Merge from Chromium at DEPS revision 237746

This commit was generated by merge_to_master.py.

Change-Id: Ia99affe6e2cf9342843aa38fa1d75355fd5c71f7
diff --git a/Source/bindings/v8/BindingSecurity.cpp b/Source/bindings/v8/BindingSecurity.cpp
index dd8b46b..da2bed7 100644
--- a/Source/bindings/v8/BindingSecurity.cpp
+++ b/Source/bindings/v8/BindingSecurity.cpp
@@ -37,7 +37,7 @@
 #include "core/frame/DOMWindow.h"
 #include "core/frame/Frame.h"
 #include "core/page/Settings.h"
-#include "weborigin/SecurityOrigin.h"
+#include "platform/weborigin/SecurityOrigin.h"
 
 namespace WebCore {
 
@@ -55,13 +55,14 @@
     return false;
 }
 
-static bool canAccessDocument(Document* targetDocument, ExceptionState& es)
+static bool canAccessDocument(Document* targetDocument, ExceptionState& exceptionState)
 {
     DOMWindow* activeWindow = activeDOMWindow();
     if (isDocumentAccessibleFromDOMWindow(targetDocument, activeWindow))
         return true;
 
-    es.throwSecurityError(targetDocument->domWindow()->sanitizedCrossDomainAccessErrorMessage(activeWindow), targetDocument->domWindow()->crossDomainAccessErrorMessage(activeWindow));
+    if (targetDocument->domWindow())
+        exceptionState.throwSecurityError(targetDocument->domWindow()->sanitizedCrossDomainAccessErrorMessage(activeWindow), targetDocument->domWindow()->crossDomainAccessErrorMessage(activeWindow));
     return false;
 }
 
@@ -71,7 +72,7 @@
     if (isDocumentAccessibleFromDOMWindow(targetDocument, activeWindow))
         return true;
 
-    if (reportingOption == ReportSecurityError) {
+    if (reportingOption == ReportSecurityError && targetDocument->domWindow()) {
         if (Frame* frame = targetDocument->frame())
             frame->domWindow()->printErrorMessage(targetDocument->domWindow()->crossDomainAccessErrorMessage(activeWindow));
     }
@@ -84,14 +85,14 @@
     return target && canAccessDocument(target->document(), reportingOption);
 }
 
-bool BindingSecurity::shouldAllowAccessToFrame(Frame* target, ExceptionState& es)
+bool BindingSecurity::shouldAllowAccessToFrame(Frame* target, ExceptionState& exceptionState)
 {
-    return target && canAccessDocument(target->document(), es);
+    return target && canAccessDocument(target->document(), exceptionState);
 }
 
-bool BindingSecurity::shouldAllowAccessToNode(Node* target, ExceptionState& es)
+bool BindingSecurity::shouldAllowAccessToNode(Node* target, ExceptionState& exceptionState)
 {
-    return target && canAccessDocument(&target->document(), es);
+    return target && canAccessDocument(&target->document(), exceptionState);
 }
 
 }
diff --git a/Source/bindings/v8/CallbackPromiseAdapter.h b/Source/bindings/v8/CallbackPromiseAdapter.h
index 0cf6ea5..19b5a54 100644
--- a/Source/bindings/v8/CallbackPromiseAdapter.h
+++ b/Source/bindings/v8/CallbackPromiseAdapter.h
@@ -46,13 +46,13 @@
 // To use:
 //
 // class MyClass ... {
-//    typedef WebKit::WebMyClass WebType;
-//    static PassRefPtr<MyClass> from(WebKit::WebMyClass* webInstance) {
+//    typedef blink::WebMyClass WebType;
+//    static PassRefPtr<MyClass> from(blink::WebMyClass* webInstance) {
 //        // convert/create as appropriate, but often it's just:
 //        return MyClass::create(adoptPtr(webInstance));
 //    }
 //
-// Now when calling into a WebKit API that requires a WebCallbacks<WebKit::WebMyClass, WebKit::WebMyClass>*:
+// Now when calling into a WebKit API that requires a WebCallbacks<blink::WebMyClass, blink::WebMyClass>*:
 //
 //    // call signature: callSomeMethod(WebCallbacks<MyClass, MyClass>* callbacks)
 //    webObject->callSomeMethod(new CallbackPromiseAdapter<MyClass, MyClass>(resolver, scriptExecutionContext));
@@ -61,7 +61,7 @@
 // example that ownership of the WebCallbacks instance is being passed
 // in and it is up to the callee to free the WebCallbacks instace.
 template<typename S, typename T>
-class CallbackPromiseAdapter : public WebKit::WebCallbacks<typename S::WebType, typename T::WebType> {
+class CallbackPromiseAdapter : public blink::WebCallbacks<typename S::WebType, typename T::WebType> {
 public:
     explicit CallbackPromiseAdapter(PassRefPtr<ScriptPromiseResolver> resolver, ExecutionContext* context)
         : m_resolver(resolver)
@@ -83,7 +83,7 @@
 private:
     RefPtr<ScriptPromiseResolver> m_resolver;
     DOMRequestState m_requestState;
-    DISALLOW_COPY_AND_ASSIGN(CallbackPromiseAdapter);
+    WTF_MAKE_NONCOPYABLE(CallbackPromiseAdapter);
 };
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/CustomElementConstructorBuilder.cpp b/Source/bindings/v8/CustomElementConstructorBuilder.cpp
index 079d5b3..9538444 100644
--- a/Source/bindings/v8/CustomElementConstructorBuilder.cpp
+++ b/Source/bindings/v8/CustomElementConstructorBuilder.cpp
@@ -40,6 +40,7 @@
 #include "bindings/v8/DOMWrapperWorld.h"
 #include "bindings/v8/Dictionary.h"
 #include "bindings/v8/ExceptionState.h"
+#include "bindings/v8/ScriptState.h"
 #include "bindings/v8/UnsafePersistent.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8HiddenPropertyName.h"
@@ -69,7 +70,7 @@
     return !DOMWrapperWorld::isolatedWorld(m_context);
 }
 
-bool CustomElementConstructorBuilder::validateOptions(const AtomicString& type, QualifiedName& tagName, ExceptionState& es)
+bool CustomElementConstructorBuilder::validateOptions(const AtomicString& type, QualifiedName& tagName, ExceptionState& exceptionState)
 {
     ASSERT(m_prototype.IsEmpty());
 
@@ -77,7 +78,7 @@
     if (m_options->get("prototype", prototypeScriptValue) && !prototypeScriptValue.isNull()) {
         m_prototype = prototypeScriptValue.v8Value().As<v8::Object>();
         if (m_prototype.IsEmpty()) {
-            CustomElementException::throwException(CustomElementException::PrototypeNotAnObject, type, es);
+            CustomElementException::throwException(CustomElementException::PrototypeNotAnObject, type, exceptionState);
             return false;
         }
     } else {
@@ -92,7 +93,7 @@
 
     if (!V8PerContextData::from(m_context)) {
         // FIXME: This should generate an InvalidContext exception at a later point.
-        CustomElementException::throwException(CustomElementException::ContextDestroyedCheckingPrototype, type, es);
+        CustomElementException::throwException(CustomElementException::ContextDestroyedCheckingPrototype, type, exceptionState);
         return false;
     }
 
@@ -106,11 +107,11 @@
         localName = extends.lower();
 
         if (!Document::isValidName(localName)) {
-            CustomElementException::throwException(CustomElementException::ExtendsIsInvalidName, type, es);
+            CustomElementException::throwException(CustomElementException::ExtendsIsInvalidName, type, exceptionState);
             return false;
         }
         if (CustomElement::isValidName(localName)) {
-            CustomElementException::throwException(CustomElementException::ExtendsIsCustomElementName, type, es);
+            CustomElementException::throwException(CustomElementException::ExtendsIsCustomElementName, type, exceptionState);
             return false;
         }
     } else {
@@ -156,7 +157,7 @@
     return value.As<v8::Function>();
 }
 
-bool CustomElementConstructorBuilder::createConstructor(Document* document, CustomElementDefinition* definition, ExceptionState& es)
+bool CustomElementConstructorBuilder::createConstructor(Document* document, CustomElementDefinition* definition, ExceptionState& exceptionState)
 {
     ASSERT(!m_prototype.IsEmpty());
     ASSERT(m_constructor.IsEmpty());
@@ -164,14 +165,14 @@
 
     v8::Isolate* isolate = m_context->GetIsolate();
 
-    if (!prototypeIsValid(definition->descriptor().type(), es))
+    if (!prototypeIsValid(definition->descriptor().type(), exceptionState))
         return false;
 
     v8::Local<v8::FunctionTemplate> constructorTemplate = v8::FunctionTemplate::New();
     constructorTemplate->SetCallHandler(constructCustomElement);
     m_constructor = constructorTemplate->GetFunction();
     if (m_constructor.IsEmpty()) {
-        CustomElementException::throwException(CustomElementException::ContextDestroyedRegisteringDefinition, definition->descriptor().type(), es);
+        CustomElementException::throwException(CustomElementException::ContextDestroyedRegisteringDefinition, definition->descriptor().type(), exceptionState);
         return false;
     }
 
@@ -208,15 +209,15 @@
     return true;
 }
 
-bool CustomElementConstructorBuilder::prototypeIsValid(const AtomicString& type, ExceptionState& es) const
+bool CustomElementConstructorBuilder::prototypeIsValid(const AtomicString& type, ExceptionState& exceptionState) const
 {
     if (m_prototype->InternalFieldCount() || !m_prototype->GetHiddenValue(V8HiddenPropertyName::customElementIsInterfacePrototypeObject(m_context->GetIsolate())).IsEmpty()) {
-        CustomElementException::throwException(CustomElementException::PrototypeInUse, type, es);
+        CustomElementException::throwException(CustomElementException::PrototypeInUse, type, exceptionState);
         return false;
     }
 
     if (m_prototype->GetPropertyAttributes(v8String("constructor", m_context->GetIsolate())) & v8::DontDelete) {
-        CustomElementException::throwException(CustomElementException::ConstructorPropertyNotConfigurable, type, es);
+        CustomElementException::throwException(CustomElementException::ConstructorPropertyNotConfigurable, type, exceptionState);
         return false;
     }
 
@@ -271,10 +272,10 @@
     v8::Handle<v8::Value> maybeType = info.Callee()->GetHiddenValue(V8HiddenPropertyName::customElementType(isolate));
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, type, maybeType);
 
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     CustomElementCallbackDispatcher::CallbackDeliveryScope deliveryScope;
-    RefPtr<Element> element = document->createElementNS(namespaceURI, tagName, maybeType->IsNull() ? nullAtom : type, es);
-    if (es.throwIfNeeded())
+    RefPtr<Element> element = document->createElementNS(namespaceURI, tagName, maybeType->IsNull() ? nullAtom : type, exceptionState);
+    if (exceptionState.throwIfNeeded())
         return;
     v8SetReturnValueFast(info, element.release(), document);
 }
diff --git a/Source/bindings/v8/DOMDataStore.cpp b/Source/bindings/v8/DOMDataStore.cpp
index bbcac2b..2626f5c 100644
--- a/Source/bindings/v8/DOMDataStore.cpp
+++ b/Source/bindings/v8/DOMDataStore.cpp
@@ -51,18 +51,18 @@
     m_wrapperMap.clear();
 }
 
-DOMDataStore* DOMDataStore::mainWorldStore()
+DOMDataStore& DOMDataStore::mainWorldStore()
 {
     DEFINE_STATIC_LOCAL(DOMDataStore, mainWorldDOMDataStore, (MainWorld));
     ASSERT(isMainThread());
-    return &mainWorldDOMDataStore;
+    return mainWorldDOMDataStore;
 }
 
