = "ownerNode" if (GetGenerateIsReachable($dataNode) eq "ImplOwnerNodeRoot");
+        $methodName = "base" if (GetGenerateIsReachable($dataNode) eq "ImplBaseRoot");
 
         push(@implContent, <<END);
     if (Node* owner = impl->${methodName}()) {
@@ -1060,7 +1062,7 @@ END
     MessagePortArray portsCopy(*ports);
     v8::Local<v8::Array> portArray = v8::Array::New(portsCopy.size());
     for (size_t i = 0; i < portsCopy.size(); ++i)
-        portArray->Set(v8::Integer::New(i), toV8(portsCopy[i].get(), info.GetIsolate()));
+        portArray->Set(v8Integer(i, info.GetIsolate()), toV8(portsCopy[i].get(), info.GetIsolate()));
     return portArray;
 END
     } else {
@@ -1355,9 +1357,17 @@ sub GenerateParametersCheckExpression
             push(@andExpression, "(${value}->IsNull() || ${value}->IsFunction())");
         } elsif (IsArrayType($type)) {
             # FIXME: Add proper support for T[], T[]?, sequence<T>.
-            push(@andExpression, "(${value}->IsNull() || ${value}->IsArray())");
+            if ($parameter->isNullable) {
+                push(@andExpression, "(${value}->IsNull() || ${value}->IsArray())");
+            } else {
+                push(@andExpression, "(${value}->IsArray())");
+            }
         } elsif (IsWrapperType($type)) {
-            push(@andExpression, "(${value}->IsNull() || V8${type}::HasInstance($value))");
+            if ($parameter->isNullable) {
+                push(@andExpression, "(${value}->IsNull() || V8${type}::HasInstance($value))");
+            } else {
+                push(@andExpression, "(V8${type}::HasInstance($value))");
+            }
         }
 
         $parameterIndex++;
@@ -3509,8 +3519,6 @@ sub IsRefPtrType
     return 0 if $type eq "unsigned";
     return 0 if $type eq "unsigned long";
     return 0 if $type eq "unsigned short";
-    return 0 if $type eq "float[]";
-    return 0 if $type eq "double[]";
 
     return 1;
 }
@@ -3571,8 +3579,6 @@ sub GetNativeType
     return "RefPtr<MediaQueryListListener>" if $type eq "MediaQueryListListener";
 
     # FIXME: Support T[], T[]?, sequence<T> generically
-    return "Vector<float>" if $type eq "float[]";
-    return "Vector<double>" if $type eq "double[]";
     return "RefPtr<DOMStringList>" if $type eq "DOMStringList";
 
     # Default, assume native type is a pointer with same type name as idl type
@@ -3631,14 +3637,6 @@ sub JSValueToNative
     return "v8ValueToWebCoreDOMStringList($value)" if $type eq "DOMStringList";
     # FIXME: Add proper support for T[], T[]? and sequence<T>.
     return "v8ValueToWebCoreDOMStringList($value)" if $type eq "DOMString[]";
-    if ($type eq "float[]") {
-        AddToImplIncludes("wtf/Vector.h");
-        return "v8NumberArrayToVector<float>($value)";
-    }
-    if ($type eq "double[]") {
-        AddToImplIncludes("wtf/Vector.h");
-        return "v8NumberArrayToVector<double>($value)";
-    }
 
     if ($type eq "DOMString" or $type eq "DOMUserData") {
         return $value;
@@ -3818,9 +3816,7 @@ my %non_wrapper_types = (
     'SerializedScriptValue' => 1,
     'boolean' => 1,
     'double' => 1,
-    'double[]' => 1,
     'float' => 1,
-    'float[]' => 1,
     'int' => 1,
     'long long' => 1,
     'long' => 1,
@@ -3892,14 +3888,14 @@ sub NativeToJSValue
     # should be returned instead.
     if ($signature->extendedAttributes->{"Reflect"} and ($type eq "unsigned long" or $type eq "unsigned short")) {
         $value =~ s/getUnsignedIntegralAttribute/getIntegralAttribute/g;
-        return "v8::Integer::NewFromUnsigned(std::max(0, " . $value . "))";
+        return "v8UnsignedInteger(std::max(0, " . $value . ")$getIsolateArg)";
     }
 
     # For all the types where we use 'int' as the representation type,
-    # we use Integer::New which has a fast Smi conversion check.
+    # we use v8Integer() which has a fast small integer conversion check.
     my $nativeType = GetNativeType($type);
-    return "v8::Integer::New($value)" if $nativeType eq "int";
-    return "v8::Integer::NewFromUnsigned($value)" if $nativeType eq "unsigned";
+    return "v8Integer($value$getIsolateArg)" if $nativeType eq "int";
+    return "v8UnsignedInteger($value$getIsolateArg)" if $nativeType eq "unsigned";
 
     return "v8DateOrNull($value$getIsolateArg)" if $type eq "Date";
     # long long and unsigned long long are not representable in ECMAScript.
@@ -3907,9 +3903,6 @@ sub NativeToJSValue
     return "v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type);
     return "$value.v8Value()" if $nativeType eq "ScriptValue";
 
-    return "v8NumberArray($value)" if $type eq "float[]";
-    return "v8NumberArray($value)" if $type eq "double[]";
-
     if ($codeGenerator->IsStringType($type)) {
         my $conv = $signature->extendedAttributes->{"TreatReturnedNullStringAs"};
         if (defined $conv) {
diff --git a/Source/WebCore/bindings/scripts/IDLAttributes.txt b/Source/WebCore/bindings/scripts/IDLAttributes.txt
index 4fe771b1c..b6d890e72 100644
--- a/Source/WebCore/bindings/scripts/IDLAttributes.txt
+++ b/Source/WebCore/bindings/scripts/IDLAttributes.txt
@@ -52,7 +52,7 @@ DoNotCheckSecurityOnGetter
 DoNotCheckSecurityOnSetter
 EventTarget
 ExtendsDOMGlobalObject
-GenerateIsReachable=|Impl|ImplContext|ImplDocument|ImplElementRoot|ImplFrame
+GenerateIsReachable=ImplElementRoot|ImplBaseRoot
 Immutable
 ImplementedAs=*
 IndexedGetter
@@ -75,7 +75,7 @@ JSCustomPushEventHandlerScope
 JSCustomSetter
 JSCustomToJSObject
 JSCustomToNativeObject
-JSGenerateIsReachable=|Impl|ImplContext|ImplDocument|ImplElementRoot|ImplFrame
+JSGenerateIsReachable=|Impl|ImplContext|ImplDocument|ImplElementRoot|ImplFrame|ImplBaseRoot
 JSGenerateToJSObject
 JSGenerateToNativeObject
 JSInlineGetOwnPropertySlot
@@ -116,6 +116,6 @@ V8DependentLifetime
 V8DoNotCheckSignature
 V8EnabledAtRuntime=*
 V8EnabledPerContext=*
-V8GenerateIsReachable=|ImplElementRoot|ImplOwnerRoot|ImplOwnerNodeRoot
+V8GenerateIsReachable=ImplElementRoot|ImplOwnerRoot|ImplOwnerNodeRoot|ImplBaseRoot
 V8ReadOnly
 V8Unforgeable
diff --git a/Source/WebCore/bindings/scripts/IDLParser.pm b/Source/WebCore/bindings/scripts/IDLParser.pm
index 0f08a353d..af02c64bb 100644
--- a/Source/WebCore/bindings/scripts/IDLParser.pm
+++ b/Source/WebCore/bindings/scripts/IDLParser.pm
@@ -244,13 +244,17 @@ sub parseParameters
         my $paramDirection = $1;
         my $paramExtendedAttributes = (defined($2) ? $2 : " "); chop($paramExtendedAttributes);
         my $paramType = (defined($3) ? $3 : die("Parsing error!\nSource:\n$line\n)"));
-        my $paramName = (defined($4) ? $4 : die("Parsing error!\nSource:\n$line\n)"));
+        my $paramTypeSuffix = defined($4) ? $4 : "";
+        my $paramName = (defined($5) ? $5 : die("Parsing error!\nSource:\n$line\n)"));
+
+        my $isNullable = $paramTypeSuffix eq "?";
 
         my $paramDataNode = new domSignature();
         $paramDataNode->direction($paramDirection);
         $paramDataNode->name($paramName);
         $paramDataNode->type($paramType);
         $paramDataNode->extendedAttributes(parseExtendedAttributes($paramExtendedAttributes));
+        $paramDataNode->isNullable($isNullable);
 
         my $arrayRef = $newDataNode->parameters;
         push(@$arrayRef, $paramDataNode);
diff --git a/Source/WebCore/bindings/scripts/IDLStructure.pm b/Source/WebCore/bindings/scripts/IDLStructure.pm
index 5424153dc..5e1ab45f9 100644
--- a/Source/WebCore/bindings/scripts/IDLStructure.pm
+++ b/Source/WebCore/bindings/scripts/IDLStructure.pm
@@ -65,7 +65,8 @@ struct( domSignature => {
     direction => '$', # Variable direction (in or out)
     name => '$',      # Variable name
     type => '$',      # Variable type
-    extendedAttributes => '$' # Extended attributes
+    extendedAttributes => '$', # Extended attributes
+    isNullable => '$' # Is variable type Nullable (T?)
 });
 
 # Used to represent string constants
@@ -90,6 +91,7 @@ our $idlDataType = '[a-zA-Z0-9\ ]';   # Generic data type identifier
 
 # Magic IDL parsing regular expressions
 my $supportedTypes = "((?:(?:unsigned )?(?:int|short|(?:long )?long)|(?:$idlIdNs*))(?:\\[\\]|<(?:$idlIdNsList*)>)?)";
+my $supportedTypeSuffix = "(\\?)?";
 
 # Special IDL notations. This regular expression extracts the string between the first [ and its corresponding ].
 our $extendedAttributeSyntax = qr/\[[^\[\]]*(?:(??{$IDLStructure::extendedAttributeSyntax})[^\[\]]*)*\]/x; # Used for extended attributes
@@ -104,9 +106,9 @@ our $setterRaisesSelector = '\bsetter\s+raises\s*\((' . $idlIdNsList . '*)\s*\)'
 
 our $typeNamespaceSelector = '((?:' . $idlId . '*::)*)\s*(' . $idlDataType . '*)';
 
-our $interfaceSelector = '(interface|exception)\s*((?:' . $extendedAttributeSyntax . ' )?)(' . $idlIdNs . '*)\s*(?::(\s*[^{]*))?{([-a-zA-Z0-9_"=\s(),;:\[\]<>&\|]*)';
-our $interfaceMethodSelector = '\s*((?:' . $extendedAttributeSyntax . ' )?)(static\s+)?' . $supportedTypes . '\s*(' . $idlIdNs . '*)\s*\(\s*([a-zA-Z0-9:\s,=\[\]<>]*)';
-our $interfaceParameterSelector = '(in|out)\s*((?:' . $extendedAttributeSyntax . ' )?)' . $supportedTypes . '\s*(' . $idlIdNs . '*)';
+our $interfaceSelector = '(interface|exception)\s*((?:' . $extendedAttributeSyntax . ' )?)(' . $idlIdNs . '*)\s*(?::(\s*[^{]*))?{([-a-zA-Z0-9_"=\s(),;:\[\]<>&\|?]*)';
+our $interfaceMethodSelector = '\s*((?:' . $extendedAttributeSyntax . ' )?)(static\s+)?' . $supportedTypes . '\s*(' . $idlIdNs . '*)\s*\(\s*([a-zA-Z0-9:\s,=\[\]<>?]*)';
+our $interfaceParameterSelector = '(in|out)\s*((?:' . $extendedAttributeSyntax . ' )?)' . $supportedTypes . $supportedTypeSuffix . '\s*(' . $idlIdNs . '*)';
 
 our $interfaceAttributeSelector = '\s*(readonly attribute|attribute)\s*(' . $extendedAttributeSyntax . ' )?' . $supportedTypes . '\s*(' . $idlType . '*)';
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
index abae044e6..e7ba4c069 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
@@ -65,7 +65,7 @@ bool JSTestCallback::callbackWithNoParam()
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -82,7 +82,7 @@ bool JSTestCallback::callbackWithClass1Param(Class1* class1Param)
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -100,7 +100,7 @@ bool JSTestCallback::callbackWithClass2Param(Class2* class2Param, const String&
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -119,7 +119,7 @@ bool JSTestCallback::callbackWithStringList(PassRefPtr<DOMStringList> listParam)
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -137,7 +137,7 @@ bool JSTestCallback::callbackWithBoolean(bool boolParam)
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -157,7 +157,7 @@ bool JSTestCallback::callbackRequiresThisToPass(Class8* class8Param, ThisClass*
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index f4a5cd858..255eb560b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -2143,6 +2143,40 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod7(
     return JSValue::encode(jsUndefined());
 }
 