-DOMDataStore* DOMDataStore::current(v8::Isolate* isolate)
+DOMDataStore& DOMDataStore::current(v8::Isolate* isolate)
 {
     V8PerIsolateData* data = isolate ? V8PerIsolateData::from(isolate) : V8PerIsolateData::current();
     if (UNLIKELY(!!data->workerDOMDataStore()))
-        return data->workerDOMDataStore();
+        return *data->workerDOMDataStore();
 
     if (DOMWrapperWorld::isolatedWorldsExist()) {
         DOMWrapperWorld* isolatedWorld = DOMWrapperWorld::isolatedWorld(v8::Context::GetEntered());
diff --git a/Source/bindings/v8/DOMDataStore.h b/Source/bindings/v8/DOMDataStore.h
index 154d8d8..a75d38f 100644
--- a/Source/bindings/v8/DOMDataStore.h
+++ b/Source/bindings/v8/DOMDataStore.h
@@ -49,7 +49,7 @@
     explicit DOMDataStore(WrapperWorldType);
     ~DOMDataStore();
 
-    static DOMDataStore* current(v8::Isolate*);
+    static DOMDataStore& current(v8::Isolate*);
 
     template<typename V8T, typename T, typename Wrappable>
     static bool setReturnValueFromWrapperFast(v8::ReturnValue<v8::Value> returnValue, T* object, v8::Local<v8::Object> holder, Wrappable* wrappable)
@@ -63,9 +63,9 @@
         if ((!DOMWrapperWorld::isolatedWorldsExist() && !canExistInWorker(object)) || holderContainsWrapper(holder, wrappable)) {
             if (ScriptWrappable::wrapperCanBeStoredInObject(object))
                 return ScriptWrappable::setReturnValueWithSecurityCheck<V8T>(returnValue, object);
-            return mainWorldStore()->m_wrapperMap.setReturnValueFrom(returnValue, V8T::toInternalPointer(object));
+            return mainWorldStore().m_wrapperMap.setReturnValueFrom(returnValue, V8T::toInternalPointer(object));
         }
-        return current(returnValue.GetIsolate())->template setReturnValueFrom<V8T>(returnValue, object);
+        return current(returnValue.GetIsolate()).template setReturnValueFrom<V8T>(returnValue, object);
     }
 
     template<typename V8T, typename T>
@@ -75,7 +75,7 @@
             if (LIKELY(!DOMWrapperWorld::isolatedWorldsExist()))
                 return ScriptWrappable::setReturnValueWithSecurityCheck<V8T>(returnValue, object);
         }
-        return current(returnValue.GetIsolate())->template setReturnValueFrom<V8T>(returnValue, object);
+        return current(returnValue.GetIsolate()).template setReturnValueFrom<V8T>(returnValue, object);
     }
 
     template<typename V8T, typename T>
@@ -83,7 +83,7 @@
     {
         if (ScriptWrappable::wrapperCanBeStoredInObject(object))
             return ScriptWrappable::setReturnValue(returnValue, object);
-        return mainWorldStore()->m_wrapperMap.setReturnValueFrom(returnValue, V8T::toInternalPointer(object));
+        return mainWorldStore().m_wrapperMap.setReturnValueFrom(returnValue, V8T::toInternalPointer(object));
     }
 
     template<typename V8T, typename T>
@@ -97,7 +97,7 @@
                 return result;
             }
         }
-        return current(isolate)->template get<V8T>(object, isolate);
+        return current(isolate).template get<V8T>(object, isolate);
     }
 
     template<typename V8T, typename T>
@@ -111,7 +111,7 @@
                 unsafePersistent.setReferenceFrom(parent, isolate);
             }
         }
-        current(isolate)->template setReference<V8T>(parent, child, isolate);
+        current(isolate).template setReference<V8T>(parent, child, isolate);
     }
 
     template<typename V8T, typename T>
@@ -123,13 +123,13 @@
                 return;
             }
         }
-        return current(isolate)->template set<V8T>(object, wrapper, isolate, configuration);
+        return current(isolate).template set<V8T>(object, wrapper, isolate, configuration);
     }
 
     template<typename V8T, typename T>
     static bool containsWrapper(T* object, v8::Isolate* isolate)
     {
-        return current(isolate)->template containsWrapper<V8T>(object);
+        return current(isolate).template containsWrapper<V8T>(object);
     }
 
     template<typename V8T, typename T>
@@ -179,7 +179,7 @@
         m_wrapperMap.set(V8T::toInternalPointer(object), wrapper, configuration);
     }
 
-    static DOMDataStore* mainWorldStore();
+    static DOMDataStore& mainWorldStore();
 
     static bool canExistInWorker(void*) { return true; }
     static bool canExistInWorker(Node*) { return false; }
@@ -193,7 +193,7 @@
     {
         // Verify our assumptions about the main world.
         UnsafePersistent<v8::Object> unsafePersistent = wrappable->unsafePersistent();
-        ASSERT(unsafePersistent.isEmpty() || !(holder == *unsafePersistent.persistent()) || current(v8::Isolate::GetCurrent())->m_type == MainWorld);
+        ASSERT(unsafePersistent.isEmpty() || !(holder == *unsafePersistent.persistent()) || current(v8::Isolate::GetCurrent()).m_type == MainWorld);
         return holder == *unsafePersistent.persistent();
     }
 
diff --git a/Source/bindings/v8/DOMWrapperMap.h b/Source/bindings/v8/DOMWrapperMap.h
index 4694500..73cfd78 100644
--- a/Source/bindings/v8/DOMWrapperMap.h
+++ b/Source/bindings/v8/DOMWrapperMap.h
@@ -111,7 +111,7 @@
     void removeAndDispose(KeyType* key)
     {
         typename MapType::iterator it = m_map.find(key);
-        ASSERT(it != m_map.end());
+        ASSERT_WITH_SECURITY_IMPLICATION(it != m_map.end());
         it->value.dispose();
         m_map.remove(it);
     }
diff --git a/Source/bindings/v8/DOMWrapperWorld.cpp b/Source/bindings/v8/DOMWrapperWorld.cpp
index 4ae3611..c932447 100644
--- a/Source/bindings/v8/DOMWrapperWorld.cpp
+++ b/Source/bindings/v8/DOMWrapperWorld.cpp
@@ -46,7 +46,7 @@
 
 namespace WebCore {
 
-int DOMWrapperWorld::isolatedWorldCount = 0;
+unsigned DOMWrapperWorld::isolatedWorldCount = 0;
 static bool initializingWindow = false;
 
 void DOMWrapperWorld::setInitializingWindow(bool initializing)
@@ -82,15 +82,15 @@
 DOMWrapperWorld* mainThreadNormalWorld()
 {
     ASSERT(isMainThread());
-    DEFINE_STATIC_LOCAL(RefPtr<DOMWrapperWorld>, cachedNormalWorld, (DOMWrapperWorld::createMainWorld()));
-    return cachedNormalWorld.get();
+    DEFINE_STATIC_REF(DOMWrapperWorld, cachedNormalWorld, (DOMWrapperWorld::createMainWorld()));
+    return cachedNormalWorld;
 }
 
 // FIXME: Remove this function. There is currently an issue with the inspector related to the call to dispatchDidClearWindowObjectInWorld in ScriptController::windowShell.
 DOMWrapperWorld* existingWindowShellWorkaroundWorld()
 {
-    DEFINE_STATIC_LOCAL(RefPtr<DOMWrapperWorld>, world, (adoptRef(new DOMWrapperWorld(MainWorldId - 1, DOMWrapperWorld::mainWorldExtensionGroup - 1))));
-    return world.get();
+    DEFINE_STATIC_REF(DOMWrapperWorld, world, (adoptRef(new DOMWrapperWorld(MainWorldId - 1, DOMWrapperWorld::mainWorldExtensionGroup - 1))));
+    return world;
 }
 
 bool DOMWrapperWorld::contextHasCorrectPrototype(v8::Handle<v8::Context> context)
diff --git a/Source/bindings/v8/DOMWrapperWorld.h b/Source/bindings/v8/DOMWrapperWorld.h
index d9560d2..8bc1cb6 100644
--- a/Source/bindings/v8/DOMWrapperWorld.h
+++ b/Source/bindings/v8/DOMWrapperWorld.h
@@ -33,7 +33,7 @@
 
 #include "bindings/v8/V8DOMActivityLogger.h"
 #include "bindings/v8/V8PerContextData.h"
-#include "weborigin/SecurityOrigin.h"
+#include "platform/weborigin/SecurityOrigin.h"
 #include <v8.h>
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
@@ -103,17 +103,17 @@
 
     int worldId() const { return m_worldId; }
     int extensionGroup() const { return m_extensionGroup; }
-    DOMDataStore* isolatedWorldDOMDataStore() const
+    DOMDataStore& isolatedWorldDOMDataStore() const
     {
         ASSERT(isIsolatedWorld());
-        return m_domDataStore.get();
+        return *m_domDataStore;
     }
     v8::Handle<v8::Context> context(ScriptController&);
 
     static void setInitializingWindow(bool);
 
 private:
-    static int isolatedWorldCount;
+    static unsigned isolatedWorldCount;
     static PassRefPtr<DOMWrapperWorld> createMainWorld();
     static bool contextHasCorrectPrototype(v8::Handle<v8::Context>);
 
diff --git a/Source/bindings/v8/DebuggerScript.js b/Source/bindings/v8/DebuggerScript.js
index e8da7a1..2f92b48 100644
--- a/Source/bindings/v8/DebuggerScript.js
+++ b/Source/bindings/v8/DebuggerScript.js
@@ -338,6 +338,9 @@
     // Get this object.
     var thisObject = frameMirror.details_.receiver();
 
+    var isAtReturn = !!frameMirror.details_.isAtReturn();
+    var returnValue = isAtReturn ? frameMirror.details_.returnValue() : undefined;
+
     var scopeChain = [];
     var scopeType = [];
     for (var i = 0; i < frameMirror.scopeCount(); i++) {
@@ -396,6 +399,8 @@
         "restart": restart,
         "setVariableValue": setVariableValue,
         "stepInPositions": stepInPositions,
+        "isAtReturn": isAtReturn,
+        "returnValue": returnValue,
         "frameMirror": frameMirror
     };
 }
diff --git a/Source/bindings/v8/Dictionary.cpp b/Source/bindings/v8/Dictionary.cpp
index dc14888..9b1050c 100644
--- a/Source/bindings/v8/Dictionary.cpp
+++ b/Source/bindings/v8/Dictionary.cpp
@@ -61,7 +61,7 @@
 {
 }
 