+static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod8(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    if (exec->argumentCount() < 1)
+        return throwVMError(exec, createNotEnoughArgumentsError(exec));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->overloadedMethod(objArg);
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod9(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    if (exec->argumentCount() < 1)
+        return throwVMError(exec, createNotEnoughArgumentsError(exec));
+    RefPtr<DOMStringList> arrayArg(toDOMStringList(exec, MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->overloadedMethod(arrayArg);
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(ExecState* exec)
 {
     size_t argsCount = exec->argumentCount();
@@ -2160,8 +2194,12 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(ExecStat
         return jsTestObjPrototypeFunctionOverloadedMethod5(exec);
     if ((argsCount == 1 && (arg0.isNull() || (arg0.isObject() && asObject(arg0)->inherits(&JSDOMStringList::s_info)))))
         return jsTestObjPrototypeFunctionOverloadedMethod6(exec);
-    if ((argsCount == 1 && (arg0.isNull() || (arg0.isObject() && asObject(arg0)->inherits(&JSArray::s_info)))))
+    if ((argsCount == 1 && (arg0.isNull() || (arg0.isObject() && isJSArray(arg0)))))
         return jsTestObjPrototypeFunctionOverloadedMethod7(exec);
+    if ((argsCount == 1 && (arg0.isObject() && asObject(arg0)->inherits(&JSTestObj::s_info))))
+        return jsTestObjPrototypeFunctionOverloadedMethod8(exec);
+    if ((argsCount == 1 && (arg0.isObject() && isJSArray(arg0))))
+        return jsTestObjPrototypeFunctionOverloadedMethod9(exec);
     return throwVMTypeError(exec);
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/TestObj.idl b/Source/WebCore/bindings/scripts/test/TestObj.idl
index ef342f8be..513df1074 100644
--- a/Source/WebCore/bindings/scripts/test/TestObj.idl
+++ b/Source/WebCore/bindings/scripts/test/TestObj.idl
@@ -163,12 +163,14 @@ module test {
 
 #if defined(TESTING_V8) || defined(TESTING_JS)
         // Overloads
-        void    overloadedMethod(in TestObj objArg, in DOMString strArg);
-        void    overloadedMethod(in TestObj objArg, in [Optional] long intArg);
+        void    overloadedMethod(in TestObj? objArg, in DOMString strArg);
+        void    overloadedMethod(in TestObj? objArg, in [Optional] long intArg);
         void    overloadedMethod(in DOMString strArg);
         void    overloadedMethod(in long intArg);
         void    overloadedMethod(in [Callback] TestCallback callback);
-        void    overloadedMethod(in DOMStringList listArg);
+        void    overloadedMethod(in DOMStringList? listArg);
+        void    overloadedMethod(in DOMString[]? arrayArg);
+        void    overloadedMethod(in TestObj objArg);
         void    overloadedMethod(in DOMString[] arrayArg);
 #endif
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
index 37817d5ff..0a9b88ada 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
@@ -45,7 +45,7 @@ static v8::Handle<v8::Value> excitingAttrAttrGetter(v8::Local<v8::String> name,
 {
     INC_STATS("DOM.TestActiveDOMObject.excitingAttr._get");
     TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(info.Holder());
-    return v8::Integer::New(imp->excitingAttr());
+    return v8Integer(imp->excitingAttr(), info.GetIsolate());
 }
 
 static v8::Handle<v8::Value> excitingFunctionCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 40b8d9dbd..adf5562d6 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -60,7 +60,6 @@
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 #include <wtf/UnusedParam.h>
-#include <wtf/Vector.h>
 
 #if ENABLE(Condition1)
 #include "V8TestObjectA.h"
@@ -86,7 +85,7 @@ static v8::Handle<v8::Value> readOnlyIntAttrAttrGetter(v8::Local<v8::String> nam
 {
     INC_STATS("DOM.TestObj.readOnlyIntAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->readOnlyIntAttr());
+    return v8Integer(imp->readOnlyIntAttr(), info.GetIsolate());
 }
 
 static v8::Handle<v8::Value> readOnlyStringAttrAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
@@ -114,7 +113,7 @@ static v8::Handle<v8::Value> shortAttrAttrGetter(v8::Local<v8::String> name, con
 {
     INC_STATS("DOM.TestObj.shortAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->shortAttr());
+    return v8Integer(imp->shortAttr(), info.GetIsolate());
 }
 
 static void shortAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -130,7 +129,7 @@ static v8::Handle<v8::Value> unsignedShortAttrAttrGetter(v8::Local<v8::String> n
 {
     INC_STATS("DOM.TestObj.unsignedShortAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->unsignedShortAttr());
+    return v8Integer(imp->unsignedShortAttr(), info.GetIsolate());
 }
 
 static void unsignedShortAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -146,7 +145,7 @@ static v8::Handle<v8::Value> intAttrAttrGetter(v8::Local<v8::String> name, const
 {
     INC_STATS("DOM.TestObj.intAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->intAttr());
+    return v8Integer(imp->intAttr(), info.GetIsolate());
 }
 
 static void intAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -274,7 +273,7 @@ static v8::Handle<v8::Value> reflectedIntegralAttrAttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.reflectedIntegralAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->getIntegralAttribute(WebCore::HTMLNames::reflectedintegralattrAttr));
+    return v8Integer(imp->getIntegralAttribute(WebCore::HTMLNames::reflectedintegralattrAttr), info.GetIsolate());
 }
 
 static void reflectedIntegralAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -290,7 +289,7 @@ static v8::Handle<v8::Value> reflectedUnsignedIntegralAttrAttrGetter(v8::Local<v
 {
     INC_STATS("DOM.TestObj.reflectedUnsignedIntegralAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::NewFromUnsigned(std::max(0, imp->getIntegralAttribute(WebCore::HTMLNames::reflectedunsignedintegralattrAttr)));
+    return v8UnsignedInteger(std::max(0, imp->getIntegralAttribute(WebCore::HTMLNames::reflectedunsignedintegralattrAttr)), info.GetIsolate());
 }
 
 static void reflectedUnsignedIntegralAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -354,7 +353,7 @@ static v8::Handle<v8::Value> reflectedCustomIntegralAttrAttrGetter(v8::Local<v8:
 {
     INC_STATS("DOM.TestObj.reflectedCustomIntegralAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->getIntegralAttribute(WebCore::HTMLNames::customContentIntegralAttrAttr));
+    return v8Integer(imp->getIntegralAttribute(WebCore::HTMLNames::customContentIntegralAttrAttr), info.GetIsolate());
 }
 
 static void reflectedCustomIntegralAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -406,7 +405,7 @@ static v8::Handle<v8::Value> attrWithGetterExceptionAttrGetter(v8::Local<v8::Str
     int v = imp->attrWithGetterException(ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, info.GetIsolate());
-    return v8::Integer::New(v);
+    return v8Integer(v, info.GetIsolate());
 }
 
 static void attrWithGetterExceptionAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -425,7 +424,7 @@ static v8::Handle<v8::Value> attrWithSetterExceptionAttrGetter(v8::Local<v8::Str
 {
     INC_STATS("DOM.TestObj.attrWithSetterException._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->attrWithSetterException());
+    return v8Integer(imp->attrWithSetterException(), info.GetIsolate());
 }
 
 static void attrWithSetterExceptionAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -489,7 +488,7 @@ static v8::Handle<v8::Value> withScriptStateAttributeAttrGetter(v8::Local<v8::St
     ScriptState* state = ScriptState::current();
     if (!state)
         return v8::Undefined();
-    return v8::Integer::New(imp->withScriptStateAttribute(state));
+    return v8Integer(imp->withScriptStateAttribute(state), info.GetIsolate());
 }
 
 static void withScriptStateAttributeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -717,7 +716,7 @@ static v8::Handle<v8::Value> conditionalAttr1AttrGetter(v8::Local<v8::String> na
 {
     INC_STATS("DOM.TestObj.conditionalAttr1._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->conditionalAttr1());
+    return v8Integer(imp->conditionalAttr1(), info.GetIsolate());
 }
 
 #endif // ENABLE(Condition1)
@@ -741,7 +740,7 @@ static v8::Handle<v8::Value> conditionalAttr2AttrGetter(v8::Local<v8::String> na
 {
     INC_STATS("DOM.TestObj.conditionalAttr2._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->conditionalAttr2());
+    return v8Integer(imp->conditionalAttr2(), info.GetIsolate());
 }
 
 #endif // ENABLE(Condition1) && ENABLE(Condition2)
@@ -765,7 +764,7 @@ static v8::Handle<v8::Value> conditionalAttr3AttrGetter(v8::Local<v8::String> na
 {
     INC_STATS("DOM.TestObj.conditionalAttr3._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->conditionalAttr3());
+    return v8Integer(imp->conditionalAttr3(), info.GetIsolate());
 }
 
 #endif // ENABLE(Condition1) || ENABLE(Condition2)
@@ -815,7 +814,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeAttr1AttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.enabledAtRuntimeAttr1._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->enabledAtRuntimeAttr1());
+    return v8Integer(imp->enabledAtRuntimeAttr1(), info.GetIsolate());
 }
 
 static void enabledAtRuntimeAttr1AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -831,7 +830,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeAttr2AttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.enabledAtRuntimeAttr2._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->enabledAtRuntimeAttr2());
+    return v8Integer(imp->enabledAtRuntimeAttr2(), info.GetIsolate());
 }
 
 static void enabledAtRuntimeAttr2AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -847,7 +846,7 @@ static v8::Handle<v8::Value> enabledAtContextAttr1AttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.enabledAtContextAttr1._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->enabledAtContextAttr1());
+    return v8Integer(imp->enabledAtContextAttr1(), info.GetIsolate());
 }
 
 static void enabledAtContextAttr1AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -863,7 +862,7 @@ static v8::Handle<v8::Value> enabledAtContextAttr2AttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.enabledAtContextAttr2._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->enabledAtContextAttr2());
+    return v8Integer(imp->enabledAtContextAttr2(), info.GetIsolate());
 }
 
 static void enabledAtContextAttr2AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -879,14 +878,14 @@ static v8::Handle<v8::Value> floatArrayAttrGetter(v8::Local<v8::String> name, co
 {
     INC_STATS("DOM.TestObj.floatArray._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8NumberArray(imp->floatArray());
+    return v8Array(imp->floatArray(), info.GetIsolate());
 }
 
 static void floatArrayAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.TestObj.floatArray._set");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    Vector<float> v = v8NumberArrayToVector<float>(value);
+    Vector<float> v = toNativeArray<float>(value);
     imp->setFloatArray(v);
     return;
 }
@@ -895,14 +894,14 @@ static v8::Handle<v8::Value> doubleArrayAttrGetter(v8::Local<v8::String> name, c
 {
     INC_STATS("DOM.TestObj.doubleArray._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8NumberArray(imp->doubleArray());
+    return v8Array(imp->doubleArray(), info.GetIsolate());
 }
 
 static void doubleArrayAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.TestObj.doubleArray._set");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    Vector<double> v = v8NumberArrayToVector<double>(value);
+    Vector<double> v = toNativeArray<double>(value);
     imp->setDoubleArray(v);
     return;
 }
@@ -953,7 +952,7 @@ static v8::Handle<v8::Value> strawberryAttrGetter(v8::Local<v8::String> name, co
 {
     INC_STATS("DOM.TestObj.strawberry._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->blueberry());
+    return v8Integer(imp->blueberry(), info.GetIsolate());
 }
 
 static void strawberryAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -985,14 +984,14 @@ static v8::Handle<v8::Value> descriptionAttrGetter(v8::Local<v8::String> name, c
 {
     INC_STATS("DOM.TestObj.description._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->description());
+    return v8Integer(imp->description(), info.GetIsolate());
 }
 
 static v8::Handle<v8::Value> idAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.TestObj.id._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->id());
+    return v8Integer(imp->id(), info.GetIsolate());
 }
 
 static void idAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -1044,7 +1043,7 @@ static v8::Handle<v8::Value> intMethodCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.intMethod");
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    return v8::Integer::New(imp->intMethod());
+    return v8Integer(imp->intMethod(), args.GetIsolate());
 }
 
 static v8::Handle<v8::Value> intMethodWithArgsCallback(const v8::Arguments& args)
@@ -1056,7 +1055,7 @@ static v8::Handle<v8::Value> intMethodWithArgsCallback(const v8::Arguments& args
     EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
     EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
-    return v8::Integer::New(imp->intMethodWithArgs(intArg, strArg, objArg));
+    return v8Integer(imp->intMethodWithArgs(intArg, strArg, objArg), args.GetIsolate());
 }
 
 static v8::Handle<v8::Value> objMethodCallback(const v8::Arguments& args)
@@ -1572,6 +1571,28 @@ static v8::Handle<v8::Value> overloadedMethod7Callback(const v8::Arguments& args
     return v8::Handle<v8::Value>();
 }
 
+static v8::Handle<v8::Value> overloadedMethod8Callback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.overloadedMethod8");
+    if (args.Length() < 1)
+        return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
+    imp->overloadedMethod(objArg);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> overloadedMethod9Callback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.overloadedMethod9");
+    if (args.Length() < 1)
+        return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    EXCEPTION_BLOCK(RefPtr<DOMStringList>, arrayArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    imp->overloadedMethod(arrayArg);
+    return v8::Handle<v8::Value>();
+}
+
 static v8::Handle<v8::Value> overloadedMethodCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.overloadedMethod");
@@ -1589,6 +1610,10 @@ static v8::Handle<v8::Value> overloadedMethodCallback(const v8::Arguments& args)
         return overloadedMethod6Callback(args);
     if ((args.Length() == 1 && (args[0]->IsNull() || args[0]->IsArray())))
         return overloadedMethod7Callback(args);
+    if ((args.Length() == 1 && (V8TestObj::HasInstance(args[0]))))
+        return overloadedMethod8Callback(args);
+    if ((args.Length() == 1 && (args[0]->IsArray())))
+        return overloadedMethod9Callback(args);
     return V8Proxy::throwTypeError(0, args.GetIsolate());
 }
 