-Dictionary::Dictionary(const v8::Local<v8::Value>& options, v8::Isolate* isolate)
+Dictionary::Dictionary(const v8::Handle<v8::Value>& options, v8::Isolate* isolate)
     : m_options(options)
     , m_isolate(isolate)
 {
@@ -274,7 +274,7 @@
         return false;
 
     value = 0;
-    if (V8Storage::HasInstance(v8Value, m_isolate, worldType(m_isolate)))
+    if (V8Storage::hasInstance(v8Value, m_isolate, worldType(m_isolate)))
         value = V8Storage::toNative(v8::Handle<v8::Object>::Cast(v8Value));
     return true;
 }
@@ -335,7 +335,7 @@
         return false;
 
     value = 0;
-    if (V8Uint8Array::HasInstance(v8Value, m_isolate, worldType(m_isolate)))
+    if (V8Uint8Array::hasInstance(v8Value, m_isolate, worldType(m_isolate)))
         value = V8Uint8Array::toNative(v8::Handle<v8::Object>::Cast(v8Value));
     return true;
 }
@@ -347,7 +347,7 @@
         return false;
 
     value = 0;
-    if (V8ArrayBufferView::HasInstance(v8Value, m_isolate, worldType(m_isolate)))
+    if (V8ArrayBufferView::hasInstance(v8Value, m_isolate, worldType(m_isolate)))
         value = V8ArrayBufferView::toNative(v8::Handle<v8::Object>::Cast(v8Value));
     return true;
 }
@@ -359,7 +359,7 @@
         return false;
 
     value = 0;
-    if (V8MIDIPort::HasInstance(v8Value, m_isolate, worldType(m_isolate)))
+    if (V8MIDIPort::hasInstance(v8Value, m_isolate, worldType(m_isolate)))
         value = V8MIDIPort::toNative(v8::Handle<v8::Object>::Cast(v8Value));
     return true;
 }
@@ -371,7 +371,7 @@
         return false;
 
     value = 0;
-    if (V8MediaKeyError::HasInstance(v8Value, m_isolate, worldType(m_isolate)))
+    if (V8MediaKeyError::hasInstance(v8Value, m_isolate, worldType(m_isolate)))
         value = V8MediaKeyError::toNative(v8::Handle<v8::Object>::Cast(v8Value));
     return true;
 }
@@ -403,7 +403,7 @@
         return false;
 
     value = 0;
-    if (V8SpeechRecognitionError::HasInstance(v8Value, m_isolate, worldType(m_isolate)))
+    if (V8SpeechRecognitionError::hasInstance(v8Value, m_isolate, worldType(m_isolate)))
         value = V8SpeechRecognitionError::toNative(v8::Handle<v8::Object>::Cast(v8Value));
     return true;
 }
@@ -415,7 +415,7 @@
         return false;
 
     value = 0;
-    if (V8SpeechRecognitionResult::HasInstance(v8Value, m_isolate, worldType(m_isolate)))
+    if (V8SpeechRecognitionResult::hasInstance(v8Value, m_isolate, worldType(m_isolate)))
         value = V8SpeechRecognitionResult::toNative(v8::Handle<v8::Object>::Cast(v8Value));
     return true;
 }
@@ -427,7 +427,7 @@
         return false;
 
     value = 0;
-    if (V8SpeechRecognitionResultList::HasInstance(v8Value, m_isolate, worldType(m_isolate)))
+    if (V8SpeechRecognitionResultList::hasInstance(v8Value, m_isolate, worldType(m_isolate)))
         value = V8SpeechRecognitionResultList::toNative(v8::Handle<v8::Object>::Cast(v8Value));
     return true;
 }
@@ -439,7 +439,7 @@
         return false;
 
     value = 0;
-    if (V8MediaStream::HasInstance(v8Value, m_isolate, worldType(m_isolate)))
+    if (V8MediaStream::hasInstance(v8Value, m_isolate, worldType(m_isolate)))
         value = V8MediaStream::toNative(v8::Handle<v8::Object>::Cast(v8Value));
     return true;
 }
diff --git a/Source/bindings/v8/Dictionary.h b/Source/bindings/v8/Dictionary.h
index 27fea21..2d50a03 100644
--- a/Source/bindings/v8/Dictionary.h
+++ b/Source/bindings/v8/Dictionary.h
@@ -55,7 +55,7 @@
 class Dictionary {
 public:
     Dictionary();
-    Dictionary(const v8::Local<v8::Value>& options, v8::Isolate*);
+    Dictionary(const v8::Handle<v8::Value>& options, v8::Isolate*);
     ~Dictionary();
 
     Dictionary& operator=(const Dictionary&);
@@ -100,15 +100,16 @@
 
     bool getWithUndefinedOrNullCheck(const String&, String&) const;
 
+    // Only allow inline allocation.
+    void* operator new(size_t, NotNullTag, void* location) { return location; }
+
 private:
+    // Disallow new allocation.
+    void* operator new(size_t);
+
     bool getKey(const String& key, v8::Local<v8::Value>&) const;
 
-    // This object can only be used safely when stack allocated because of v8::Local.
-    static void* operator new(size_t);
-    static void* operator new[](size_t);
-    static void operator delete(void *);
-
-    v8::Local<v8::Value> m_options;
+    v8::Handle<v8::Value> m_options;
     v8::Isolate* m_isolate;
 };
 
diff --git a/Source/bindings/v8/ExceptionMessages.cpp b/Source/bindings/v8/ExceptionMessages.cpp
index 0969fb7..8108578 100644
--- a/Source/bindings/v8/ExceptionMessages.cpp
+++ b/Source/bindings/v8/ExceptionMessages.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "bindings/v8/ExceptionMessages.h"
 
+#include "wtf/MathExtras.h"
+
 namespace WebCore {
 
 String ExceptionMessages::failedToConstruct(const String& type, const String& detail)
@@ -78,6 +80,12 @@
     return String::number(expected) + " argument" + (expected > 1 ? "s" : "") + " required, but only " + String::number(provided) + " present.";
 }
 
+String ExceptionMessages::notAFiniteNumber(double value)
+{
+    ASSERT(!std::isfinite(value));
+    return std::isinf(value) ? "The value provided is infinite." : "The value provided is not a number.";
+}
+
 String ExceptionMessages::ordinalNumber(int number)
 {
     String suffix("th");
diff --git a/Source/bindings/v8/ExceptionMessages.h b/Source/bindings/v8/ExceptionMessages.h
index 5c4b0bd..dd41c63 100644
--- a/Source/bindings/v8/ExceptionMessages.h
+++ b/Source/bindings/v8/ExceptionMessages.h
@@ -47,6 +47,7 @@
     // If == 0, a (non-argument) value (e.g., a setter) failed the same check.
     static String notAnArrayTypeArgumentOrValue(int argumentIndex);
     static String notASequenceTypeProperty(const String& propertyName);
+    static String notAFiniteNumber(double value);
 
     static String notEnoughArguments(unsigned expected, unsigned providedleastNumMandatoryParams);
 
diff --git a/Source/bindings/v8/ExceptionState.cpp b/Source/bindings/v8/ExceptionState.cpp
index ae086ac..6d666b3 100644
--- a/Source/bindings/v8/ExceptionState.cpp
+++ b/Source/bindings/v8/ExceptionState.cpp
@@ -51,14 +51,14 @@
     ASSERT(ec != SecurityError);
 
     m_code = ec;
-    setException(V8ThrowException::createDOMException(ec, message, m_isolate));
+    setException(V8ThrowException::createDOMException(ec, message, m_creationContext, m_isolate));
 }
 
 void ExceptionState::throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage)
 {
     ASSERT(m_isolate);
     m_code = SecurityError;
-    setException(V8ThrowException::createDOMException(SecurityError, sanitizedMessage, unsanitizedMessage, m_isolate));
+    setException(V8ThrowException::createDOMException(SecurityError, sanitizedMessage, unsanitizedMessage, m_creationContext, m_isolate));
 }
 
 void ExceptionState::setException(v8::Handle<v8::Value> exception)
diff --git a/Source/bindings/v8/ExceptionState.h b/Source/bindings/v8/ExceptionState.h
index d83b77d..576d370 100644
--- a/Source/bindings/v8/ExceptionState.h
+++ b/Source/bindings/v8/ExceptionState.h
@@ -44,11 +44,12 @@
 class ExceptionState {
     WTF_MAKE_NONCOPYABLE(ExceptionState);
 public:
-    explicit ExceptionState(v8::Isolate* isolate)
+    explicit ExceptionState(const v8::Handle<v8::Object>& creationContext, v8::Isolate* isolate)
         : m_code(0)
+        , m_creationContext(creationContext)
         , m_isolate(isolate) { }
 
-    virtual void throwDOMException(const ExceptionCode&,  const String& message);
+    virtual void throwDOMException(const ExceptionCode&, const String& message);
     virtual void throwTypeError(const String& message);
     virtual void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage = String());
 
@@ -80,12 +81,13 @@
     void setException(v8::Handle<v8::Value>);
 
     ScopedPersistent<v8::Value> m_exception;
+    v8::Handle<v8::Object> m_creationContext;
     v8::Isolate* m_isolate;
 };
 
 class TrackExceptionState : public ExceptionState {
 public:
-    TrackExceptionState(): ExceptionState(0) { }
+    TrackExceptionState(): ExceptionState(v8::Handle<v8::Object>(), 0) { }
     virtual void throwDOMException(const ExceptionCode&, const String& message) OVERRIDE FINAL;
     virtual void throwTypeError(const String& message = String()) OVERRIDE FINAL;
     virtual void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage = String()) OVERRIDE FINAL;
diff --git a/Source/bindings/v8/ExceptionStatePlaceholder.cpp b/Source/bindings/v8/ExceptionStatePlaceholder.cpp
index c1b56fd..9d33119 100644
--- a/Source/bindings/v8/ExceptionStatePlaceholder.cpp
+++ b/Source/bindings/v8/ExceptionStatePlaceholder.cpp
@@ -36,7 +36,7 @@
 #if !ASSERT_DISABLED
 
 NoExceptionStateAssertionChecker::NoExceptionStateAssertionChecker(const char* file, int line)
-    : ExceptionState(0)
+    : ExceptionState(v8::Handle<v8::Object>(), 0)
     , m_file(file)
     , m_line(line) { }
 
diff --git a/Source/bindings/v8/ExceptionStatePlaceholder.h b/Source/bindings/v8/ExceptionStatePlaceholder.h
index b69a6c5..84f6eb0 100644
--- a/Source/bindings/v8/ExceptionStatePlaceholder.h
+++ b/Source/bindings/v8/ExceptionStatePlaceholder.h
@@ -43,7 +43,7 @@
 
 class IgnorableExceptionState : public ExceptionState {
 public:
-    IgnorableExceptionState(): ExceptionState(0) { }
+    IgnorableExceptionState(): ExceptionState(v8::Handle<v8::Object>(), 0) { }
     ExceptionState& returnThis() { return *this; }
     virtual void throwDOMException(const ExceptionCode&, const String& message = String()) OVERRIDE FINAL { };
     virtual void throwTypeError(const String& message = String()) OVERRIDE FINAL { }
diff --git a/Source/bindings/v8/IDBBindingUtilities.cpp b/Source/bindings/v8/IDBBindingUtilities.cpp
index 0dd4195..3881e1a 100644
--- a/Source/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/bindings/v8/IDBBindingUtilities.cpp
@@ -30,17 +30,21 @@
 #include "bindings/v8/DOMRequestState.h"
 #include "bindings/v8/SerializedScriptValue.h"
 #include "bindings/v8/V8Binding.h"
+#include "bindings/v8/custom/V8ArrayBufferViewCustom.h"
+#include "bindings/v8/custom/V8Uint8ArrayCustom.h"
 #include "platform/SharedBuffer.h"
 #include "modules/indexeddb/IDBKey.h"
 #include "modules/indexeddb/IDBKeyPath.h"
 #include "modules/indexeddb/IDBKeyRange.h"
 #include "modules/indexeddb/IDBTracing.h"
+#include "wtf/ArrayBufferView.h"
 #include "wtf/MathExtras.h"
+#include "wtf/Uint8Array.h"
 #include "wtf/Vector.h"
 
 namespace WebCore {
 
-static v8::Handle<v8::Value> idbKeyToV8Value(IDBKey* key, v8::Isolate* isolate)
+static v8::Handle<v8::Value> idbKeyToV8Value(IDBKey* key, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
     if (!key) {
         // This should be undefined, not null.
@@ -57,13 +61,15 @@
         return v8::Number::New(isolate, key->number());
     case IDBKey::StringType:
         return v8String(key->string(), isolate);
+    case IDBKey::BinaryType:
+        return toV8(Uint8Array::create(reinterpret_cast<const unsigned char*>(key->binary()->data()), key->binary()->size()), creationContext, isolate);
     case IDBKey::DateType:
         return v8::Date::New(key->date());
     case IDBKey::ArrayType:
         {
             v8::Local<v8::Array> array = v8::Array::New(key->array().size());
             for (size_t i = 0; i < key->array().size(); ++i)
-                array->Set(i, idbKeyToV8Value(key->array()[i].get(), isolate));
+                array->Set(i, idbKeyToV8Value(key->array()[i].get(), creationContext, isolate));
             return array;
         }
     }
@@ -226,7 +232,6 @@
     ASSERT(!keyPath.isNull());
     ASSERT(v8::Context::InContext());
 
-
     v8::Isolate* isolate = state ? state->context()->GetIsolate() : v8::Isolate::GetCurrent();
     v8::HandleScope handleScope(isolate);
     if (keyPath.type() == IDBKeyPath::ArrayType) {
@@ -287,13 +292,15 @@
         return 0;
 
     v8::Isolate* isolate = state ? state->context()->GetIsolate() : v8::Isolate::GetCurrent();
+    v8::Local<v8::Context> context = state ? state->context() : isolate->GetCurrentContext();
+
     v8::HandleScope handleScope(isolate);
     v8::Handle<v8::Value> v8Value(value.v8Value());
     v8::Handle<v8::Value> parent(ensureNthValueOnKeyPath(v8Value, keyPathElements, keyPathElements.size() - 1, isolate));
     if (parent.IsEmpty())
         return false;
 
-    if (!set(parent, keyPathElements.last(), idbKeyToV8Value(key.get(), isolate), isolate))
+    if (!set(parent, keyPathElements.last(), idbKeyToV8Value(key.get(), context->Global(), isolate), isolate))
         return false;
 
     return true;
@@ -319,8 +326,9 @@
 {
     ASSERT(v8::Context::InContext());
     v8::Isolate* isolate = state ? state->context()->GetIsolate() : v8::Isolate::GetCurrent();
+    v8::Local<v8::Context> context = state ? state->context() : isolate->GetCurrentContext();
     v8::HandleScope handleScope(isolate);
-    v8::Handle<v8::Value> v8Value(idbKeyToV8Value(key.get(), state->context()->GetIsolate()));
+    v8::Handle<v8::Value> v8Value(idbKeyToV8Value(key.get(), context->Global(), isolate));
     return ScriptValue(v8Value, isolate);
 }
 
@@ -338,7 +346,7 @@
     v8::Isolate* isolate = state ? state->context()->GetIsolate() : v8::Isolate::GetCurrent();
     v8::HandleScope handleScope(isolate);
     v8::Handle<v8::Value> value(scriptValue.v8Value());
-    if (V8IDBKeyRange::HasInstance(value, isolate, worldType(isolate)))
+    if (V8IDBKeyRange::hasInstance(value, isolate, worldType(isolate)))
         return V8IDBKeyRange::toNative(value.As<v8::Object>());
     return 0;
 }
diff --git a/Source/bindings/v8/NPV8Object.cpp b/Source/bindings/v8/NPV8Object.cpp
index de061e5..778530d 100644
--- a/Source/bindings/v8/NPV8Object.cpp
+++ b/Source/bindings/v8/NPV8Object.cpp
@@ -53,7 +53,7 @@
 
 const WrapperTypeInfo* npObjectTypeInfo()
 {
-    static const WrapperTypeInfo typeInfo = { 0, 0, 0, 0, 0, 0, 0, WrapperTypeObjectPrototype };
+    static const WrapperTypeInfo typeInfo = { gin::kEmbedderBlink, 0, 0, 0, 0, 0, 0, 0, WrapperTypeObjectPrototype };
     return &typeInfo;
 }
 
diff --git a/Source/bindings/v8/PageScriptDebugServer.cpp b/Source/bindings/v8/PageScriptDebugServer.cpp
index ed4d522..48b879b 100644
--- a/Source/bindings/v8/PageScriptDebugServer.cpp
+++ b/Source/bindings/v8/PageScriptDebugServer.cpp
@@ -102,7 +102,7 @@
     if (!m_listenersMap.size()) {
         ensureDebuggerScriptCompiled();
         ASSERT(!debuggerScript->IsUndefined());
-        v8::Debug::SetDebugEventListener2(&PageScriptDebugServer::v8DebugEventCallback, v8::External::New(this));
+        v8::Debug::SetDebugEventListener2(&PageScriptDebugServer::v8DebugEventCallback, v8::External::New(m_isolate, this));
     }
     m_listenersMap.set(page, listener);
 
diff --git a/Source/bindings/v8/RetainedDOMInfo.cpp b/Source/bindings/v8/RetainedDOMInfo.cpp
index 15a83f2..deea731 100644
--- a/Source/bindings/v8/RetainedDOMInfo.cpp
+++ b/Source/bindings/v8/RetainedDOMInfo.cpp
@@ -81,7 +81,7 @@
     intptr_t count = 1;
     Node* current = m_root;
     while (current) {
-        current = NodeTraversal::next(current, m_root);
+        current = NodeTraversal::next(*current, m_root);
         ++count;
     }
     return count;
diff --git a/Source/bindings/v8/ScriptController.cpp b/Source/bindings/v8/ScriptController.cpp
index 622d59a..fa37c6c 100644
--- a/Source/bindings/v8/ScriptController.cpp
+++ b/Source/bindings/v8/ScriptController.cpp
@@ -71,8 +71,8 @@
 #include "platform/TraceEvent.h"
 #include "platform/UserGestureIndicator.h"
 #include "platform/Widget.h"
+#include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
-#include "weborigin/SecurityOrigin.h"
 #include "wtf/CurrentTime.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/StringExtras.h"
@@ -138,7 +138,7 @@
 {
     double start = currentTime();
     clearForClose(false);
-    WebKit::Platform::current()->histogramCustomCounts("WebCore.ScriptController.clearForClose", (currentTime() - start) * 1000, 0, 10000, 50);
+    blink::Platform::current()->histogramCustomCounts("WebCore.ScriptController.clearForClose", (currentTime() - start) * 1000, 0, 10000, 50);
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -153,16 +153,18 @@
     return ScriptController::callFunction(m_frame->document(), function, receiver, argc, info, m_isolate);
 }
 
-static void resourceInfo(const v8::Handle<v8::Function> function, String& resourceName, int& lineNumber)
+static bool resourceInfo(const v8::Handle<v8::Function> function, String& resourceName, int& lineNumber)
 {
     v8::ScriptOrigin origin = function->GetScriptOrigin();
     if (origin.ResourceName().IsEmpty()) {
         resourceName = "undefined";
         lineNumber = 1;
     } else {
-        resourceName = toWebCoreString(origin.ResourceName());
+        V8TRYCATCH_FOR_V8STRINGRESOURCE_RETURN(V8StringResource<>, stringResourceName, origin.ResourceName(), false);
+        resourceName = stringResourceName;
         lineNumber = function->GetScriptLineNumber() + 1;
     }
+    return true;
 }
 
 v8::Local<v8::Value> ScriptController::callFunction(ExecutionContext* context, v8::Handle<v8::Function> function, v8::Handle<v8::Object> receiver, int argc, v8::Handle<v8::Value> info[], v8::Isolate* isolate)
@@ -171,7 +173,8 @@
     if (InspectorInstrumentation::timelineAgentEnabled(context)) {
         String resourceName;
         int lineNumber;
-        resourceInfo(function, resourceName, lineNumber);
+        if (!resourceInfo(function, resourceName, lineNumber))
+            return v8::Local<v8::Value>();
         cookie = InspectorInstrumentation::willCallFunction(context, resourceName, lineNumber);
     }
 
@@ -491,7 +494,7 @@
     for (IsolatedWorldMap::iterator iter = m_isolatedWorlds.begin(); iter != m_isolatedWorlds.end(); ++iter)
         iter->value->clearForNavigation();
     V8GCController::hintForCollectGarbage();
-    WebKit::Platform::current()->histogramCustomCounts("WebCore.ScriptController.clearWindowShell", (currentTime() - start) * 1000, 0, 10000, 50);
+    blink::Platform::current()->histogramCustomCounts("WebCore.ScriptController.clearWindowShell", (currentTime() - start) * 1000, 0, 10000, 50);
 }
 
 void ScriptController::setCaptureCallStackForUncaughtExceptions(bool value)
diff --git a/Source/bindings/v8/ScriptController.h b/Source/bindings/v8/ScriptController.h
index 1af43de..83793c7 100644
--- a/Source/bindings/v8/ScriptController.h
+++ b/Source/bindings/v8/ScriptController.h
@@ -47,6 +47,7 @@
 namespace WebCore {
 
 class DOMWrapperWorld;
+class ExecutionContext;
 class Event;
 class Frame;
 class HTMLDocument;
diff --git a/Source/bindings/v8/ScriptDebugServer.cpp b/Source/bindings/v8/ScriptDebugServer.cpp
index 39ace0f..c20f1de 100644
--- a/Source/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/bindings/v8/ScriptDebugServer.cpp
@@ -179,11 +179,6 @@
 {
     if (!m_breakpointsActivated)
         return false;
-
-    // FIXME: Remove this check once m_isolate->GetCurrentContext() does not crash.
-    if (!v8::Context::InContext())
-        return false;
-
     v8::HandleScope scope(m_isolate);
     return !m_isolate->GetCurrentContext().IsEmpty();
 }
@@ -196,7 +191,7 @@
     v8::HandleScope scope(m_isolate);
     if (m_breakProgramCallbackTemplate.isEmpty()) {
         v8::Handle<v8::FunctionTemplate> templ = v8::FunctionTemplate::New();
-        templ->SetCallHandler(&ScriptDebugServer::breakProgramCallback, v8::External::New(this));
+        templ->SetCallHandler(&ScriptDebugServer::breakProgramCallback, v8::External::New(m_isolate, this));
         m_breakProgramCallbackTemplate.set(m_isolate, templ);
     }
 
@@ -465,9 +460,8 @@
             if (!stackTrace->GetFrameCount())
                 return;
             RefPtr<JavaScriptCallFrame> topFrame = wrapCallFrames(eventDetails.GetExecutionState(), 1);
-            if (topFrame && executeSkipPauseRequest(listener->shouldSkipExceptionPause(topFrame), eventDetails.GetExecutionState())) {
+            if (executeSkipPauseRequest(listener->shouldSkipExceptionPause(topFrame), eventDetails.GetExecutionState()))
                 return;
-            }
             v8::Handle<v8::Object> eventData = eventDetails.GetEventData();
             v8::Handle<v8::Value> exceptionGetterValue = eventData->Get(v8::String::NewSymbol("exception"));
             ASSERT(!exceptionGetterValue.IsEmpty() && exceptionGetterValue->IsFunction());
@@ -478,18 +472,14 @@
             v8::Handle<v8::Value> argv[] = { eventDetails.GetEventData() };
             v8::Handle<v8::Value> hitBreakpoints = V8ScriptRunner::callInternalFunction(getBreakpointNumbersFunction, debuggerScript, WTF_ARRAY_LENGTH(argv), argv, m_isolate);
             ASSERT(hitBreakpoints->IsArray());
-
             RefPtr<JavaScriptCallFrame> topFrame = wrapCallFrames(eventDetails.GetExecutionState(), 1);
-            if (topFrame) {
-                ScriptDebugListener::SkipPauseRequest skipRequest;
-                if (v8::Handle<v8::Array>::Cast(hitBreakpoints)->Length())
-                    skipRequest = listener->shouldSkipBreakpointPause(topFrame);
-                else
-                    skipRequest = listener->shouldSkipStepPause(topFrame);
-                if (executeSkipPauseRequest(skipRequest, eventDetails.GetExecutionState()))
-                    return;
-            }
-
+            ScriptDebugListener::SkipPauseRequest skipRequest;
+            if (v8::Handle<v8::Array>::Cast(hitBreakpoints)->Length())
+                skipRequest = listener->shouldSkipBreakpointPause(topFrame);
+            else
+                skipRequest = listener->shouldSkipStepPause(topFrame);
+            if (executeSkipPauseRequest(skipRequest, eventDetails.GetExecutionState()))
+                return;
             handleProgramBreak(eventDetails, v8::Handle<v8::Value>(), hitBreakpoints.As<v8::Array>());
         }
     }
diff --git a/Source/bindings/v8/ScriptEventListener.cpp b/Source/bindings/v8/ScriptEventListener.cpp
index 3283ed3..2575165 100644
--- a/Source/bindings/v8/ScriptEventListener.cpp
+++ b/Source/bindings/v8/ScriptEventListener.cpp
@@ -33,6 +33,7 @@
 