@@ -1603,10 +1628,10 @@ static v8::Handle<v8::Value> classMethodWithOptionalCallback(const v8::Arguments
 {
     INC_STATS("DOM.TestObj.classMethodWithOptional");
     if (args.Length() <= 0) {
-        return v8::Integer::New(TestObj::classMethodWithOptional());
+        return v8Integer(TestObj::classMethodWithOptional(), args.GetIsolate());
     }
     EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
-    return v8::Integer::New(TestObj::classMethodWithOptional(arg));
+    return v8Integer(TestObj::classMethodWithOptional(arg), args.GetIsolate());
 }
 
 #if ENABLE(Condition1)
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index 28ecd9408..3b0f2f67d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -103,7 +103,7 @@ static v8::Handle<v8::Value> portsAttrGetter(v8::Local<v8::String> name, const v
     MessagePortArray portsCopy(*ports);
     v8::Local<v8::Array> portArray = v8::Array::New(portsCopy.size());
     for (size_t i = 0; i < portsCopy.size(); ++i)
-        portArray->Set(v8::Integer::New(i), toV8(portsCopy[i].get(), info.GetIsolate()));
+        portArray->Set(v8Integer(i, info.GetIsolate()), toV8(portsCopy[i].get(), info.GetIsolate()));
     return portArray;
 }
 
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.cpp b/Source/WebCore/bindings/v8/DOMDataStore.cpp
index 2d5b5e633..dbca39540 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.cpp
+++ b/Source/WebCore/bindings/v8/DOMDataStore.cpp
@@ -32,6 +32,7 @@
 #include "DOMDataStore.h"
 
 #include "DOMData.h"
+#include "MemoryInstrumentation.h"
 #include "V8Binding.h"
 #include <wtf/MainThread.h>
 
@@ -118,6 +119,15 @@ void* DOMDataStore::getDOMWrapperMap(DOMWrapperMapType type)
     return 0;
 }
 
+void DOMDataStore::reportMemoryUsage(MemoryInstrumentation* instrumentation)
+{
+    instrumentation->reportPointer(this, MemoryInstrumentation::Binding);
+    domNodeMap().reportMemoryUsage(instrumentation);
+    activeDomNodeMap().reportMemoryUsage(instrumentation);
+    domObjectMap().reportMemoryUsage(instrumentation);
+    activeDomObjectMap().reportMemoryUsage(instrumentation);
+}
+
 // Called when the object is near death (not reachable from JS roots).
 // It is time to remove the entry from the table and dispose the handle.
 void DOMDataStore::weakDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject)
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.h b/Source/WebCore/bindings/v8/DOMDataStore.h
index 089d86d4f..b5bdfc392 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.h
+++ b/Source/WebCore/bindings/v8/DOMDataStore.h
@@ -47,6 +47,7 @@ namespace WebCore {
 
     class DOMData;
     class DOMDataStore;
+    class MemoryInstrumentation;
 
     typedef WTF::Vector<DOMDataStore*> DOMDataList;
 
@@ -86,6 +87,8 @@ namespace WebCore {
         static void weakActiveDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
         static void weakNodeCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
 
+        void reportMemoryUsage(MemoryInstrumentation*);
+
     protected:
         static void weakDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
 
diff --git a/Source/WebCore/bindings/v8/Dictionary.cpp b/Source/WebCore/bindings/v8/Dictionary.cpp
index dc724fa95..7d692e78e 100644
--- a/Source/WebCore/bindings/v8/Dictionary.cpp
+++ b/Source/WebCore/bindings/v8/Dictionary.cpp
@@ -277,7 +277,7 @@ bool Dictionary::get(const String& key, HashSet<AtomicString>& value) const
 
     v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(v8Value);
     for (size_t i = 0; i < v8Array->Length(); ++i) {
-        v8::Local<v8::Value> indexedValue = v8Array->Get(v8::Integer::New(i));
+        v8::Local<v8::Value> indexedValue = v8Array->Get(v8Integer(i));
         value.add(v8ValueToWebCoreString(indexedValue));
     }
 
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index ee76ee29a..661ff0159 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -154,13 +154,15 @@ v8::Handle<v8::Value> ensureNthValueOnKeyPath(v8::Handle<v8::Value>& rootValue,
 
 } // anonymous namespace
 
-static PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> value, const String& keyPath)
+static PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> prpValue, const String& keyPath)
 {
     Vector<String> keyPathElements;
     IDBKeyPathParseError error;
     IDBParseKeyPath(keyPath, keyPathElements, error);
     ASSERT(error == IDBKeyPathParseErrorNone);
 
+    RefPtr<SerializedScriptValue> value = prpValue;
+
     V8AuxiliaryContext context;
     v8::Handle<v8::Value> v8Value(value->deserialize());
     v8::Handle<v8::Value> v8Key(getNthValueOnKeyPath(v8Value, keyPathElements, keyPathElements.size()));
diff --git a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
index 5c066f010..5d61668c1 100644
--- a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
+++ b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
@@ -32,6 +32,7 @@
 #define IntrusiveDOMWrapperMap_h
 
 #include "DOMDataStore.h"
+#include "MemoryInstrumentation.h"
 #include "V8Node.h"
 
 namespace WebCore {
@@ -101,6 +102,12 @@ class ChunkedTable {
             visitEntries(store, chunk->m_entries, chunk->m_entries + CHUNK_SIZE, visitor);
     }
 
+    void reportMemoryUsage(MemoryInstrumentation* instrumentation)
+    {
+        for (Chunk* chunk = m_chunks; chunk; chunk = chunk->m_previous)
+            instrumentation->reportPointer(chunk, MemoryInstrumentation::Binding);
+    }
+
   private:
     struct Chunk {
         explicit Chunk(Chunk* previous) : m_previous(previous) { }
@@ -176,6 +183,12 @@ public:
         m_table.clear();
     }
 
+    virtual void reportMemoryUsage(MemoryInstrumentation* instrumentation) OVERRIDE
+    {
+        instrumentation->reportPointer(this, MemoryInstrumentation::Binding);
+        m_table.reportMemoryUsage(instrumentation);
+    }
+
 private:
     static int const numberOfEntries = (1 << 10) - 1;
 
diff --git a/Source/WebCore/bindings/v8/NPObjectWrapper.cpp b/Source/WebCore/bindings/v8/NPObjectWrapper.cpp
deleted file mode 100644
index 7c73b2f03..000000000
--- a/Source/WebCore/bindings/v8/NPObjectWrapper.cpp
+++ /dev/null
@@ -1,181 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "NPObjectWrapper.h"
-
-namespace WebCore {
-
-struct NPProxyObject {
-    NPObject object;
-    NPObjectWrapper* wrapper;
-};
-
-NPClass NPObjectWrapper::m_npClassWrapper = {
-    NP_CLASS_STRUCT_VERSION,
-    NPObjectWrapper::NPAllocate,
-    NPObjectWrapper::NPDeallocate,
-    NPObjectWrapper::NPPInvalidate,
-    NPObjectWrapper::NPHasMethod,
-    NPObjectWrapper::NPInvoke,
-    NPObjectWrapper::NPInvokeDefault,
-    NPObjectWrapper::NPHasProperty,
-    NPObjectWrapper::NPGetProperty,
-    NPObjectWrapper::NPSetProperty,
-    NPObjectWrapper::NPRemoveProperty,
-    NPObjectWrapper::NPNEnumerate,
-    NPObjectWrapper::NPNConstruct
-};
-
-NPObjectWrapper::NPObjectWrapper(NPObject* obj)
-    : m_wrappedNPObject(obj)
-{
-}
-
-NPObject* NPObjectWrapper::create(NPObject* object)
-{
-    ASSERT(object);
-    NPProxyObject* proxyObject = reinterpret_cast<NPProxyObject*>(_NPN_CreateObject(0, &m_npClassWrapper));
-    proxyObject->wrapper = new NPObjectWrapper(object);
-    return reinterpret_cast<NPObject*>(proxyObject);
-}
-
-void NPObjectWrapper::clear()
-{
-    m_wrappedNPObject = 0;   
-}
-
-NPObjectWrapper* NPObjectWrapper::getWrapper(NPObject* obj)
-{
-    if (&m_npClassWrapper == obj->_class) {
-        NPProxyObject* proxyObject = reinterpret_cast<NPProxyObject*>(obj);
-        return proxyObject->wrapper;
-    }
-    return 0;
-}
-
-NPObject* NPObjectWrapper::getUnderlyingNPObject(NPObject* obj)
-{
-    NPObjectWrapper* wrapper = getWrapper(obj);
-    return wrapper ? wrapper->m_wrappedNPObject : 0;
-}
-
-NPObject* NPObjectWrapper::getObjectForCall(NPObject* obj)
-{
-    NPObject* actualObject = getUnderlyingNPObject(obj);
-    return actualObject ? actualObject : 0;
-}
-
-NPObject* NPObjectWrapper::NPAllocate(NPP, NPClass*)
-{
-    return reinterpret_cast<NPObject*>(new NPProxyObject);
-}
-
-void NPObjectWrapper::NPDeallocate(NPObject* obj)
-{
-    NPProxyObject* proxyObject = reinterpret_cast<NPProxyObject*>(obj);
-    delete proxyObject->wrapper;
-    delete proxyObject;
-}
-
-void NPObjectWrapper::NPPInvalidate(NPObject* obj)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    if (actualObject && actualObject->_class->invalidate)
-        actualObject->_class->invalidate(actualObject);
-}
-
-bool NPObjectWrapper::NPHasMethod(NPObject* obj, NPIdentifier name)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_HasMethod(0, actualObject, name) : false;
-}
-
-bool NPObjectWrapper::NPInvoke(NPObject* obj, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_Invoke(0, actualObject, name, args, argCount, result) : false;
-}
-
-bool NPObjectWrapper::NPInvokeDefault(NPObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_InvokeDefault(0, actualObject, args, argCount, result) : false;
-}
- 
-bool NPObjectWrapper::NPHasProperty(NPObject* obj, NPIdentifier name)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_HasProperty(0, actualObject, name) : false;
-}
-
-bool NPObjectWrapper::NPGetProperty(NPObject* obj, NPIdentifier name, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_GetProperty(0, actualObject, name, result) : false;
-}
-
-bool NPObjectWrapper::NPSetProperty(NPObject* obj, NPIdentifier name, const NPVariant* value)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_SetProperty(0, actualObject, name, value) : false;
-}
-
-bool NPObjectWrapper::NPRemoveProperty(NPObject* obj, NPIdentifier name) {
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_RemoveProperty(0, actualObject, name) : false;
-}
-
-bool NPObjectWrapper::NPNEnumerate(NPObject* obj, NPIdentifier** value, uint32_t* count)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_Enumerate(0, actualObject, value, count) : false;
-}
-
-bool NPObjectWrapper::NPNConstruct(NPObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_Construct(0, actualObject, args, argCount, result) : false;
-}
-
-bool NPObjectWrapper::NPInvokePrivate(NPP npp, NPObject* obj, bool isDefault, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    if (!actualObject)
-        return false;
-
-    if (isDefault) {
-        return _NPN_InvokeDefault(0, actualObject, args, argCount, result);
-    } else {
-        return _NPN_Invoke(0, actualObject, name, args, argCount, result);
-    }
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/NPObjectWrapper.h b/Source/WebCore/bindings/v8/NPObjectWrapper.h
deleted file mode 100644
index 6fdf90b4a..000000000
--- a/Source/WebCore/bindings/v8/NPObjectWrapper.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef NPObjectWrapper_h
-#define NPObjectWrapper_h
-
-#include "npruntime_impl.h"
-
-namespace WebCore {
-
-// This class wraps a NPObject and provides functionality for the wrapped
-// object to be cleared out when this object is destroyed. This is to ensure
-// that callers trying to access the underlying object don't crash while
-// invoking methods on the NPObject.
-class NPObjectWrapper {
-public:
-    // Creates an instance of the NPObjectWrapper class and wraps the object
-    // passed in.
-    static NPObject* create(NPObject* object);
-
-    // This method should be called to invalidate the underlying NPObject pointer.
-    void clear();
-
-    // Returns a pointer to NPObjectWrapper if the object passed in was wrapped by us.
-    static NPObjectWrapper* getWrapper(NPObject* obj);
-
-    // Returns a pointer to the underlying raw NPObject pointer or 0 if the object
-    // passed in was not wrapped.
-    static NPObject* getUnderlyingNPObject(NPObject* obj);
-
-    // NPObject functions implemented by the wrapper.
-    static NPObject* NPAllocate(NPP, NPClass*);
-    static void NPDeallocate(NPObject* obj);
-    static void NPPInvalidate(NPObject *obj);
-    static bool NPHasMethod(NPObject* obj, NPIdentifier name);
-    static bool NPInvoke(NPObject* obj, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result);
-    static bool NPInvokeDefault(NPObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result);
-    static bool NPHasProperty(NPObject* obj, NPIdentifier name);
-    static bool NPGetProperty(NPObject* obj, NPIdentifier name, NPVariant* result);
-    static bool NPSetProperty(NPObject* obj, NPIdentifier name, const NPVariant *value);
-    static bool NPRemoveProperty(NPObject* obj, NPIdentifier name);
-    static bool NPNEnumerate(NPObject* obj, NPIdentifier **value, uint32_t* count);
-    static bool NPNConstruct(NPObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result);
-    static bool NPInvokePrivate(NPP npp, NPObject* obj,bool isDefault, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result);
-
-private:
-    NPObjectWrapper(NPObject* obj);
-
-    // Returns the underlying NPObject if the object passed in was wrapped. Otherwise
-    // just returns the object passed in.
-    static NPObject* getObjectForCall(NPObject* obj);
-
-    static NPClass m_npClassWrapper;
-    // Weak NPObject poointer.
-    NPObject* m_wrappedNPObject;
-};
-
-} // namespace WebCore
-
-#endif // NPObjectWrapper_h
-
diff --git a/Source/WebCore/bindings/v8/NPV8Object.cpp b/Source/WebCore/bindings/v8/NPV8Object.cpp
index ccf2f9897..d4d6cfc9c 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.cpp
+++ b/Source/WebCore/bindings/v8/NPV8Object.cpp
@@ -31,11 +31,11 @@
 #include "PlatformSupport.h"
 #include "DOMWindow.h"
 #include "Frame.h"
-#include "NPObjectWrapper.h"
 #include <wtf/OwnArrayPtr.h>
 #include "PlatformString.h"
 #include "ScriptSourceCode.h"
 #include "UserGestureIndicator.h"
+#include "V8Binding.h"
 #include "V8GCController.h"
 #include "V8Helpers.h"
 #include "V8NPUtils.h"
@@ -75,29 +75,7 @@ static NPObject* allocV8NPObject(NPP, NPClass*)
 static void freeV8NPObject(NPObject* npObject)
 {
     V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
-    if (int v8ObjectHash = v8NpObject->v8Object->GetIdentityHash()) {
-        V8NPObjectMap::iterator iter = staticV8NPObjectMap()->find(v8ObjectHash);
-        if (iter != staticV8NPObjectMap()->end()) {
-            V8NPObjectVector& objects = iter->second;
-            for (size_t index = 0; index < objects.size(); ++index) {
-                if (objects.at(index) == v8NpObject) {
-                    objects.remove(index);
-                    break;
-                }
-            }
-            if (objects.isEmpty())
-                staticV8NPObjectMap()->remove(v8ObjectHash);
-        } else
-            ASSERT_NOT_REACHED();
-    } else {
-        ASSERT(!v8::Context::InContext());
-        staticV8NPObjectMap()->clear();
-    }
-
-#ifndef NDEBUG
-    V8GCController::unregisterGlobalHandle(v8NpObject, v8NpObject->v8Object);
-#endif
-    v8NpObject->v8Object.Dispose();
+    disposeUnderlyingV8Object(npObject);
     free(v8NpObject);
 }
 
@@ -178,6 +156,38 @@ NPObject* npCreateV8ScriptObject(NPP npp, v8::Handle<v8::Object> object, DOMWind
     return reinterpret_cast<NPObject*>(v8npObject);
 }
 
+void disposeUnderlyingV8Object(NPObject* npObject)
+{
+    ASSERT(npObject->_class == npScriptObjectClass);
+    V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
+    if (v8NpObject->v8Object.IsEmpty())
+        return;
+    if (int v8ObjectHash = v8NpObject->v8Object->GetIdentityHash()) {
+        V8NPObjectMap::iterator iter = staticV8NPObjectMap()->find(v8ObjectHash);
+        if (iter != staticV8NPObjectMap()->end()) {
+            V8NPObjectVector& objects = iter->second;
+            for (size_t index = 0; index < objects.size(); ++index) {
+                if (objects.at(index) == v8NpObject) {
+                    objects.remove(index);
+                    break;
+                }
+            }
+            if (objects.isEmpty())
+                staticV8NPObjectMap()->remove(v8ObjectHash);
+        } else
+            ASSERT_NOT_REACHED();
+    } else {
+        ASSERT(!v8::Context::InContext());
+        staticV8NPObjectMap()->clear();
+    }
+
+#ifndef NDEBUG
+    V8GCController::unregisterGlobalHandle(v8NpObject, v8NpObject->v8Object);
+#endif
+    v8NpObject->v8Object.Dispose();
+    v8NpObject->v8Object.Clear();
+}
+
 } // namespace WebCore
 
 bool _NPN_Invoke(NPP npp, NPObject* npObject, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result)
@@ -194,6 +204,8 @@ bool _NPN_Invoke(NPP npp, NPObject* npObject, NPIdentifier methodName, const NPV
     }
 
     V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
+    if (v8NpObject->v8Object.IsEmpty())
+        return false;
 
     PrivateIdentifier* identifier = static_cast<PrivateIdentifier*>(methodName);
     if (!identifier->isString)
@@ -258,6 +270,8 @@ bool _NPN_InvokeDefault(NPP npp, NPObject* npObject, const NPVariant* arguments,
     }
 
     V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
+    if (v8NpObject->v8Object.IsEmpty())
+        return false;
 
     VOID_TO_NPVARIANT(*result);
 
@@ -304,13 +318,8 @@ bool _NPN_EvaluateHelper(NPP npp, bool popupsAllowed, NPObject* npObject, NPStri
     if (!npObject)
         return false;
 
-    if (npObject->_class != npScriptObjectClass) {
-        // Check if the object passed in is wrapped. If yes, then we need to invoke on the underlying object.
-        NPObject* actualObject = NPObjectWrapper::getUnderlyingNPObject(npObject);
-        if (!actualObject)
-            return false;
-        npObject = actualObject;
-    }
+    if (npObject->_class != npScriptObjectClass)
+        return false;
 
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -348,6 +357,8 @@ bool _NPN_GetProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName, NP
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -383,6 +394,8 @@ bool _NPN_SetProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName, co
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -412,6 +425,8 @@ bool _NPN_RemoveProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName)
         return false;
 
     V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+    if (object->v8Object.IsEmpty())
+        return false;
 
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -433,6 +448,8 @@ bool _NPN_HasProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName)
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -457,6 +474,8 @@ bool _NPN_HasMethod(NPP npp, NPObject* npObject, NPIdentifier methodName)
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -501,6 +520,8 @@ bool _NPN_Enumerate(NPP npp, NPObject* npObject, NPIdentifier** identifier, uint
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -537,7 +558,7 @@ bool _NPN_Enumerate(NPP npp, NPObject* npObject, NPIdentifier** identifier, uint
         *count = props->Length();
         *identifier = static_cast<NPIdentifier*>(malloc(sizeof(NPIdentifier*) * *count));
         for (uint32_t i = 0; i < *count; ++i) {
-            v8::Local<v8::Value> name = props->Get(v8::Integer::New(i));
+            v8::Local<v8::Value> name = props->Get(v8Integer(i));
             (*identifier)[i] = getStringIdentifier(v8::Local<v8::String>::Cast(name));
         }
         return true;
@@ -556,6 +577,8 @@ bool _NPN_Construct(NPP npp, NPObject* npObject, const NPVariant* arguments, uin
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
diff --git a/Source/WebCore/bindings/v8/NPV8Object.h b/Source/WebCore/bindings/v8/NPV8Object.h
index f72ba8bd1..b7e0464a1 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.h
+++ b/Source/WebCore/bindings/v8/NPV8Object.h
@@ -54,8 +54,9 @@ WrapperTypeInfo* npObjectTypeInfo();
 
 extern NPClass* npScriptObjectClass;
 
-// A V8NPObject is a NPObject which carries additional V8-specific information. It is allocated and deallocated by
-// AllocV8NPObject() and FreeV8NPObject() methods.
+// A V8NPObject is a NPObject which carries additional V8-specific information.
+// It is created with npCreateV8ScriptObject() and deallocated via the deallocate
+// method in the same way as other NPObjects.
 struct V8NPObject {
     NPObject object;
     v8::Persistent<v8::Object> v8Object;
@@ -74,6 +75,8 @@ NPObject* npCreateV8ScriptObject(NPP, v8::Handle<v8::Object>, DOMWindow*);
 
 NPObject* v8ObjectToNPObject(v8::Handle<v8::Object>);
 
+void disposeUnderlyingV8Object(NPObject*);
+
 } // namespace WebCore
 
 #endif // NPV8Object_h
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
index dce148a84..03e7c57b2 100755
--- a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
@@ -112,7 +112,7 @@ void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* pag
     ASSERT(!value->IsUndefined() && value->IsArray());
     v8::Handle<v8::Array> scriptsArray = v8::Handle<v8::Array>::Cast(value);
     for (unsigned i = 0; i < scriptsArray->Length(); ++i)
-        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
+        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8Integer(i))));
 }
 
 void PageScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
diff --git a/Source/WebCore/bindings/v8/ScriptController.cpp b/Source/WebCore/bindings/v8/ScriptController.cpp
index d49866d87..d0a7e06e2 100644
--- a/Source/WebCore/bindings/v8/ScriptController.cpp
+++ b/Source/WebCore/bindings/v8/ScriptController.cpp
@@ -45,7 +45,6 @@
 #include "FrameLoaderClient.h"
 #include "Node.h"
 #include "NotImplemented.h"
-#include "NPObjectWrapper.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "NPV8Object.h"
@@ -110,7 +109,7 @@ ScriptController::ScriptController(Frame* frame)
     , m_paused(false)
     , m_proxy(adoptPtr(new V8Proxy(frame)))
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    , m_wrappedWindowScriptNPObject(0)
+    , m_windowScriptNPObject(0)
 #endif
 {
 }
@@ -129,21 +128,14 @@ void ScriptController::clearScriptObjects()
     m_pluginObjects.clear();
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    if (m_wrappedWindowScriptNPObject) {
-        NPObjectWrapper* windowScriptObjectWrapper = NPObjectWrapper::getWrapper(m_wrappedWindowScriptNPObject);
-        ASSERT(windowScriptObjectWrapper);
-
-        NPObject* windowScriptNPObject = NPObjectWrapper::getUnderlyingNPObject(m_wrappedWindowScriptNPObject);
-        ASSERT(windowScriptNPObject);
-        // Call _NPN_DeallocateObject() instead of _NPN_ReleaseObject() so that we don't leak if a plugin fails to release the window
-        // script object properly.
-        // This shouldn't cause any problems for plugins since they should have already been stopped and destroyed at this point.
-        _NPN_DeallocateObject(windowScriptNPObject);
-
-        // Clear out the wrapped window script object pointer held by the wrapper.
-        windowScriptObjectWrapper->clear();
-        _NPN_ReleaseObject(m_wrappedWindowScriptNPObject);
-        m_wrappedWindowScriptNPObject = 0;
+    if (m_windowScriptNPObject) {
+        // Dispose of the underlying V8 object before releasing our reference
+        // to it, so that if the plugin fails to release it properly we will
+        // only leak the NPObject wrapper, not the object, its document, or
+        // anything else they reference.
+        disposeUnderlyingV8Object(m_windowScriptNPObject);
+        _NPN_ReleaseObject(m_windowScriptNPObject);
+        m_windowScriptNPObject = 0;
     }
 #endif
 }
@@ -391,24 +383,21 @@ static NPObject* createScriptObject(Frame* frame)
 
 NPObject* ScriptController::windowScriptNPObject()
 {
-    if (m_wrappedWindowScriptNPObject)
-        return m_wrappedWindowScriptNPObject;
+    if (m_windowScriptNPObject)
+        return m_windowScriptNPObject;
 
-    NPObject* windowScriptNPObject = 0;
     if (canExecuteScripts(NotAboutToExecuteScript)) {
         // JavaScript is enabled, so there is a JavaScript window object.
         // Return an NPObject bound to the window object.
-        windowScriptNPObject = createScriptObject(m_frame);
-        _NPN_RegisterObject(windowScriptNPObject, 0);
+        m_windowScriptNPObject = createScriptObject(m_frame);
+        _NPN_RegisterObject(m_windowScriptNPObject, 0);
     } else {
         // JavaScript is not enabled, so we cannot bind the NPObject to the
         // JavaScript window object. Instead, we create an NPObject of a
         // different class, one which is not bound to a JavaScript object.
-        windowScriptNPObject = createNoScriptObject();
+        m_windowScriptNPObject = createNoScriptObject();
     }
-
-    m_wrappedWindowScriptNPObject = NPObjectWrapper::create(windowScriptNPObject);
-    return m_wrappedWindowScriptNPObject;
+    return m_windowScriptNPObject;
 }
 
 NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)
diff --git a/Source/WebCore/bindings/v8/ScriptController.h b/Source/WebCore/bindings/v8/ScriptController.h
index 41d71ce32..7c7836876 100644
--- a/Source/WebCore/bindings/v8/ScriptController.h
+++ b/Source/WebCore/bindings/v8/ScriptController.h
@@ -205,14 +205,9 @@ private:
     // invalidate all sub-objects which are associated with that plugin.
     // The frame keeps a NPObject reference for each item on the list.
     PluginObjectMap m_pluginObjects;
-    // The window script object can get destroyed while there are outstanding
-    // references to it. Please refer to ScriptController::clearScriptObjects
-    // for more information as to why this is necessary. To avoid crashes due
-    // to calls on the destroyed window object, we return a proxy NPObject
-    // which wraps the underlying window object. The wrapped window object
-    // pointer in this object is cleared out when the window object is
-    // destroyed.
-    NPObject* m_wrappedWindowScriptNPObject;
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    NPObject* m_windowScriptNPObject;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index f95f2b6a2..2c82510b1 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -79,8 +79,8 @@ String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBrea
 
     v8::Local<v8::Object> args = v8::Object::New();
     args->Set(v8::String::New("sourceID"), v8String(sourceID));
-    args->Set(v8::String::New("lineNumber"), v8::Integer::New(scriptBreakpoint.lineNumber));
-    args->Set(v8::String::New("columnNumber"), v8::Integer::New(scriptBreakpoint.columnNumber));
+    args->Set(v8::String::New("lineNumber"), v8Integer(scriptBreakpoint.lineNumber));
+    args->Set(v8::String::New("columnNumber"), v8Integer(scriptBreakpoint.columnNumber));
     args->Set(v8::String::New("condition"), v8String(scriptBreakpoint.condition));
 
     v8::Handle<v8::Function> setBreakpointFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("setBreakpoint")));
@@ -428,7 +428,7 @@ void ScriptDebugServer::compileScript(ScriptState* state, const String& expressi
     v8::Local<v8::String> code = v8ExternalString(expression);
     v8::TryCatch tryCatch;
 