 #include "bindings/v8/ScriptController.h"
 #include "bindings/v8/ScriptScope.h"
+#include "bindings/v8/ScriptState.h"
 #include "bindings/v8/V8AbstractEventListener.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8WindowShell.h"
diff --git a/Source/bindings/v8/ScriptProfiler.cpp b/Source/bindings/v8/ScriptProfiler.cpp
index a517993..fc497d8 100644
--- a/Source/bindings/v8/ScriptProfiler.cpp
+++ b/Source/bindings/v8/ScriptProfiler.cpp
@@ -292,7 +292,7 @@
             // Casting to Handle is safe here, since the Persistent cannot get
             // GCd during visiting.
             v8::Handle<v8::Object>* wrapper = reinterpret_cast<v8::Handle<v8::Object>*>(value);
-            ASSERT_UNUSED(m_isolate, V8Node::HasInstanceInAnyWorld(*wrapper, m_isolate));
+            ASSERT_UNUSED(m_isolate, V8Node::hasInstanceInAnyWorld(*wrapper, m_isolate));
             ASSERT((*wrapper)->IsObject());
             m_visitor->visitNode(V8Node::toNative(*wrapper));
         }
diff --git a/Source/bindings/v8/ScriptPromise.cpp b/Source/bindings/v8/ScriptPromise.cpp
index 4b53245..a618761 100644
--- a/Source/bindings/v8/ScriptPromise.cpp
+++ b/Source/bindings/v8/ScriptPromise.cpp
@@ -44,7 +44,9 @@
     ASSERT(v8::Context::InContext());
     ASSERT(context);
     v8::Isolate* isolate = toIsolate(context);
-    v8::Handle<v8::Object> promise = V8PromiseCustom::createPromise(toV8Context(context, DOMWrapperWorld::current())->Global(), isolate);
+    v8::Handle<v8::Context> v8Context = toV8Context(context, DOMWrapperWorld::current());
+    v8::Handle<v8::Object> creationContext = v8Context.IsEmpty() ? v8::Object::New() : v8Context->Global();
+    v8::Handle<v8::Object> promise = V8PromiseCustom::createPromise(creationContext, isolate);
     return ScriptPromise(promise, isolate);
 }
 
diff --git a/Source/bindings/v8/ScriptPromiseResolver.h b/Source/bindings/v8/ScriptPromiseResolver.h
index 65511db..25bc1aa 100644
--- a/Source/bindings/v8/ScriptPromiseResolver.h
+++ b/Source/bindings/v8/ScriptPromiseResolver.h
@@ -31,11 +31,13 @@
 #ifndef ScriptPromiseResolver_h
 #define ScriptPromiseResolver_h
 
+#include "bindings/v8/DOMWrapperWorld.h"
 #include "bindings/v8/ScopedPersistent.h"
 #include "bindings/v8/ScriptObject.h"
 #include "bindings/v8/ScriptPromise.h"
 #include "bindings/v8/ScriptState.h"
 #include "bindings/v8/ScriptValue.h"
+#include "bindings/v8/V8Binding.h"
 #include "wtf/RefPtr.h"
 
 #include <v8.h>
@@ -83,12 +85,38 @@
         return m_promise;
     }
 
-    // Resolve with a C++ object which can be converted to a v8 object by toV8.
+    // To use following template methods, T must be a DOM class.
+
+    // This method will be implemented by the code generator.
     template<typename T>
-    inline void resolve(PassRefPtr<T>);
-    // Reject with a C++ object which can be converted to a v8 object by toV8.
+    void resolve(T* value, v8::Handle<v8::Object> creationContext) { resolve(toV8NoInline(value, creationContext, m_isolate)); }
     template<typename T>
-    inline void reject(PassRefPtr<T>);
+    void reject(T* value, v8::Handle<v8::Object> creationContext) { reject(toV8NoInline(value, creationContext, m_isolate)); }
+
+    template<typename T>
+    void resolve(PassRefPtr<T> value, v8::Handle<v8::Object> creationContext) { resolve(value.get(), creationContext); }
+    template<typename T>
+    void reject(PassRefPtr<T> value, v8::Handle<v8::Object> creationContext) { reject(value.get(), creationContext); }
+
+    template<typename T>
+    inline void resolve(T* value, ExecutionContext*);
+    template<typename T>
+    inline void reject(T* value, ExecutionContext*);
+
+    template<typename T>
+    void resolve(PassRefPtr<T> value, ExecutionContext* context) { resolve(value.get(), context); }
+    template<typename T>
+    void reject(PassRefPtr<T> value, ExecutionContext* context) { reject(value.get(), context); }
+
+    template<typename T>
+    inline void resolve(T* value);
+    template<typename T>
+    inline void reject(T* value);
+
+    template<typename T>
+    void resolve(PassRefPtr<T> value) { resolve(value.get()); }
+    template<typename T>
+    void reject(PassRefPtr<T> value) { reject(value.get()); }
 
     void resolve(ScriptValue);
     void reject(ScriptValue);
@@ -103,17 +131,33 @@
 };
 
 template<typename T>
-void ScriptPromiseResolver::resolve(PassRefPtr<T> value)
+void ScriptPromiseResolver::resolve(T* value, ExecutionContext* context)
 {
     ASSERT(v8::Context::InContext());
-    resolve(toV8(value.get(), v8::Object::New(), m_isolate));
+    v8::Handle<v8::Context> v8Context = toV8Context(context, DOMWrapperWorld::current());
+    resolve(value, v8Context->Global());
 }
 
 template<typename T>
-void ScriptPromiseResolver::reject(PassRefPtr<T> value)
+void ScriptPromiseResolver::reject(T* value, ExecutionContext* context)
 {
     ASSERT(v8::Context::InContext());
-    reject(toV8(value.get(), v8::Object::New(), m_isolate));
+    v8::Handle<v8::Context> v8Context = toV8Context(context, DOMWrapperWorld::current());
+    reject(value, v8Context->Global());
+}
+
+template<typename T>
+void ScriptPromiseResolver::resolve(T* value)
+{
+    ASSERT(v8::Context::InContext());
+    resolve(value, v8::Object::New());
+}
+
+template<typename T>
+void ScriptPromiseResolver::reject(T* value)
+{
+    ASSERT(v8::Context::InContext());
+    reject(value, v8::Object::New());
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/ScriptSourceCode.h b/Source/bindings/v8/ScriptSourceCode.h
index 5bacd8b..d5ddbcc 100644
--- a/Source/bindings/v8/ScriptSourceCode.h
+++ b/Source/bindings/v8/ScriptSourceCode.h
@@ -33,7 +33,7 @@
 
 #include "core/fetch/ResourcePtr.h"
 #include "core/fetch/ScriptResource.h"
-#include "weborigin/KURL.h"
+#include "platform/weborigin/KURL.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/text/TextPosition.h"
 #include "wtf/text/WTFString.h"
@@ -50,6 +50,8 @@
         , m_url(url)
         , m_startPosition(startPosition)
     {
+        if (!m_url.isEmpty())
+            m_url.removeFragmentIdentifier();
     }
 
     // We lose the encoding information from ScriptResource.
@@ -57,7 +59,6 @@
     ScriptSourceCode(ScriptResource* cs)
         : m_source(cs->script())
         , m_resource(cs)
-        , m_url(cs->url())
         , m_startPosition(TextPosition::minimumPosition())
     {
     }
@@ -68,8 +69,11 @@
     ScriptResource* resource() const { return m_resource.get(); }
     const KURL& url() const
     {
-        if (m_resource)
-            return m_resource->response().url();
+        if (m_url.isEmpty() && m_resource) {
+            m_url = m_resource->response().url();
+            if (!m_url.isEmpty())
+                m_url.removeFragmentIdentifier();
+        }
         return m_url;
     }
     int startLine() const { return m_startPosition.m_line.oneBasedInt(); }
@@ -78,7 +82,7 @@
 private:
     String m_source;
     ResourcePtr<ScriptResource> m_resource;
-    KURL m_url;
+    mutable KURL m_url;
     TextPosition m_startPosition;
 };
 
diff --git a/Source/bindings/v8/ScriptState.cpp b/Source/bindings/v8/ScriptState.cpp
index f7b3090..fa05ccc 100644
--- a/Source/bindings/v8/ScriptState.cpp
+++ b/Source/bindings/v8/ScriptState.cpp
@@ -77,7 +77,7 @@
         return static_cast<ScriptState*>(v8::External::Cast(*scriptStateWrapper)->Value());
 
     ScriptState* scriptState = new ScriptState(context);
-    innerGlobal->SetHiddenValue(V8HiddenPropertyName::scriptState(context->GetIsolate()), v8::External::New(scriptState));
+    innerGlobal->SetHiddenValue(V8HiddenPropertyName::scriptState(context->GetIsolate()), v8::External::New(context->GetIsolate(), scriptState));
     return scriptState;
 }
 
diff --git a/Source/bindings/v8/ScriptValue.cpp b/Source/bindings/v8/ScriptValue.cpp
index 4afe386..5b05c23 100644
--- a/Source/bindings/v8/ScriptValue.cpp
+++ b/Source/bindings/v8/ScriptValue.cpp
@@ -32,11 +32,9 @@
 #include "bindings/v8/ScriptValue.h"
 
 #include "bindings/v8/ScriptScope.h"
-#include "bindings/v8/SerializedScriptValue.h"
+#include "bindings/v8/ScriptState.h"
 #include "bindings/v8/V8Binding.h"
-#include "core/dom/MessagePort.h"
 #include "platform/JSONValues.h"
-#include "wtf/ArrayBuffer.h"
 
 namespace WebCore {
 
@@ -44,24 +42,6 @@
 {
 }
 
-PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState)
-{
-    ScriptScope scope(scriptState);
-    return SerializedScriptValue::create(v8Value(), scriptState->isolate());
-}
-
-PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState, MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers, bool& didThrow)
-{
-    ScriptScope scope(scriptState);
-    return SerializedScriptValue::create(v8Value(), messagePorts, arrayBuffers, didThrow, scriptState->isolate());
-}
-
-ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value)
-{
-    ScriptScope scope(scriptState);
-    return ScriptValue(value->deserialize(), scriptState->isolate());
-}
-
 bool ScriptValue::getString(String& result) const
 {
     if (hasNoValue())
diff --git a/Source/bindings/v8/ScriptValue.h b/Source/bindings/v8/ScriptValue.h
index b2a25d9..42b5fe7 100644
--- a/Source/bindings/v8/ScriptValue.h
+++ b/Source/bindings/v8/ScriptValue.h
@@ -31,29 +31,16 @@
 #ifndef ScriptValue_h
 #define ScriptValue_h
 