-    v8::ScriptOrigin origin(v8ExternalString(sourceURL), v8::Integer::New(0), v8::Integer::New(0));
+    v8::ScriptOrigin origin(v8ExternalString(sourceURL), v8Integer(0), v8Integer(0));
     v8::Handle<v8::Script> script = v8::Script::New(code, &origin);
 
     if (tryCatch.HasCaught()) {
@@ -451,6 +451,8 @@ void ScriptDebugServer::clearCompiledScripts()
 
 void ScriptDebugServer::runScript(ScriptState* state, const String& scriptId, ScriptValue* result, bool* wasThrown, String* exceptionMessage)
 {
+    if (!m_compiledScripts.contains(scriptId))
+        return;
     v8::HandleScope handleScope;
     OwnHandle<v8::Script>* scriptOwnHandle = m_compiledScripts.get(scriptId);
     v8::Local<v8::Script> script = v8::Local<v8::Script>::New(scriptOwnHandle->get());
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index 57bb8080e..8d6c5029e 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -33,6 +33,7 @@
 #include "ScriptProfiler.h"
 
 #include "BindingVisitors.h"
+#include "MemoryInstrumentation.h"
 #include "RetainedDOMInfo.h"
 #include "ScriptObject.h"
 #include "V8ArrayBufferView.h"
@@ -219,6 +220,14 @@ void ScriptProfiler::visitExternalArrays(ExternalArrayVisitor* visitor)
 
 }
 
+void ScriptProfiler::collectBindingMemoryInfo(MemoryInstrumentation* instrumentation)
+{
+    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
+    if (!data)
+        return;
+    data->reportMemoryUsage(instrumentation);
+}
+
 size_t ScriptProfiler::profilerSnapshotsSize()
 {
     return v8::HeapProfiler::GetMemorySizeUsedByProfiler();
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index 25f6e129e..7ffa50da7 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -42,6 +42,7 @@ namespace WebCore {
 
 class ExternalArrayVisitor;
 class ExternalStringVisitor;
+class MemoryInstrumentation;
 class NodeWrapperVisitor;
 class Page;
 class ScriptObject;
@@ -81,6 +82,7 @@ public:
     static void visitNodeWrappers(NodeWrapperVisitor*);
     static void visitExternalStrings(ExternalStringVisitor*);
     static void visitExternalArrays(ExternalArrayVisitor*);
+    static void collectBindingMemoryInfo(MemoryInstrumentation*);
     static size_t profilerSnapshotsSize();
 };
 
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index ecba2e063..616107361 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -1574,7 +1574,7 @@ private:
         uint32_t rawValue;
         if (!doReadUint32(&rawValue))
             return false;
-        *value = v8::Integer::New(static_cast<int32_t>(ZigZag::decode(rawValue)));
+        *value = v8Integer(static_cast<int32_t>(ZigZag::decode(rawValue)), m_isolate);
         return true;
     }
 
@@ -1583,7 +1583,7 @@ private:
         uint32_t rawValue;
         if (!doReadUint32(&rawValue))
             return false;
-        *value = v8::Integer::NewFromUnsigned(rawValue);
+        *value = v8UnsignedInteger(rawValue, m_isolate);
         return true;
     }
 
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index 699018692..c29bcf833 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -34,6 +34,7 @@
 #include "BindingVisitors.h"
 #include "DOMStringList.h"
 #include "Element.h"
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 #include "QualifiedName.h"
 #include "V8DOMStringList.h"
@@ -89,7 +90,16 @@ void V8BindingPerIsolateData::dispose(v8::Isolate* isolate)
     isolate->SetData(0);
 }
 
+void V8BindingPerIsolateData::reportMemoryUsage(MemoryInstrumentation* instrumentation)
+{
+    instrumentation->reportPointer(this, MemoryInstrumentation::Binding);
+    instrumentation->reportHashMap(m_rawTemplates, MemoryInstrumentation::Binding);
+    instrumentation->reportHashMap(m_templates, MemoryInstrumentation::Binding);
+    m_stringCache.reportMemoryUsage(instrumentation);
 
+    for (size_t i = 0; i < m_domDataList.size(); i++)
+        m_domDataList[i]->reportMemoryUsage(instrumentation);
+}
 
 // WebCoreStringResource is a helper class for v8ExternalString. It is used
 // to manage the life-cycle of the underlying buffer of the external string.
@@ -218,7 +228,7 @@ v8::Handle<v8::Value> v8Array(PassRefPtr<DOMStringList> stringList, v8::Isolate*
         return v8::Array::New();
     v8::Local<v8::Array> result = v8::Array::New(stringList->length());
     for (unsigned i = 0; i < stringList->length(); ++i)
-        result->Set(v8::Integer::New(i), v8String(stringList->item(i), isolate));
+        result->Set(v8Integer(i, isolate), v8String(stringList->item(i), isolate));
     return result;
 }
 
@@ -490,7 +500,27 @@ v8::Local<v8::String> StringCache::v8ExternalStringSlow(StringImpl* stringImpl,
 
     return newString;
 }
-    
+
+void IntegerCache::createSmallIntegers()
+{
+    ASSERT(!m_initialized);
+    // We initialize m_smallIntegers not in a constructor but in v8Integer(),
+    // because Integer::New() requires a HandleScope. At the point where
+    // IntegerCache is constructed, a HandleScope might not exist.
+    for (int value = 0; value < numberOfCachedSmallIntegers; value++)
+        m_smallIntegers[value] = v8::Persistent<v8::Integer>::New(v8::Integer::New(value));
+    m_initialized = true;
+}
+
+IntegerCache::~IntegerCache()
+{
+    if (m_initialized) {
+        for (int value = 0; value < numberOfCachedSmallIntegers; value++)
+            m_smallIntegers[value].Dispose();
+        m_initialized = false;
+    }
+}
+
 v8::Persistent<v8::FunctionTemplate> createRawTemplate()
 {
     v8::HandleScope scope;
@@ -556,6 +586,11 @@ v8::Persistent<v8::FunctionTemplate> getToStringTemplate()
         toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(constructorToString));
     return toStringTemplate;
 }
+
+void StringCache::reportMemoryUsage(MemoryInstrumentation* instrumentation)
+{
+    instrumentation->reportHashMap(m_stringCache, MemoryInstrumentation::Binding);
+}
     
 PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value> value)
 {
@@ -572,7 +607,7 @@ PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value> va
     RefPtr<DOMStringList> ret = DOMStringList::create();
     v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(v8Value);
     for (size_t i = 0; i < v8Array->Length(); ++i) {
-        v8::Local<v8::Value> indexedValue = v8Array->Get(v8::Integer::New(i));
+        v8::Local<v8::Value> indexedValue = v8Array->Get(v8Integer(i));
         ret->append(v8ValueToWebCoreString(indexedValue));
     }
     return ret.release();
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index 10296a700..cb420002f 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -49,6 +49,7 @@ namespace WebCore {
     class EventListener;
     class EventTarget;
     class ExternalStringVisitor;
+    class MemoryInstrumentation;
 
     // FIXME: Remove V8Binding.
     class V8Binding {
@@ -78,6 +79,8 @@ namespace WebCore {
 
         void remove(StringImpl*);
 
+        void reportMemoryUsage(MemoryInstrumentation*);
+
     private:
         v8::Local<v8::String> v8ExternalStringSlow(StringImpl*, v8::Isolate*);
 
@@ -89,6 +92,38 @@ namespace WebCore {
         RefPtr<StringImpl> m_lastStringImpl;
     };
 
+    const int numberOfCachedSmallIntegers = 64;
+
+    class IntegerCache {
+    public:
+        IntegerCache() : m_initialized(false) { };
+        ~IntegerCache();
+
+        v8::Handle<v8::Integer> v8Integer(int value)
+        {
+            if (!m_initialized)
+                createSmallIntegers();
+            if (0 <= value && value < numberOfCachedSmallIntegers)
+                return m_smallIntegers[value];
+            return v8::Integer::New(value);
+        }
+
+        v8::Handle<v8::Integer> v8UnsignedInteger(unsigned value)
+        {
+            if (!m_initialized)
+                createSmallIntegers();
+            if (value < static_cast<unsigned>(numberOfCachedSmallIntegers))
+                return m_smallIntegers[value];
+            return v8::Integer::NewFromUnsigned(value);
+        }
+
+    private:
+        void createSmallIntegers();
+
+        v8::Persistent<v8::Integer> m_smallIntegers[numberOfCachedSmallIntegers];
+        bool m_initialized;
+    };
+
     class ScriptGCEventListener;
 
     class GCEventData {
@@ -120,16 +155,13 @@ namespace WebCore {
     public:
         static V8BindingPerIsolateData* create(v8::Isolate*);
         static void ensureInitialized(v8::Isolate*);
-        static V8BindingPerIsolateData* get(v8::Isolate* isolate)
+        static V8BindingPerIsolateData* current(v8::Isolate* isolate = 0)
         {
+            if (UNLIKELY(!isolate))
+                isolate = v8::Isolate::GetCurrent();
             ASSERT(isolate->GetData());
             return static_cast<V8BindingPerIsolateData*>(isolate->GetData()); 
         }
-
-        static V8BindingPerIsolateData* current(v8::Isolate* isolate = 0)
-        {
-            return isolate ? static_cast<V8BindingPerIsolateData*>(isolate->GetData()) : get(v8::Isolate::GetCurrent());
-        }
         static void dispose(v8::Isolate*);
 
         typedef HashMap<WrapperTypeInfo*, v8::Persistent<v8::FunctionTemplate> > TemplateMap;
@@ -145,6 +177,8 @@ namespace WebCore {
         }
 
         StringCache* stringCache() { return &m_stringCache; }
+        IntegerCache* integerCache() { return &m_integerCache; }
+
 #if ENABLE(INSPECTOR)
         void visitExternalStrings(ExternalStringVisitor*);
 #endif
@@ -183,6 +217,8 @@ namespace WebCore {
 
         GCEventData& gcEventData() { return m_gcEventData; }
 
+        void reportMemoryUsage(MemoryInstrumentation*);
+
     private:
         explicit V8BindingPerIsolateData(v8::Isolate*);
         ~V8BindingPerIsolateData();
@@ -193,6 +229,7 @@ namespace WebCore {
         v8::Persistent<v8::FunctionTemplate> m_toStringTemplate;
         v8::Persistent<v8::FunctionTemplate> m_lazyEventListenerToStringTemplate;
         StringCache m_stringCache;
+        IntegerCache m_integerCache;
 
         DOMDataList m_domDataList;
         DOMDataStore* m_domDataStore;
@@ -293,29 +330,97 @@ namespace WebCore {
         return v8ExternalString(string, isolate);
     }
 
+    inline v8::Handle<v8::Integer> v8Integer(int value, v8::Isolate* isolate = 0)
+    {
+        V8BindingPerIsolateData* data = V8BindingPerIsolateData::current(isolate);
+        return data->integerCache()->v8Integer(value);
+    }
+
+    inline v8::Handle<v8::Integer> v8UnsignedInteger(unsigned value, v8::Isolate* isolate = 0)
+    {
+        V8BindingPerIsolateData* data = V8BindingPerIsolateData::current(isolate);
+        return data->integerCache()->v8UnsignedInteger(value);
+    }
+
+    template <class T>
+    struct V8ValueTraits {
+        static inline v8::Handle<v8::Value> arrayV8Value(const T& value, v8::Isolate* isolate)
+        {
+            return toV8(WTF::getPtr(value), isolate);
+        }
+    };
+
+    template<>
+    struct V8ValueTraits<String> {
+        static inline v8::Handle<v8::Value> arrayV8Value(const String& value, v8::Isolate* isolate)
+        {
+            return v8String(value, isolate);
+        }
+    };
+
+    template<>
+    struct V8ValueTraits<unsigned long> {
+        static inline v8::Handle<v8::Value> arrayV8Value(const unsigned long& value, v8::Isolate* isolate)
+        {
+            return v8UnsignedInteger(value, isolate);
+        }
+    };
+
+    template<>
+    struct V8ValueTraits<float> {
+        static inline v8::Handle<v8::Value> arrayV8Value(const float& value, v8::Isolate*)
+        {
+            return v8::Number::New(value);
+        }
+    };
+
+    template<>
+    struct V8ValueTraits<double> {
+        static inline v8::Handle<v8::Value> arrayV8Value(const double& value, v8::Isolate*)
+        {
+            return v8::Number::New(value);
+        }
+    };
+
     template<typename T>
     v8::Handle<v8::Value> v8Array(const Vector<T>& iterator, v8::Isolate* isolate)
     {
         v8::Local<v8::Array> result = v8::Array::New(iterator.size());
         int index = 0;
         typename Vector<T>::const_iterator end = iterator.end();
+        typedef V8ValueTraits<T> TraitsType;
         for (typename Vector<T>::const_iterator iter = iterator.begin(); iter != end; ++iter)
-            result->Set(v8::Integer::New(index++), toV8(WTF::getPtr(*iter), isolate));
+            result->Set(v8Integer(index++, isolate), TraitsType::arrayV8Value(*iter, isolate));
         return result;
     }
 
+    v8::Handle<v8::Value> v8Array(PassRefPtr<DOMStringList>, v8::Isolate*);
+
+    template<class T> struct NativeValueTraits;
+
     template<>
-    inline v8::Handle<v8::Value> v8Array(const Vector<String>& iterator, v8::Isolate* isolate)
-    {
-        v8::Local<v8::Array> array = v8::Array::New(iterator.size());
-        Vector<String>::const_iterator end = iterator.end();
-        int index = 0;
-        for (Vector<String>::const_iterator iter = iterator.begin(); iter != end; ++iter)
-            array->Set(v8::Integer::New(index++), v8String(*iter, isolate));
-        return array;
-    }
+    struct NativeValueTraits<String> {
+        static inline String arrayNativeValue(const v8::Local<v8::Array>& array, size_t i)
+        {
+            return v8ValueToWebCoreString(array->Get(i));
+        }
+    };
 
-    v8::Handle<v8::Value> v8Array(PassRefPtr<DOMStringList>, v8::Isolate*);
+    template<>
+    struct NativeValueTraits<float> {
+        static inline float arrayNativeValue(const v8::Local<v8::Array>& array, size_t i)
+        {
+            return static_cast<float>(array->Get(v8Integer(i))->NumberValue());
+        }
+    };
+
+    template<>
+    struct NativeValueTraits<double> {
+        static inline double arrayNativeValue(const v8::Local<v8::Array>& array, size_t i)
+        {
+            return static_cast<double>(array->Get(v8Integer(i))->NumberValue());
+        }
+    };
 
     template <class T>
     Vector<T> toNativeArray(v8::Handle<v8::Value> value)
@@ -324,12 +429,12 @@ namespace WebCore {
             return Vector<T>();
 
         Vector<T> result;
+        typedef NativeValueTraits<T> TraitsType;
         v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(value));
         v8::Local<v8::Array> array = v8::Local<v8::Array>::Cast(v8Value);
         size_t length = array->Length();
-
         for (size_t i = 0; i < length; ++i) {
-            result.append(v8ValueToWebCoreString(array->Get(i)));
+            result.append(TraitsType::arrayNativeValue(array, i));
         }
         return result;
     }
@@ -459,15 +564,6 @@ namespace WebCore {
         return str.isNull() ? v8::Handle<v8::Value>(v8Boolean(false)) : v8::Handle<v8::Value>(v8String(str, isolate));
     }
 
-    template <class T> v8::Handle<v8::Value> v8NumberArray(const Vector<T>& values)
-    {
-        size_t size = values.size();
-        v8::Local<v8::Array> result = v8::Array::New(size);
-        for (size_t i = 0; i < size; ++i)
-            result->Set(i, v8::Number::New(values[i]));
-        return result;
-    }
-
     inline double toWebCoreDate(v8::Handle<v8::Value> object)
     {
         return (object->IsDate() || object->IsNumber()) ? object->NumberValue() : std::numeric_limits<double>::quiet_NaN();
@@ -497,22 +593,6 @@ namespace WebCore {
 
     String int32ToWebCoreString(int value);
 
-    template <class T> Vector<T> v8NumberArrayToVector(v8::Handle<v8::Value> value)
-    {
-        v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(value));
-        if (!v8Value->IsArray())
-            return Vector<T>();
-
-        Vector<T> result;
-        v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(v8Value);
-        size_t length = v8Array->Length();
-        for (size_t i = 0; i < length; ++i) {
-            v8::Local<v8::Value> indexedValue = v8Array->Get(v8::Integer::New(i));
-            result.append(static_cast<T>(indexedValue->NumberValue()));
-        }
-        return result;
-    }
-
     PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value>);
 
     class V8ParameterBase {
diff --git a/Source/WebCore/bindings/v8/V8Collection.h b/Source/WebCore/bindings/v8/V8Collection.h
index b50ba899c..d8cdc81cc 100644
--- a/Source/WebCore/bindings/v8/V8Collection.h
+++ b/Source/WebCore/bindings/v8/V8Collection.h
@@ -106,7 +106,7 @@ template<class Collection> static v8::Handle<v8::Array> nodeCollectionIndexedPro
     v8::Handle<v8::Array> properties = v8::Array::New(length);
     for (int i = 0; i < length; ++i) {
         // FIXME: Do we need to check that the item function returns a non-null value for this index?
-        v8::Handle<v8::Integer> integer = v8::Integer::New(i);
+        v8::Handle<v8::Integer> integer = v8Integer(i, info.GetIsolate());
         properties->Set(integer, integer);
     }
     return properties;
@@ -121,7 +121,7 @@ template<class Collection> static v8::Handle<v8::Array> collectionIndexedPropert
     v8::Handle<v8::Array> properties = v8::Array::New(length);
     for (int i = 0; i < length; ++i) {
         // FIXME: Do we need to check that the item function returns a non-null value for this index?
-        v8::Handle<v8::Integer> integer = v8::Integer::New(i);
+        v8::Handle<v8::Integer> integer = v8Integer(i, info.GetIsolate());
         properties->Set(integer, integer);
     }
     return properties;
diff --git a/Source/WebCore/bindings/v8/V8DOMMap.cpp b/Source/WebCore/bindings/v8/V8DOMMap.cpp
index f09a4a895..0b10cb0c6 100644
--- a/Source/WebCore/bindings/v8/V8DOMMap.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMMap.cpp
@@ -50,10 +50,6 @@ DOMDataStoreHandle::~DOMDataStoreHandle()
     V8BindingPerIsolateData::current()->unregisterDOMDataStore(m_store.get());
 }
 
-void enableFasterDOMStoreAccess()
-{
-}
-
 DOMNodeMapping& getDOMNodeMap(v8::Isolate* isolate)
 {
     return DOMData::getCurrentStore(isolate).domNodeMap();
diff --git a/Source/WebCore/bindings/v8/V8DOMMap.h b/Source/WebCore/bindings/v8/V8DOMMap.h
index bc51540a2..4ee6c318d 100644
--- a/Source/WebCore/bindings/v8/V8DOMMap.h
+++ b/Source/WebCore/bindings/v8/V8DOMMap.h
@@ -31,6 +31,7 @@
 #ifndef V8DOMMap_h
 #define V8DOMMap_h
 
+#include "MemoryInstrumentation.h"
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <v8.h>
@@ -38,6 +39,7 @@
 namespace WebCore {
     class DOMDataStore;
     class Node;
+    class MemoryInstrumentation;
 
     template <class KeyType, class ValueType> class AbstractWeakReferenceMap {
     public:
@@ -61,6 +63,9 @@ namespace WebCore {
         virtual void clear() = 0;
 
         v8::WeakReferenceCallback weakReferenceCallback() { return m_weakReferenceCallback; }
+
+        virtual void reportMemoryUsage(MemoryInstrumentation*) = 0;
+
     private:
         v8::WeakReferenceCallback m_weakReferenceCallback;
     };
@@ -129,6 +134,11 @@ namespace WebCore {
             visitor->endMap();
         }
 
+        virtual void reportMemoryUsage(MemoryInstrumentation* instrumentation) OVERRIDE
+        {
+            instrumentation->reportHashMap(m_map, MemoryInstrumentation::Binding);
+        }
+
     protected:
         HashMap<KeyType*, ValueType*> m_map;
     };
@@ -167,7 +177,6 @@ namespace WebCore {
     // This should be called to remove all DOM objects associated with the current thread when it is tearing down.
     void removeAllDOMObjects();
 
-    void enableFasterDOMStoreAccess();
 } // namespace WebCore
 
 #endif // V8DOMMap_h
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index 056239b4f..bdbe4e1c5 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -300,6 +300,10 @@ bool V8DOMWindowShell::initContextIfNeeded()
 #endif
         V8BindingPerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
 
+        // FIXME: Remove the following 2 lines when V8 default has changed.
+        const char es52GlobalsFlag[] = "--es52_globals";
+        v8::V8::SetFlagsFromString(es52GlobalsFlag, sizeof(es52GlobalsFlag));
+
         isV8Initialized = true;
     }
 
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
index 83b1a1403..eb0522f27 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -180,11 +180,11 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
     v8::Local<v8::Object> thisObject = v8::Object::New();
     if (thisObject.IsEmpty())
         return;
-    if (!thisObject->ForceSet(v8::Integer::NewFromUnsigned(0), nodeWrapper))
+    if (!thisObject->ForceSet(v8UnsignedInteger(0), nodeWrapper))
         return;
-    if (!thisObject->ForceSet(v8::Integer::NewFromUnsigned(1), formWrapper))
+    if (!thisObject->ForceSet(v8UnsignedInteger(1), formWrapper))
         return;
-    if (!thisObject->ForceSet(v8::Integer::NewFromUnsigned(2), documentWrapper))
+    if (!thisObject->ForceSet(v8UnsignedInteger(2), documentWrapper))
         return;
 
     // FIXME: Remove this code when we stop doing the 'with' hack above.
diff --git a/Source/WebCore/bindings/v8/V8NPObject.cpp b/Source/WebCore/bindings/v8/V8NPObject.cpp
index 6125f9a63..d480e3e69 100644
--- a/Source/WebCore/bindings/v8/V8NPObject.cpp
+++ b/Source/WebCore/bindings/v8/V8NPObject.cpp
@@ -264,7 +264,7 @@ v8::Handle<v8::Value> npObjectGetIndexedProperty(v8::Local<v8::Object> self, uin
 v8::Handle<v8::Integer> npObjectQueryProperty(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     NPIdentifier identifier = getStringIdentifier(name);
-    return npObjectGetProperty(info.Holder(), identifier, name, info.GetIsolate()).IsEmpty() ? v8::Handle<v8::Integer>() : v8::Integer::New(v8::None);
+    return npObjectGetProperty(info.Holder(), identifier, name, info.GetIsolate()).IsEmpty() ? v8::Handle<v8::Integer>() : v8Integer(0, info.GetIsolate());
 }
 
 static v8::Handle<v8::Value> npObjectSetProperty(v8::Local<v8::Object> self, NPIdentifier identifier, v8::Local<v8::Value> value, v8::Isolate* isolate)
@@ -335,9 +335,9 @@ v8::Handle<v8::Array> npObjectPropertyEnumerator(const v8::AccessorInfo& info, b
             for (uint32_t i = 0; i < count; ++i) {
                 IdentifierRep* identifier = static_cast<IdentifierRep*>(identifiers[i]);
                 if (namedProperty)
-                    properties->Set(v8::Integer::New(i), v8::String::New(identifier->string()));
+                    properties->Set(v8Integer(i, info.GetIsolate()), v8::String::New(identifier->string()));
                 else
-                    properties->Set(v8::Integer::New(i), v8::Integer::New(identifier->number()));
+                    properties->Set(v8Integer(i, info.GetIsolate()), v8Integer(identifier->number(), info.GetIsolate()));
             }
 
             return properties;
diff --git a/Source/WebCore/bindings/v8/V8NPUtils.cpp b/Source/WebCore/bindings/v8/V8NPUtils.cpp
index ca9e1ea70..89b12e836 100644
--- a/Source/WebCore/bindings/v8/V8NPUtils.cpp
+++ b/Source/WebCore/bindings/v8/V8NPUtils.cpp
@@ -83,7 +83,7 @@ v8::Handle<v8::Value> convertNPVariantToV8Object(const NPVariant* variant, NPObj
 
     switch (type) {
     case NPVariantType_Int32:
-        return v8::Integer::New(NPVARIANT_TO_INT32(*variant));
+        return v8Integer(NPVARIANT_TO_INT32(*variant));
     case NPVariantType_Double:
         return v8::Number::New(NPVARIANT_TO_DOUBLE(*variant));
     case NPVariantType_Bool:
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index f8031ec7e..ae039e3b6 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -115,8 +115,8 @@ void batchConfigureConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor
 {
     for (size_t i = 0; i < constantCount; ++i) {
         const BatchedConstant* constant = &constants[i];
-        functionDescriptor->Set(v8::String::New(constant->name), v8::Integer::New(constant->value), v8::ReadOnly);
-        proto->Set(v8::String::New(constant->name), v8::Integer::New(constant->value), v8::ReadOnly);
+        functionDescriptor->Set(v8::String::New(constant->name), v8Integer(constant->value), v8::ReadOnly);
+        proto->Set(v8::String::New(constant->name), v8Integer(constant->value), v8::ReadOnly);
     }
 }
 
@@ -181,8 +181,8 @@ v8::Handle<v8::Script> V8Proxy::compileScript(v8::Handle<v8::String> code, const
 {
     const uint16_t* fileNameString = fromWebCoreString(fileName);
     v8::Handle<v8::String> name = v8::String::New(fileNameString, fileName.length());
-    v8::Handle<v8::Integer> line = v8::Integer::New(scriptStartPosition.m_line.zeroBasedInt());
-    v8::Handle<v8::Integer> column = v8::Integer::New(scriptStartPosition.m_column.zeroBasedInt());
+    v8::Handle<v8::Integer> line = v8Integer(scriptStartPosition.m_line.zeroBasedInt());
+    v8::Handle<v8::Integer> column = v8Integer(scriptStartPosition.m_column.zeroBasedInt());
     v8::ScriptOrigin origin(name, line, column);
     v8::Handle<v8::Script> script = v8::Script::Compile(code, &origin, scriptData);
     return script;
diff --git a/Source/WebCore/bindings/v8/V8RecursionScope.cpp b/Source/WebCore/bindings/v8/V8RecursionScope.cpp
index 92be720b1..6a09e8e38 100644
--- a/Source/WebCore/bindings/v8/V8RecursionScope.cpp
+++ b/Source/WebCore/bindings/v8/V8RecursionScope.cpp
@@ -32,7 +32,7 @@
 #include "V8RecursionScope.h"
 
 #include "IDBPendingTransactionMonitor.h"
-#include "WebKitMutationObserver.h"
+#include "MutationObserver.h"
 
 namespace WebCore {
 
@@ -41,15 +41,14 @@ void V8RecursionScope::didLeaveScriptContext()
     // FIXME: Instrument any work that takes place when script exits to c++ (e.g. Mutation Observers).
 