-#include "bindings/v8/ScriptState.h"
 #include "bindings/v8/SharedPersistent.h"
-#include <v8.h>
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefPtr.h"
-#include "wtf/Vector.h"
 #include "wtf/text/WTFString.h"
-
-#ifndef NDEBUG
-#include "bindings/v8/V8GCController.h"
-#endif
-
-namespace WTF {
-class ArrayBuffer;
-}
+#include <v8.h>
 
 namespace WebCore {
 
 class JSONValue;
-class MessagePort;
-class SerializedScriptValue;
-typedef Vector<RefPtr<MessagePort>, 1> MessagePortArray;
-typedef Vector<RefPtr<WTF::ArrayBuffer>, 1> ArrayBufferArray;
+class ScriptState;
 
 class ScriptValue {
 public:
@@ -82,6 +69,11 @@
         return m_isolate;
     }
 
+    static ScriptValue createUndefined(v8::Isolate* isolate)
+    {
+        return ScriptValue(v8::Undefined(isolate), isolate);
+    }
+
     static ScriptValue createNull()
     {
         v8::Isolate* isolate = v8::Isolate::GetCurrent();
@@ -162,10 +154,6 @@
         return !m_value.get() || m_value->isEmpty();
     }
 
-    PassRefPtr<SerializedScriptValue> serialize(ScriptState*);
-    PassRefPtr<SerializedScriptValue> serialize(ScriptState*, MessagePortArray*, ArrayBufferArray*, bool&);
-    static ScriptValue deserialize(ScriptState*, SerializedScriptValue*);
-
     void clear()
     {
         m_value = 0;
diff --git a/Source/bindings/v8/SerializedScriptValue.cpp b/Source/bindings/v8/SerializedScriptValue.cpp
index 984d5e7..bf7232f 100644
--- a/Source/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/bindings/v8/SerializedScriptValue.cpp
@@ -37,6 +37,8 @@
 #include "V8FileList.h"
 #include "V8ImageData.h"
 #include "V8MessagePort.h"
+#include "bindings/v8/ScriptScope.h"
+#include "bindings/v8/ScriptState.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8Utilities.h"
 #include "bindings/v8/custom/V8ArrayBufferCustom.h"
@@ -118,11 +120,6 @@
         m_map.set(*handle, value);
     }
 
-    uint32_t size()
-    {
-        return m_map.size();
-    }
-
 private:
     // This implementation uses GetIdentityHash(), which sets a hidden property on the object containing
     // a random integer (or returns the one that had been previously set). This ensures that the table
@@ -296,13 +293,6 @@
         append(value ? TrueObjectTag : FalseObjectTag);
     }
 
-    void writeString(const char* data, int length)
-    {
-        ASSERT(length >= 0);
-        append(StringTag);
-        doWriteString(data, length);
-    }
-
     void writeOneByteString(v8::Handle<v8::String>& string)
     {
         int stringLength = string->Length();
@@ -739,7 +729,15 @@
     }
 
     // Functions used by serialization states.
-    StateBase* doSerialize(v8::Handle<v8::Value> value, StateBase* next);
+    StateBase* doSerialize(v8::Handle<v8::Value>, StateBase* next);
+
+    // The serializer workhorse, no stack depth check.
+    StateBase* doSerializeImpl(v8::Handle<v8::Value>, StateBase* next);
+
+    StateBase* doSerializeArrayBuffer(v8::Handle<v8::Value> arrayBuffer, StateBase* next)
+    {
+        return doSerializeImpl(arrayBuffer, next);
+    }
 
     StateBase* checkException(StateBase* state)
     {
@@ -991,11 +989,6 @@
         }
     };
 
-    uint32_t execDepth() const
-    {
-        return m_execDepth;
-    }
-
     StateBase* push(StateBase* state)
     {
         ASSERT(state);
@@ -1139,16 +1132,18 @@
         v8::Handle<v8::Value> underlyingBuffer = toV8(arrayBufferView->buffer(), v8::Handle<v8::Object>(), m_writer.getIsolate());
         if (underlyingBuffer.IsEmpty())
             return handleError(DataCloneError, next);
-        StateBase* stateOut = doSerialize(underlyingBuffer, 0);
+        StateBase* stateOut = doSerializeArrayBuffer(underlyingBuffer, next);
         if (stateOut)
-            return handleError(DataCloneError, next);
+            return stateOut;
         m_writer.writeArrayBufferView(*arrayBufferView);
         // This should be safe: we serialize something that we know to be a wrapper (see
-        // the toV8 call above), so the call to doSerialize above should neither cause
-        // the stack to overflow nor should it have the potential to reach this
-        // ArrayBufferView again. We do need to grey the underlying buffer before we grey
-        // its view, however; ArrayBuffers may be shared, so they need to be given reference IDs,
-        // and an ArrayBufferView cannot be constructed without a corresponding ArrayBuffer
+        // the toV8 call above), so the call to doSerializeArrayBuffer should neither
+        // cause the system stack to overflow nor should it have potential to reach
+        // this ArrayBufferView again.
+        //
+        // We do need to grey the underlying buffer before we grey its view, however;
+        // ArrayBuffers may be shared, so they need to be given reference IDs, and an
+        // ArrayBufferView cannot be constructed without a corresponding ArrayBuffer
         // (or without an additional tag that would allow us to do two-stage construction
         // like we do for Objects and Arrays).
         greyObject(object);
@@ -1233,12 +1228,8 @@
     v8::Isolate* m_isolate;
 };
 
-Serializer::StateBase* Serializer::doSerialize(v8::Handle<v8::Value> value, StateBase* next)
+Serializer::StateBase* Serializer::doSerializeImpl(v8::Handle<v8::Value> value, StateBase* next)
 {
-    if (m_execDepth + (next ? next->execDepth() : 0) > 1) {
-        m_writer.writeNull();
-        return 0;
-    }
     m_writer.writeReferenceCount(m_nextObjectReference);
     uint32_t objectReference;
     uint32_t arrayBufferIndex;
@@ -1265,17 +1256,17 @@
         m_writer.writeUint32(value->Uint32Value());
     else if (value->IsNumber())
         m_writer.writeNumber(value.As<v8::Number>()->Value());
-    else if (V8ArrayBufferView::HasInstance(value, m_isolate, currentWorldType))
+    else if (V8ArrayBufferView::hasInstance(value, m_isolate, currentWorldType))
         return writeAndGreyArrayBufferView(value.As<v8::Object>(), next);
     else if (value->IsString())
         writeString(value);
-    else if (V8MessagePort::HasInstance(value, m_isolate, currentWorldType)) {
+    else if (V8MessagePort::hasInstance(value, m_isolate, currentWorldType)) {
         uint32_t messagePortIndex;
         if (m_transferredMessagePorts.tryGet(value.As<v8::Object>(), &messagePortIndex))
                 m_writer.writeTransferredMessagePort(messagePortIndex);
             else
                 return handleError(DataCloneError, next);
-    } else if (V8ArrayBuffer::HasInstance(value, m_isolate, currentWorldType) && m_transferredArrayBuffers.tryGet(value.As<v8::Object>(), &arrayBufferIndex))
+    } else if (V8ArrayBuffer::hasInstance(value, m_isolate, currentWorldType) && m_transferredArrayBuffers.tryGet(value.As<v8::Object>(), &arrayBufferIndex))
         return writeTransferredArrayBuffer(value, arrayBufferIndex, next);
     else {
         v8::Handle<v8::Object> jsObject = value.As<v8::Object>();
@@ -1292,19 +1283,19 @@
             writeBooleanObject(value);
         else if (value->IsArray()) {
             return startArrayState(value.As<v8::Array>(), next);
-        } else if (V8File::HasInstance(value, m_isolate, currentWorldType))
+        } else if (V8File::hasInstance(value, m_isolate, currentWorldType))
             writeFile(value);
-        else if (V8Blob::HasInstance(value, m_isolate, currentWorldType))
+        else if (V8Blob::hasInstance(value, m_isolate, currentWorldType))
             writeBlob(value);
-        else if (V8DOMFileSystem::HasInstance(value, m_isolate, currentWorldType))
+        else if (V8DOMFileSystem::hasInstance(value, m_isolate, currentWorldType))
             return writeDOMFileSystem(value, next);
-        else if (V8FileList::HasInstance(value, m_isolate, currentWorldType))
+        else if (V8FileList::hasInstance(value, m_isolate, currentWorldType))
             writeFileList(value);
-        else if (V8ImageData::HasInstance(value, m_isolate, currentWorldType))
+        else if (V8ImageData::hasInstance(value, m_isolate, currentWorldType))
             writeImageData(value);
         else if (value->IsRegExp())
             writeRegExp(value);
-        else if (V8ArrayBuffer::HasInstance(value, m_isolate, currentWorldType))
+        else if (V8ArrayBuffer::hasInstance(value, m_isolate, currentWorldType))
             return writeArrayBuffer(value, next);
         else if (value->IsObject()) {
             if (isHostObject(jsObject) || jsObject->IsCallable() || value->IsNativeError())
@@ -1316,6 +1307,15 @@
     return 0;
 }
 
+Serializer::StateBase* Serializer::doSerialize(v8::Handle<v8::Value> value, StateBase* next)
+{
+    if (m_execDepth + (next ? next->execDepth() : 0) > 1) {
+        m_writer.writeNull();
+        return 0;
+    }
+    return doSerializeImpl(value, next);
+}
+
 // Interface used by Reader to create objects of composite types.
 class CompositeCreator {
 public:
@@ -1743,7 +1743,7 @@
             return 0;
         const void* bufferStart = m_buffer + m_position;
         RefPtr<ArrayBuffer> arrayBuffer = ArrayBuffer::create(bufferStart, byteLength);
-        arrayBuffer->setDeallocationObserver(V8ArrayBufferDeallocationObserver::instance());
+        arrayBuffer->setDeallocationObserver(V8ArrayBufferDeallocationObserver::instanceTemplate());
         m_position += byteLength;
         return arrayBuffer.release();
     }
@@ -2157,7 +2157,7 @@
         v8::Handle<v8::Object> result = m_arrayBuffers.at(index);
         if (result.IsEmpty()) {
             RefPtr<ArrayBuffer> buffer = ArrayBuffer::create(m_arrayBufferContents->at(index));
-            buffer->setDeallocationObserver(V8ArrayBufferDeallocationObserver::instance());
+            buffer->setDeallocationObserver(V8ArrayBufferDeallocationObserver::instanceTemplate());
             v8::V8::AdjustAmountOfExternalAllocatedMemory(buffer->byteLength());
             result = toV8Object(buffer.get(), m_reader.getIsolate());
             m_arrayBuffers[index] = result;
@@ -2257,18 +2257,18 @@
     return adoptRef(new SerializedScriptValue(value, messagePorts, arrayBuffers, didThrow, isolate));
 }
 
-PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(v8::Handle<v8::Value> value, v8::Isolate* isolate)
-{
-    bool didThrow;
-    return adoptRef(new SerializedScriptValue(value, 0, 0, didThrow, isolate));
-}
-
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::createAndSwallowExceptions(v8::Handle<v8::Value> value, v8::Isolate* isolate)
 {
     bool didThrow;
     return adoptRef(new SerializedScriptValue(value, 0, 0, didThrow, isolate, DoNotThrowExceptions));
 }
 
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(const ScriptValue& value, bool& didThrow, ScriptState* state)
+{
+    ScriptScope scope(state);
+    return adoptRef(new SerializedScriptValue(value.v8Value(), 0, 0, didThrow, state->isolate()));
+}
+
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::createFromWire(const String& data)
 {
     return adoptRef(new SerializedScriptValue(data));
@@ -2332,22 +2332,6 @@
     return adoptRef(new SerializedScriptValue(wireData));
 }
 