 #if ENABLE(INDEXED_DATABASE)
-    // If we've just left a script context and indexed database has been
-    // instantiated, we must let its transaction coordinator know so it can terminate
-    // any not-yet-started transactions.
-    IDBPendingTransactionMonitor::abortPendingTransactions();
+    // Indexed DB requires that transactions are created with an internal |active| flag
+    // set to true, but the flag becomes false when control returns to the event loop.
+    IDBPendingTransactionMonitor::deactivateNewTransactions();
 #endif
 
 #if ENABLE(MUTATION_OBSERVERS)
     if (m_isDocumentContext)
-        WebKitMutationObserver::deliverAllMutations();
+        MutationObserver::deliverAllMutations();
 #endif
 }
 
diff --git a/Source/WebCore/bindings/v8/V8Utilities.cpp b/Source/WebCore/bindings/v8/V8Utilities.cpp
index 9f923a918..7d9334d0e 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.cpp
+++ b/Source/WebCore/bindings/v8/V8Utilities.cpp
@@ -81,7 +81,7 @@ void createHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value>
     }
 
     v8::Local<v8::Array> cacheArray = v8::Local<v8::Array>::Cast(cache);
-    cacheArray->Set(v8::Integer::New(cacheArray->Length()), value);
+    cacheArray->Set(v8Integer(cacheArray->Length()), value);
 }
 
 bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, ArrayBufferArray& arrayBuffers)
@@ -153,7 +153,7 @@ void removeHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value>
         return;
     v8::Local<v8::Array> cacheArray = v8::Local<v8::Array>::Cast(cache);
     for (int i = cacheArray->Length() - 1; i >= 0; --i) {
-        v8::Local<v8::Value> cached = cacheArray->Get(v8::Integer::New(i));
+        v8::Local<v8::Value> cached = cacheArray->Get(v8Integer(i));
         if (cached->StrictEquals(value)) {
             cacheArray->Delete(i);
             return;
diff --git a/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp b/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
index 2379723c8..aef7d1235 100644
--- a/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
+++ b/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
@@ -55,7 +55,7 @@ v8::Local<v8::Value> V8WindowErrorHandler::callListenerFunction(ScriptExecutionC
     if (!listener.IsEmpty() && listener->IsFunction()) {
         v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
         v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
-        v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8::Integer::New(errorEvent->lineno()) };
+        v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8Integer(errorEvent->lineno()) };
         v8::TryCatch tryCatch;
         tryCatch.SetVerbose(true);
         returnValue = V8Proxy::instrumentedCallFunction(0 /* frame */, callFunction, thisValue, 3, parameters);
diff --git a/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp b/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
index b9bdecd4b..dd45a84c3 100644
--- a/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
+++ b/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
@@ -55,7 +55,7 @@ v8::Local<v8::Value> V8WorkerContextErrorHandler::callListenerFunction(ScriptExe
         ErrorEvent* errorEvent = static_cast<ErrorEvent*>(event);
         v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
         v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
-        v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8::Integer::New(errorEvent->lineno()) };
+        v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8Integer(errorEvent->lineno()) };
         V8RecursionScope recursionScope(context);
         returnValue = callFunction->Call(thisValue, 3, parameters);
     }
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index 1f4848bad..139be5191 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -122,6 +122,10 @@ void WorkerContextExecutionProxy::initIsolate()
     v8::V8::SetGlobalGCPrologueCallback(&V8GCController::gcPrologue);
     v8::V8::SetGlobalGCEpilogueCallback(&V8GCController::gcEpilogue);
 
+    // FIXME: Remove the following 2 lines when V8 default has changed.
+    const char es52GlobalsFlag[] = "--es52_globals";
+    v8::V8::SetFlagsFromString(es52GlobalsFlag, sizeof(es52GlobalsFlag));
+
     v8::ResourceConstraints resource_constraints;
     uint32_t here;
     resource_constraints.set_stack_limit(&here - kWorkerMaxStackSize / sizeof(uint32_t*));
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.cpp b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
index cf19e0eec..79c8810fb 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
@@ -77,8 +77,8 @@ WorkerScriptController::~WorkerScriptController()
     WebKit::Platform::current()->didStopWorkerRunLoop(WebKit::WebWorkerRunLoop(&m_workerContext->thread()->runLoop()));
 #endif
     m_proxy.clear();
-    m_isolate->Exit();
     V8BindingPerIsolateData::dispose(m_isolate);
+    m_isolate->Exit();
     m_isolate->Dispose();
 }
 
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
index 1860ddc8d..15546e6d6 100755
--- a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
@@ -79,7 +79,7 @@ void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener)
     ASSERT(!value->IsUndefined() && value->IsArray());
     v8::Handle<v8::Array> scriptsArray = v8::Handle<v8::Array>::Cast(value);
     for (unsigned i = 0; i < scriptsArray->Length(); ++i)
-        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
+        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8Integer(i))));
 }
 
 void WorkerScriptDebugServer::removeListener(ScriptDebugListener* listener)
diff --git a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
index 62fc8ecad..af2375f7c 100644
--- a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
@@ -174,7 +174,7 @@ v8::Handle<v8::Array> V8CSSStyleDeclaration::namedPropertyEnumerator(const v8::A
     for (unsigned i = 0; i < propertyNamesLength; ++i) {
         String key = propertyNames.at(i);
         ASSERT(!key.isNull());
-        properties->Set(v8::Integer::New(i), v8String(key, info.GetIsolate()));
+        properties->Set(v8Integer(i, info.GetIsolate()), v8String(key, info.GetIsolate()));
     }
 
     return properties;
@@ -185,7 +185,7 @@ v8::Handle<v8::Integer> V8CSSStyleDeclaration::namedPropertyQuery(v8::Local<v8::
     INC_STATS("DOM.CSSStyleDeclaration.NamedPropertyQuery");
 
     if (cssPropertyInfo(v8Name))
-        return v8::Integer::New(v8::None);
+        return v8Integer(0, info.GetIsolate());
 
     return v8::Handle<v8::Integer>();
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
index 3063459e7..80030128d 100644
--- a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
@@ -57,7 +57,7 @@ v8::Handle<v8::Value> V8Clipboard::typesAccessorGetter(v8::Local<v8::String> nam
     HashSet<String>::const_iterator end = types.end();
     int index = 0;
     for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it, ++index)
-        result->Set(v8::Integer::New(index), v8String(*it, info.GetIsolate()));
+        result->Set(v8Integer(index, info.GetIsolate()), v8String(*it, info.GetIsolate()));
 
     return result;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
index cdbf38581..5d43d4070 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
@@ -42,7 +42,7 @@ v8::Handle<v8::Integer> V8DOMStringMap::namedPropertyQuery(v8::Local<v8::String>
 {
     INC_STATS("DOM.DOMStringMap.NamedPropertyQuery");
     if (V8DOMStringMap::toNative(info.Holder())->contains(toWebCoreString(name)))
-        return v8::Integer::New(v8::None);
+        return v8Integer(v8::None, info.GetIsolate());
     return v8::Handle<v8::Integer>();
 }
 
@@ -62,7 +62,7 @@ v8::Handle<v8::Array> V8DOMStringMap::namedPropertyEnumerator(const v8::Accessor
     V8DOMStringMap::toNative(info.Holder())->getNames(names);
     v8::Handle<v8::Array> properties = v8::Array::New(names.size());
     for (size_t i = 0; i < names.size(); ++i)
-        properties->Set(v8::Integer::New(i), v8String(names[i], info.GetIsolate()));
+        properties->Set(v8Integer(i, info.GetIsolate()), v8String(names[i], info.GetIsolate()));
     return properties;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index c0964ad19..0dcc29952 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -131,7 +131,7 @@ v8::Handle<v8::Value> WindowSetTimeoutImpl(const v8::Arguments& args, bool singl
     } else {
         RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
         if (imp->document() && !imp->document()->contentSecurityPolicy()->allowEval(callStack.release()))
-            return v8::Integer::New(0);
+            return v8Integer(0, args.GetIsolate());
         id = DOMTimer::install(scriptContext, adoptPtr(new ScheduledAction(V8Proxy::context(imp->frame()), functionString)), timeout, singleShot);
     }
 
@@ -142,7 +142,7 @@ v8::Handle<v8::Value> WindowSetTimeoutImpl(const v8::Arguments& args, bool singl
         V8GCForContextDispose::instance().notifyIdleSooner(maximumFireInterval);
     }
 
-    return v8::Integer::New(id);
+    return v8Integer(id, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8DOMWindow::eventAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
@@ -520,11 +520,11 @@ v8::Handle<v8::Value> V8DOMWindow::namedPropertyGetter(v8::Local<v8::String> nam
 
     if (doc && doc->isHTMLDocument()) {
         if (static_cast<HTMLDocument*>(doc)->hasNamedItem(propName.impl()) || doc->hasElementWithId(propName.impl())) {
-            HTMLCollection* items = doc->windowNamedItems(propName);
-            if (items->hasAnyItem()) {
+            RefPtr<HTMLCollection> items = doc->windowNamedItems(propName);
+            if (!items->isEmpty()) {
                 if (items->hasExactlyOneItem())
                     return toV8(items->item(0), info.GetIsolate());
-                return toV8(items, info.GetIsolate());
+                return toV8(items.release(), info.GetIsolate());
             }
         }
     }
diff --git a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
index 34110a0b6..bddba9aa0 100755
--- a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
@@ -76,7 +76,7 @@ v8::Handle<v8::Value> V8DataView::getInt8Callback(const v8::Arguments& args)
     int8_t result = imp->getInt8(byteOffset, ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, args.GetIsolate());
-    return v8::Integer::New(result);
+    return v8Integer(result, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8DataView::getUint8Callback(const v8::Arguments& args)
@@ -91,7 +91,7 @@ v8::Handle<v8::Value> V8DataView::getUint8Callback(const v8::Arguments& args)
     uint8_t result = imp->getUint8(byteOffset, ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, args.GetIsolate());
-    return v8::Integer::New(result);
+    return v8Integer(result, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8DataView::setInt8Callback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index df5331727..31efd0ce2 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -84,8 +84,8 @@ v8::Handle<v8::Value> V8HTMLDocument::GetNamedProperty(HTMLDocument* htmlDocumen
     if (!htmlDocument->hasNamedItem(key.impl()) && !htmlDocument->hasExtraNamedItem(key.impl()))
         return v8::Handle<v8::Value>();
 
-    HTMLCollection* items = htmlDocument->documentNamedItems(key);
-    if (!items->hasAnyItem())
+    RefPtr<HTMLCollection> items = htmlDocument->documentNamedItems(key);
+    if (items->isEmpty())
         return v8::Handle<v8::Value>();
 
     if (items->hasExactlyOneItem()) {
@@ -97,7 +97,7 @@ v8::Handle<v8::Value> V8HTMLDocument::GetNamedProperty(HTMLDocument* htmlDocumen
         return toV8(node, isolate);
     }
 
-    return toV8(items, isolate);
+    return toV8(items.release(), isolate);
 }
 
 // HTMLDocument ----------------------------------------------------------------
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
index 7a6fff47f..03ead6584 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
@@ -48,7 +48,7 @@ v8::Handle<v8::Value> V8HTMLInputElement::selectionStartAccessorGetter(v8::Local
         return V8Proxy::throwTypeError("Accessing selectionStart on an input element that cannot have a selection.", info.GetIsolate());
 
     int v = imp->selectionStart();
-    return v8::Integer::New(v);
+    return v8Integer(v, info.GetIsolate());
 }
 
 void V8HTMLInputElement::selectionStartAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -74,7 +74,7 @@ v8::Handle<v8::Value> V8HTMLInputElement::selectionEndAccessorGetter(v8::Local<v
         return V8Proxy::throwTypeError("Accessing selectionEnd on an input element that cannot have a selection.", info.GetIsolate());
 
     int v = imp->selectionEnd();
-    return v8::Integer::New(v);
+    return v8Integer(v, info.GetIsolate());
 }
 
 void V8HTMLInputElement::selectionEndAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
index 44187c979..61efa44f2 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
@@ -88,7 +88,7 @@ v8::Handle<v8::Value> V8HTMLOptionsCollection::lengthAccessorGetter(v8::Local<v8
     INC_STATS("DOM.HTMLOptionsCollection.length._get");
     HTMLOptionsCollection* imp = V8HTMLOptionsCollection::toNative(info.Holder());
     int v = imp->length();
-    return v8::Integer::New(v);
+    return v8Integer(v, info.GetIsolate());
 }
 
 void V8HTMLOptionsCollection::lengthAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 9a42dee90..67e8d2d57 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -168,8 +168,8 @@ v8::Handle<v8::Value> V8InjectedScriptHost::functionDetailsCallback(const v8::Ar
     int columnNumber = function->GetScriptColumnNumber();
 
     v8::Local<v8::Object> location = v8::Object::New();
-    location->Set(v8::String::New("lineNumber"), v8::Integer::New(lineNumber));
-    location->Set(v8::String::New("columnNumber"), v8::Integer::New(columnNumber));
+    location->Set(v8::String::New("lineNumber"), v8Integer(lineNumber, args.GetIsolate()));
+    location->Set(v8::String::New("columnNumber"), v8Integer(columnNumber, args.GetIsolate()));
     location->Set(v8::String::New("scriptId"), function->GetScriptId()->ToString());
 
     v8::Local<v8::Object> result = v8::Object::New();
diff --git a/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
index 77ba3f266..3d8e8e18e 100644
--- a/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
@@ -101,7 +101,7 @@ v8::Handle<v8::Value> V8MessageEvent::portsAccessorGetter(v8::Local<v8::String>
 
     v8::Local<v8::Array> portArray = v8::Array::New(portsCopy.size());
     for (size_t i = 0; i < portsCopy.size(); ++i)
-        portArray->Set(v8::Integer::New(i), toV8(portsCopy[i].get(), info.GetIsolate()));
+        portArray->Set(v8Integer(i, info.GetIsolate()), toV8(portsCopy[i].get(), info.GetIsolate()));
 
     return portArray;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
index bffbe7400..9280b216c 100644
--- a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
@@ -37,9 +37,9 @@
 #include "ScriptExecutionContext.h"
 #include "V8Binding.h"
 #include "V8CustomVoidCallback.h"
+#include "V8MutationObserver.h"
 #include "V8MutationRecord.h"
 #include "V8Proxy.h"
-#include "V8WebKitMutationObserver.h"
 #include <wtf/Assertions.h>
 #include <wtf/GetPtr.h>
 #include <wtf/RefCounted.h>
@@ -47,7 +47,7 @@
 
 namespace WebCore {
 
-bool V8MutationCallback::handleEvent(MutationRecordArray* mutations, WebKitMutationObserver* observer)
+bool V8MutationCallback::handleEvent(MutationRecordArray* mutations, MutationObserver* observer)
 {
     ASSERT(mutations);
     if (!mutations)
@@ -66,7 +66,7 @@ bool V8MutationCallback::handleEvent(MutationRecordArray* mutations, WebKitMutat
 
     v8::Local<v8::Array> mutationsArray = v8::Array::New(mutations->size());
     for (size_t i = 0; i < mutations->size(); ++i)
-        mutationsArray->Set(v8::Integer::New(i), toV8(mutations->at(i).get()));
+        mutationsArray->Set(v8Integer(i), toV8(mutations->at(i).get()));
 
     v8::Handle<v8::Value> observerHandle = toV8(observer);
     if (observerHandle.IsEmpty()) {
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
index 7667854b2..a43d6e91d 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
@@ -32,21 +32,21 @@
 
 #if ENABLE(MUTATION_OBSERVERS)
 
-#include "V8WebKitMutationObserver.h"
+#include "V8MutationObserver.h"
 
+#include "MutationObserver.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
 #include "V8DOMWrapper.h"
 #include "V8MutationCallback.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
-#include "WebKitMutationObserver.h"
 
 namespace WebCore {
 
-v8::Handle<v8::Value> V8WebKitMutationObserver::constructorCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8MutationObserver::constructorCallback(const v8::Arguments& args)
 {
-    INC_STATS("DOM.WebKitMutationObserver.Constructor");
+    INC_STATS("DOM.MutationObserver.Constructor");
 
     if (!args.IsConstructCall())
         return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.", args.GetIsolate());
@@ -63,10 +63,10 @@ v8::Handle<v8::Value> V8WebKitMutationObserver::constructorCallback(const v8::Ar
 
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
-        return V8Proxy::throwError(V8Proxy::ReferenceError, "WebKitMutationObserver constructor's associated frame unavailable", args.GetIsolate());
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "MutationObserver constructor's associated frame unavailable", args.GetIsolate());
 
     RefPtr<MutationCallback> callback = V8MutationCallback::create(arg, context);
-    RefPtr<WebKitMutationObserver> observer = WebKitMutationObserver::create(callback.release());
+    RefPtr<MutationObserver> observer = MutationObserver::create(callback.release());
 
     V8DOMWrapper::setDOMWrapper(args.Holder(), &info, observer.get());
     V8DOMWrapper::setJSWrapperForDOMObject(observer.release(), v8::Persistent<v8::Object>::New(args.Holder()));
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
index 656b9d510..9e1be9ade 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "V8NodeList.h" 
 
+#include "DynamicNodeList.h"
 #include "NodeList.h"
 #include "V8Binding.h"
 #include "V8Node.h"
@@ -50,7 +51,7 @@ v8::Handle<v8::Value> V8NodeList::namedPropertyGetter(v8::Local<v8::String> name
     // Length property cannot be overridden.
     DEFINE_STATIC_LOCAL(const AtomicString, length, ("length"));
     if (key == length)
-        return v8::Integer::New(list->length());
+        return v8Integer(list->length(), info.GetIsolate());
 
     RefPtr<Node> result = list->itemWithName(key);
     if (!result)
@@ -59,4 +60,19 @@ v8::Handle<v8::Value> V8NodeList::namedPropertyGetter(v8::Local<v8::String> name
     return toV8(result.release(), info.GetIsolate());
 }
 
+void V8NodeList::visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+{
+    NodeList* impl = static_cast<NodeList*>(object);
+    if (impl->isDynamicNodeList()) {
+        Node* owner = static_cast<DynamicNodeList*>(impl)->ownerNode();
+        if (owner) {
+            v8::Persistent<v8::Object> ownerWrapper = store->domNodeMap().get(owner);
+            if (!ownerWrapper.IsEmpty()) {
+                v8::Persistent<v8::Value> value = wrapper;
+                v8::V8::AddImplicitReferences(ownerWrapper, &value, 1);
+            }
+        }
+    }
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
index 71c4f3bd3..e79f937d6 100644
--- a/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
@@ -73,7 +73,7 @@ v8::Handle<v8::Value> V8SQLTransaction::executeSqlCallback(const v8::Arguments&
             sqlArgsLength = length->Uint32Value();
 
         for (unsigned int i = 0; i < sqlArgsLength; ++i) {
-            v8::Local<v8::Integer> key = v8::Integer::New(i);
+            v8::Handle<v8::Integer> key = v8Integer(i, args.GetIsolate());
             EXCEPTION_BLOCK(v8::Local<v8::Value>, value, sqlArgsObject->Get(key));
 
             if (value.IsEmpty() || value->IsNull())
diff --git a/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
index 707b0d8b6..622937d6a 100644
--- a/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
@@ -73,7 +73,7 @@ v8::Handle<v8::Value> V8SQLTransactionSync::executeSqlCallback(const v8::Argumen
             sqlArgsLength = length->Uint32Value();
 
         for (unsigned int i = 0; i < sqlArgsLength; ++i) {
-            v8::Local<v8::Integer> key = v8::Integer::New(i);
+            v8::Handle<v8::Integer> key = v8Integer(i, args.GetIsolate());
             EXCEPTION_BLOCK(v8::Local<v8::Value>, value, sqlArgsObject->Get(key));
 
             if (value.IsEmpty() || value->IsNull())
diff --git a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
index 1bdadb5d9..89396a30c 100644
--- a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
@@ -47,7 +47,7 @@ v8::Handle<v8::Array> V8Storage::namedPropertyEnumerator(const v8::AccessorInfo&
         String key = storage->key(i);
         ASSERT(!key.isNull());
         String val = storage->getItem(key);
-        properties->Set(v8::Integer::New(i), v8String(key, info.GetIsolate()));
+        properties->Set(v8Integer(i, info.GetIsolate()), v8String(key, info.GetIsolate()));
     }
 
     return properties;
@@ -67,7 +67,7 @@ static v8::Handle<v8::Value> storageGetter(v8::Local<v8::String> v8Name, const v
 v8::Handle<v8::Value> V8Storage::indexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Storage.IndexedPropertyGetter");
-    v8::Local<v8::Integer> indexV8 = v8::Integer::New(index);
+    v8::Handle<v8::Integer> indexV8 = v8Integer(index, info.GetIsolate());
     return storageGetter(indexV8->ToString(), info);
 }
 
@@ -87,7 +87,7 @@ v8::Handle<v8::Integer> V8Storage::namedPropertyQuery(v8::Local<v8::String> v8Na
     String name = toWebCoreString(v8Name);
 
     if (name != "length" && storage->contains(name))
-        return v8::Integer::New(v8::None);
+        return v8Integer(0, info.GetIsolate());
 
     return v8::Handle<v8::Integer>();
 }
@@ -116,7 +116,7 @@ static v8::Handle<v8::Value> storageSetter(v8::Local<v8::String> v8Name, v8::Loc
 v8::Handle<v8::Value> V8Storage::indexedPropertySetter(uint32_t index, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Storage.NamedPropertyGetter");
-    v8::Local<v8::Integer> indexV8 = v8::Integer::New(index);
+    v8::Handle<v8::Integer> indexV8 = v8Integer(index, info.GetIsolate());
     return storageSetter(indexV8->ToString(), value, info);
 }
 
@@ -142,7 +142,7 @@ static v8::Handle<v8::Boolean> storageDeleter(v8::Local<v8::String> v8Name, cons
 v8::Handle<v8::Boolean> V8Storage::indexedPropertyDeleter(uint32_t index, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Storage.IndexedPropertyDeleter");
-    v8::Local<v8::Integer> indexV8 = v8::Integer::New(index);
+    v8::Handle<v8::Integer> indexV8 = v8Integer(index, info.GetIsolate());
     return storageDeleter(indexV8->ToString(), info);
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 5059ddf0a..5904ec2fa 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -125,19 +125,19 @@ static v8::Handle<v8::Value> toV8Object(const WebGLGetInfo& info, v8::Isolate* i
         const Vector<bool>& value = info.getBoolArray();
         v8::Local<v8::Array> array = v8::Array::New(value.size());
         for (size_t ii = 0; ii < value.size(); ++ii)
-            array->Set(v8::Integer::New(ii), v8::Boolean::New(value[ii]));
+            array->Set(v8Integer(ii, isolate), v8::Boolean::New(value[ii]));
         return array;
     }
     case WebGLGetInfo::kTypeFloat:
         return v8::Number::New(info.getFloat());
     case WebGLGetInfo::kTypeInt:
-        return v8::Integer::New(info.getInt());
+        return v8Integer(info.getInt(), isolate);
     case WebGLGetInfo::kTypeNull:
         return v8::Null(isolate);
     case WebGLGetInfo::kTypeString:
         return v8::String::New(fromWebCoreString(info.getString()), info.getString().length());
     case WebGLGetInfo::kTypeUnsignedInt:
-        return v8::Integer::NewFromUnsigned(info.getUnsignedInt());
+        return v8UnsignedInteger(info.getUnsignedInt(), isolate);
     case WebGLGetInfo::kTypeWebGLBuffer:
         return toV8(info.getWebGLBuffer(), isolate);
     case WebGLGetInfo::kTypeWebGLFloatArray:
@@ -289,7 +289,7 @@ v8::Handle<v8::Value> V8WebGLRenderingContext::getAttachedShadersCallback(const
         return v8::Null(args.GetIsolate());
     v8::Local<v8::Array> array = v8::Array::New(shaders.size());
     for (size_t ii = 0; ii < shaders.size(); ++ii)
-        array->Set(v8::Integer::New(ii), toV8(shaders[ii].get(), args.GetIsolate()));
+        array->Set(v8Integer(ii, args.GetIsolate()), toV8(shaders[ii].get(), args.GetIsolate()));
     return array;
 }
 
@@ -398,7 +398,7 @@ v8::Handle<v8::Value> V8WebGLRenderingContext::getSupportedExtensionsCallback(co
     Vector<String> value = imp->getSupportedExtensions();
     v8::Local<v8::Array> array = v8::Array::New(value.size());
     for (size_t ii = 0; ii < value.size(); ++ii)
-        array->Set(v8::Integer::New(ii), v8::String::New(fromWebCoreString(value[ii]), value[ii].length()));
+        array->Set(v8Integer(ii, args.GetIsolate()), v8::String::New(fromWebCoreString(value[ii]), value[ii].length()));
     return array;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index 17c9f1bbf..7e27f6c05 100644
--- a/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -83,7 +83,7 @@ v8::Handle<v8::Value> SetTimeoutOrInterval(const v8::Arguments& args, bool singl
     } else
         return v8::Undefined();
 
-    return v8::Integer::New(timerId);
+    return v8Integer(timerId, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8WorkerContext::importScriptsCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 8b429f8a4..5e64fc2d3 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -36,6 +36,7 @@
 #include "Frame.h"
 #include "InspectorInstrumentation.h"
 #include "V8ArrayBuffer.h"
+#include "V8ArrayBufferView.h"
 #include "V8Binding.h"
 #include "V8Blob.h"
 #include "V8DOMFormData.h"
@@ -188,6 +189,11 @@ v8::Handle<v8::Value> V8XMLHttpRequest::sendCallback(const v8::Arguments& args)
             ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(object);
             ASSERT(arrayBuffer);
             xmlHttpRequest->send(arrayBuffer, ec);
+        } else if (V8ArrayBufferView::HasInstance(arg)) {
+            v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
+            ArrayBufferView* arrayBufferView = V8ArrayBufferView::toNative(object);
+            ASSERT(arrayBufferView);
+            xmlHttpRequest->send(arrayBufferView, ec);
 #endif
         } else
             xmlHttpRequest->send(toWebCoreStringWithNullCheck(arg), ec);