-PassRefPtr<SerializedScriptValue> SerializedScriptValue::booleanValue(bool value)
-{
-    return booleanValue(value, v8::Isolate::GetCurrent());
-}
-
-PassRefPtr<SerializedScriptValue> SerializedScriptValue::booleanValue(bool value, v8::Isolate* isolate)
-{
-    Writer writer(isolate);
-    if (value)
-        writer.writeTrue();
-    else
-        writer.writeFalse();
-    String wireData = writer.takeWireString();
-    return adoptRef(new SerializedScriptValue(wireData));
-}
-
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::numberValue(double value)
 {
     return numberValue(value, v8::Isolate::GetCurrent());
@@ -2380,13 +2364,6 @@
     }
 }
 
-PassRefPtr<SerializedScriptValue> SerializedScriptValue::release()
-{
-    RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data));
-    m_data = String();
-    return result.release();
-}
-
 SerializedScriptValue::SerializedScriptValue()
     : m_externallyAllocatedMemory(0)
 {
@@ -2533,15 +2510,6 @@
     return deserializer.deserialize();
 }
 
-ScriptValue SerializedScriptValue::deserializeForInspector(ScriptState* scriptState)
-{
-    v8::Isolate* isolate = scriptState->isolate();
-    v8::HandleScope handleScope(isolate);
-    v8::Context::Scope contextScope(scriptState->context());
-
-    return ScriptValue(deserialize(isolate), isolate);
-}
-
 void SerializedScriptValue::registerMemoryAllocatedWithCurrentScriptContext()
 {
     if (m_externallyAllocatedMemory)
diff --git a/Source/bindings/v8/SerializedScriptValue.h b/Source/bindings/v8/SerializedScriptValue.h
index ba979bb..c2b920b 100644
--- a/Source/bindings/v8/SerializedScriptValue.h
+++ b/Source/bindings/v8/SerializedScriptValue.h
@@ -68,13 +68,14 @@
     // the caller must not invoke any V8 operations until control returns to
     // V8. When serialization is successful, |didThrow| is false.
     static PassRefPtr<SerializedScriptValue> create(v8::Handle<v8::Value>, MessagePortArray*, ArrayBufferArray*, bool& didThrow, v8::Isolate*);
-    static PassRefPtr<SerializedScriptValue> create(v8::Handle<v8::Value>, v8::Isolate*);
     static PassRefPtr<SerializedScriptValue> createFromWire(const String&);
     static PassRefPtr<SerializedScriptValue> createFromWireBytes(const Vector<uint8_t>&);
     static PassRefPtr<SerializedScriptValue> create(const String&);
     static PassRefPtr<SerializedScriptValue> create(const String&, v8::Isolate*);
     static PassRefPtr<SerializedScriptValue> create();
 
+    static PassRefPtr<SerializedScriptValue> create(const ScriptValue&, bool& didThrow, ScriptState*);
+
     // Never throws exceptions.
     static PassRefPtr<SerializedScriptValue> createAndSwallowExceptions(v8::Handle<v8::Value>, v8::Isolate*);
 
@@ -82,13 +83,9 @@
     static PassRefPtr<SerializedScriptValue> nullValue(v8::Isolate*);
     static PassRefPtr<SerializedScriptValue> undefinedValue();
     static PassRefPtr<SerializedScriptValue> undefinedValue(v8::Isolate*);
-    static PassRefPtr<SerializedScriptValue> booleanValue(bool);
-    static PassRefPtr<SerializedScriptValue> booleanValue(bool, v8::Isolate*);
     static PassRefPtr<SerializedScriptValue> numberValue(double);
     static PassRefPtr<SerializedScriptValue> numberValue(double, v8::Isolate*);
 
-    PassRefPtr<SerializedScriptValue> release();
-
     String toWireString() const { return m_data; }
     void toWireBytes(Vector<char>&) const;
 
@@ -97,8 +94,6 @@
     v8::Handle<v8::Value> deserialize(MessagePortArray* = 0);
     v8::Handle<v8::Value> deserialize(v8::Isolate*, MessagePortArray* = 0);
 
-    ScriptValue deserializeForInspector(ScriptState*);
-
     // Only reflects the truth if the SSV was created by walking a v8 value, not reliable
     // if the SSV was created createdFromWire(data).
     bool containsBlobs() const { return !m_blobDataHandles.isEmpty(); }
diff --git a/Source/bindings/v8/V8Binding.cpp b/Source/bindings/v8/V8Binding.cpp
index 13e9fbb..232add9 100644
--- a/Source/bindings/v8/V8Binding.cpp
+++ b/Source/bindings/v8/V8Binding.cpp
@@ -67,12 +67,13 @@
 
 v8::Handle<v8::Value> setDOMException(int exceptionCode, v8::Isolate* isolate)
 {
-    return V8ThrowException::throwDOMException(exceptionCode, isolate);
+    // FIXME: pass in an ExceptionState instead for better creationContext.
+    return V8ThrowException::throwDOMException(exceptionCode, v8::Handle<v8::Object>(), isolate);
 }
 
 v8::Handle<v8::Value> setDOMException(int exceptionCode, const String& message, v8::Isolate* isolate)
 {
-    return V8ThrowException::throwDOMException(exceptionCode, message, isolate);
+    return V8ThrowException::throwDOMException(exceptionCode, message, v8::Handle<v8::Object>(), isolate);
 }
 
 v8::Handle<v8::Value> throwError(V8ErrorType errorType, const String& message, v8::Isolate* isolate)
@@ -122,15 +123,6 @@
     return &arrayBufferAllocator;
 }
 
-Vector<v8::Handle<v8::Value> > toVectorOfArguments(const v8::FunctionCallbackInfo<v8::Value>& info)
-{
-    Vector<v8::Handle<v8::Value> > result;
-    size_t length = info.Length();
-    for (size_t i = 0; i < length; ++i)
-        result.append(info[i]);
-    return result;
-}
-
 PassRefPtr<NodeFilter> toNodeFilter(v8::Handle<v8::Value> callback, v8::Isolate* isolate)
 {
     RefPtr<NodeFilter> filter = NodeFilter::create();
@@ -425,7 +417,7 @@
 PassRefPtr<XPathNSResolver> toXPathNSResolver(v8::Handle<v8::Value> value, v8::Isolate* isolate)
 {
     RefPtr<XPathNSResolver> resolver;
-    if (V8XPathNSResolver::HasInstance(value, isolate, worldType(isolate)))
+    if (V8XPathNSResolver::hasInstance(value, isolate, worldType(isolate)))
         resolver = V8XPathNSResolver::toNative(v8::Handle<v8::Object>::Cast(value));
     else if (value->IsObject())
         resolver = V8CustomXPathNSResolver::create(value->ToObject(), isolate);
diff --git a/Source/bindings/v8/V8Binding.h b/Source/bindings/v8/V8Binding.h
index f33245b..89c8edd 100644
--- a/Source/bindings/v8/V8Binding.h
+++ b/Source/bindings/v8/V8Binding.h
@@ -33,6 +33,7 @@
 #define V8Binding_h
 
 #include "bindings/v8/DOMWrapperWorld.h"
+#include "bindings/v8/Dictionary.h"
 #include "bindings/v8/ExceptionMessages.h"
 #include "bindings/v8/V8BindingMacros.h"
 #include "bindings/v8/V8PerIsolateData.h"
@@ -74,7 +75,7 @@
 
     v8::ArrayBuffer::Allocator* v8ArrayBufferAllocator();
 
-    v8::Handle<v8::Value> toV8Sequence(v8::Handle<v8::Value>, uint32_t& length, bool& notASequence, v8::Isolate*);
+    v8::Handle<v8::Value> toV8Sequence(v8::Handle<v8::Value>, uint32_t& length, v8::Isolate*);
 
     inline v8::Handle<v8::Value> argumentOrNull(const v8::FunctionCallbackInfo<v8::Value>& info, int index)
     {
@@ -430,7 +431,7 @@
 
     template<>
     struct NativeValueTraits<String> {
-        static inline String nativeValue(const v8::Handle<v8::Value>& value)
+        static inline String nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
         {
             V8TRYCATCH_FOR_V8STRINGRESOURCE_RETURN(V8StringResource<>, stringValue, value, String());
             return stringValue;
@@ -439,7 +440,7 @@
 
     template<>
     struct NativeValueTraits<unsigned> {
-        static inline unsigned nativeValue(const v8::Handle<v8::Value>& value)
+        static inline unsigned nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
         {
             return toUInt32(value);
         }
@@ -447,7 +448,7 @@
 
     template<>
     struct NativeValueTraits<float> {
-        static inline float nativeValue(const v8::Handle<v8::Value>& value)
+        static inline float nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
         {
             return static_cast<float>(value->NumberValue());
         }
@@ -455,12 +456,28 @@
 
     template<>
     struct NativeValueTraits<double> {
-        static inline double nativeValue(const v8::Handle<v8::Value>& value)
+        static inline double nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
         {
             return static_cast<double>(value->NumberValue());
         }
     };
 
+    template<>
+    struct NativeValueTraits<v8::Handle<v8::Value> > {
+        static inline v8::Handle<v8::Value> nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
+        {
+            return value;
+        }
+    };
+
+    template<>
+    struct NativeValueTraits<Dictionary> {
+        static inline Dictionary nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
+        {
+            return Dictionary(value, isolate);
+        }
+    };
+
     // Converts a JavaScript value to an array as per the Web IDL specification:
     // http://www.w3.org/TR/2012/CR-WebIDL-20120419/#es-array
     template <class T, class V8T>
@@ -472,7 +489,7 @@
         for (uint32_t i = 0; i < length; ++i) {
             v8::Handle<v8::Value> element = object->Get(i);
 
-            if (V8T::HasInstance(element, isolate, worldType(isolate))) {
+            if (V8T::hasInstance(element, isolate, worldType(isolate))) {
                 v8::Handle<v8::Object> elementObject = v8::Handle<v8::Object>::Cast(element);
                 result.uncheckedAppend(V8T::toNative(elementObject));
             } else {
@@ -493,12 +510,10 @@
 
         v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
         uint32_t length = 0;
-        bool notASequence = false;
         if (value->IsArray()) {
             length = v8::Local<v8::Array>::Cast(v8Value)->Length();
-        } else if (toV8Sequence(value, length, notASequence, isolate).IsEmpty()) {
-            if (notASequence)
-                throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex), isolate);
+        } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
+            throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex), isolate);
             return Vector<RefPtr<T> >();
         }
 
@@ -513,12 +528,10 @@
 
         v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
         uint32_t length = 0;
-        bool notASequence = false;
         if (value->IsArray()) {
             length = v8::Local<v8::Array>::Cast(v8Value)->Length();
-        } else if (toV8Sequence(value, length, notASequence, isolate).IsEmpty()) {
-            if (notASequence)
-                throwTypeError(ExceptionMessages::notASequenceTypeProperty(propertyName), isolate);
+        } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
+            throwTypeError(ExceptionMessages::notASequenceTypeProperty(propertyName), isolate);
             return Vector<RefPtr<T> >();
         }
 
@@ -532,12 +545,10 @@
     {
         v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
         uint32_t length = 0;
-        bool notASequence = false;
         if (value->IsArray()) {
             length = v8::Local<v8::Array>::Cast(v8Value)->Length();
-        } else if (toV8Sequence(value, length, notASequence, isolate).IsEmpty()) {
-            if (notASequence)
-                throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex), isolate);
+        } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
+            throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex), isolate);
             return Vector<T>();
         }
 
@@ -546,7 +557,7 @@
         typedef NativeValueTraits<T> TraitsType;
         v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(v8Value);
         for (uint32_t i = 0; i < length; ++i)
-            result.uncheckedAppend(TraitsType::nativeValue(object->Get(i)));
+            result.uncheckedAppend(TraitsType::nativeValue(object->Get(i), isolate));
         return result;
     }
 
@@ -559,15 +570,13 @@
         int length = info.Length();
         result.reserveInitialCapacity(length);
         for (int i = startIndex; i < length; ++i)
-            result.uncheckedAppend(TraitsType::nativeValue(info[i]));
+            result.uncheckedAppend(TraitsType::nativeValue(info[i], info.GetIsolate()));
         return result;
     }
 
-    Vector<v8::Handle<v8::Value> > toVectorOfArguments(const v8::FunctionCallbackInfo<v8::Value>&);
-
     // Validates that the passed object is a sequence type per WebIDL spec
     // http://www.w3.org/TR/2012/CR-WebIDL-20120419/#es-sequence
-    inline v8::Handle<v8::Value> toV8Sequence(v8::Handle<v8::Value> value, uint32_t& length, bool& notASequence, v8::Isolate* isolate)
+    inline v8::Handle<v8::Value> toV8Sequence(v8::Handle<v8::Value> value, uint32_t& length, v8::Isolate* isolate)
     {
         // Attempt converting to a sequence if the value is not already an array but is
         // any kind of object except for a native Date object or a native RegExp object.
@@ -575,8 +584,7 @@
         // FIXME: Do we really need to special case Date and RegExp object?
         // https://www.w3.org/Bugs/Public/show_bug.cgi?id=22806
         if (!value->IsObject() || value->IsDate() || value->IsRegExp()) {
-            // Signal that the caller must handle the type error.
-            notASequence = true;
+            // The caller is responsible for reporting a TypeError.
             return v8Undefined();
         }
 
@@ -589,7 +597,7 @@
         V8TRYCATCH(v8::Local<v8::Value>, lengthValue, object->Get(v8::String::NewSymbol("length")));
 
         if (lengthValue->IsUndefined() || lengthValue->IsNull()) {
-            notASequence = true;
+            // The caller is responsible for reporting a TypeError.
             return v8Undefined();
         }
 
@@ -715,8 +723,15 @@
     v8::Isolate* toIsolate(ExecutionContext*);
     v8::Isolate* toIsolate(Frame*);
 
-    // Can only be called by WebKit::initialize
+    // Can only be called by blink::initialize
     void setMainThreadIsolate(v8::Isolate*);
+
+    // Converts a DOM object to a v8 value.
+    // This is a no-inline version of toV8(). If you want to call toV8()
+    // without creating #include cycles, you can use this function instead.
+    // Each specialized implementation will be generated.
+    template<typename T>
+    v8::Handle<v8::Value> toV8NoInline(T* impl, v8::Handle<v8::Object> creationContext, v8::Isolate*);
 } // namespace WebCore
 
 #endif // V8Binding_h
diff --git a/Source/bindings/v8/V8BindingMacros.h b/Source/bindings/v8/V8BindingMacros.h
index 0123dbf..8098652 100644
--- a/Source/bindings/v8/V8BindingMacros.h
+++ b/Source/bindings/v8/V8BindingMacros.h
@@ -42,6 +42,17 @@
             return block.ReThrow();       \
     }
 
+#define V8TRYCATCH_RETURN(type, var, value, retVal) \
+    type var;                                       \
+    {                                               \
+        v8::TryCatch block;                         \
+        var = (value);                              \
+        if (block.HasCaught()) {                    \
+            block.ReThrow();                        \
+            return retVal;                          \
+        }                                           \
+    }
+
 #define V8TRYCATCH_VOID(type, var, value) \
     type var;                             \
     {                                     \
diff --git a/Source/bindings/v8/V8CustomElementLifecycleCallbacks.cpp b/Source/bindings/v8/V8CustomElementLifecycleCallbacks.cpp
index da0a0a8..b2f1c8d 100644
--- a/Source/bindings/v8/V8CustomElementLifecycleCallbacks.cpp
+++ b/Source/bindings/v8/V8CustomElementLifecycleCallbacks.cpp
@@ -162,7 +162,7 @@
 
     v8::Context::Scope scope(context);
 
-    v8::Handle<v8::Object> receiver = DOMDataStore::current(isolate)->get<V8Element>(element, isolate);
+    v8::Handle<v8::Object> receiver = DOMDataStore::current(isolate).get<V8Element>(element, isolate);
     if (!receiver.IsEmpty()) {
         // Swizzle the prototype of the existing wrapper. We don't need to
         // worry about non-existent wrappers; they will get the right
diff --git a/Source/bindings/v8/V8DOMConfiguration.cpp b/Source/bindings/v8/V8DOMConfiguration.cpp
index 986c455..100951f 100644
--- a/Source/bindings/v8/V8DOMConfiguration.cpp
+++ b/Source/bindings/v8/V8DOMConfiguration.cpp
@@ -33,10 +33,36 @@
 
 namespace WebCore {
 
-void V8DOMConfiguration::installAttributes(v8::Handle<v8::ObjectTemplate> instance, v8::Handle<v8::ObjectTemplate> prototype, const AttributeConfiguration* attributes, size_t attributeCount, v8::Isolate* isolate, WrapperWorldType currentWorldType)
+void V8DOMConfiguration::installAttributes(v8::Handle<v8::ObjectTemplate> instanceTemplate, v8::Handle<v8::ObjectTemplate> prototype, const AttributeConfiguration* attributes, size_t attributeCount, v8::Isolate* isolate, WrapperWorldType currentWorldType)
 {
     for (size_t i = 0; i < attributeCount; ++i)
-        installAttribute(instance, prototype, attributes[i], isolate, currentWorldType);
+        installAttribute(instanceTemplate, prototype, attributes[i], isolate, currentWorldType);
+}
+
+void V8DOMConfiguration::installAccessors(v8::Handle<v8::ObjectTemplate> prototype, v8::Handle<v8::Signature> signature, const AccessorConfiguration* accessors, size_t accessorCount, v8::Isolate* isolate, WrapperWorldType currentWorldType)
+{
+    for (size_t i = 0; i < accessorCount; ++i) {
+        v8::FunctionCallback getterCallback = accessors[i].getter;
+        v8::FunctionCallback setterCallback = accessors[i].setter;
+        if (currentWorldType == MainWorld) {
+            if (accessors[i].getterForMainWorld)
+                getterCallback = accessors[i].getterForMainWorld;
+            if (accessors[i].setterForMainWorld)
+                setterCallback = accessors[i].setterForMainWorld;
+        }
+
+        v8::Local<v8::FunctionTemplate> getter;
+        if (getterCallback) {
+            getter = v8::FunctionTemplate::New(getterCallback, v8::External::New(isolate, const_cast<WrapperTypeInfo*>(accessors[i].data)), signature, 0);
+            getter->RemovePrototype();
+        }
+        v8::Local<v8::FunctionTemplate> setter;
+        if (setterCallback) {
+            setter = v8::FunctionTemplate::New(setterCallback, v8::External::New(isolate, const_cast<WrapperTypeInfo*>(accessors[i].data)), signature, 1);
+            setter->RemovePrototype();
+        }
+        prototype->SetAccessorProperty(v8::String::NewSymbol(accessors[i].name), getter, setter, accessors[i].attribute, accessors[i].settings);
+    }
 }
 
 void V8DOMConfiguration::installConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor, v8::Handle<v8::ObjectTemplate> prototype, const ConstantConfiguration* constants, size_t constantCount, v8::Isolate* isolate)
@@ -60,12 +86,15 @@
     }
 }
 
-v8::Local<v8::Signature> V8DOMConfiguration::installDOMClassTemplate(v8::Handle<v8::FunctionTemplate> functionDescriptor, const char* interfaceName, v8::Handle<v8::FunctionTemplate> parentClass,
-    size_t fieldCount, const AttributeConfiguration* attributes, size_t attributeCount, const MethodConfiguration* callbacks, size_t callbackCount, v8::Isolate* isolate, WrapperWorldType currentWorldType)
+v8::Local<v8::Signature> V8DOMConfiguration::installDOMClassTemplate(v8::Handle<v8::FunctionTemplate> functionDescriptor, const char* interfaceName, v8::Handle<v8::FunctionTemplate> parentClass, size_t fieldCount,
+    const AttributeConfiguration* attributes, size_t attributeCount,
+    const AccessorConfiguration* accessors, size_t accessorCount,
+    const MethodConfiguration* callbacks, size_t callbackCount,
+    v8::Isolate* isolate, WrapperWorldType currentWorldType)
 {
     functionDescriptor->SetClassName(v8::String::NewSymbol(interfaceName));
-    v8::Local<v8::ObjectTemplate> instance = functionDescriptor->InstanceTemplate();
-    instance->SetInternalFieldCount(fieldCount);
+    v8::Local<v8::ObjectTemplate> instanceTemplate = functionDescriptor->InstanceTemplate();
+    instanceTemplate->SetInternalFieldCount(fieldCount);
     if (!parentClass.IsEmpty()) {
         functionDescriptor->Inherit(parentClass);
         // Marks the prototype object as one of native-backed objects.
@@ -75,9 +104,11 @@
         prototype->SetInternalFieldCount(v8PrototypeInternalFieldcount);
     }
 
-    if (attributeCount)
-        installAttributes(instance, functionDescriptor->PrototypeTemplate(), attributes, attributeCount, isolate, currentWorldType);
     v8::Local<v8::Signature> defaultSignature = v8::Signature::New(functionDescriptor);
+    if (attributeCount)
+        installAttributes(instanceTemplate, functionDescriptor->PrototypeTemplate(), attributes, attributeCount, isolate, currentWorldType);
+    if (accessorCount)
+        installAccessors(functionDescriptor->PrototypeTemplate(), defaultSignature, accessors, accessorCount, isolate, currentWorldType);
     if (callbackCount)
         installCallbacks(functionDescriptor->PrototypeTemplate(), defaultSignature, static_cast<v8::PropertyAttribute>(v8::DontDelete), callbacks, callbackCount, isolate, currentWorldType);
     return defaultSignature;
diff --git a/Source/bindings/v8/V8DOMConfiguration.h b/Source/bindings/v8/V8DOMConfiguration.h
index f7ba865..aed41bb 100644
--- a/Source/bindings/v8/V8DOMConfiguration.h
+++ b/Source/bindings/v8/V8DOMConfiguration.h
@@ -56,21 +56,34 @@
         bool onPrototype;
     };
 
+    // AccessorConfiguration translates into calls to SetAccessorProperty()
+    // on prototype ObjectTemplate.
+    struct AccessorConfiguration {
+        const char* const name;
+        v8::FunctionCallback getter;
+        v8::FunctionCallback setter;
+        v8::FunctionCallback getterForMainWorld;
+        v8::FunctionCallback setterForMainWorld;
+        const WrapperTypeInfo* data;
+        v8::AccessControl settings;
+        v8::PropertyAttribute attribute;
+    };
+
     static void installAttributes(v8::Handle<v8::ObjectTemplate>, v8::Handle<v8::ObjectTemplate>, const AttributeConfiguration*, size_t attributeCount, v8::Isolate*, WrapperWorldType currentWorldType);
 
     template<class ObjectOrTemplate>
-    static inline void installAttribute(v8::Handle<ObjectOrTemplate> instance, v8::Handle<ObjectOrTemplate> prototype, const AttributeConfiguration& attribute, v8::Isolate*)
+    static inline void installAttribute(v8::Handle<ObjectOrTemplate> instanceTemplate, v8::Handle<ObjectOrTemplate> prototype, const AttributeConfiguration& attribute, v8::Isolate* isolate)
     {
-        (attribute.onPrototype ? prototype : instance)->SetAccessor(v8::String::NewSymbol(attribute.name),
+        (attribute.onPrototype ? prototype : instanceTemplate)->SetAccessor(v8::String::NewSymbol(attribute.name),
                                                                     attribute.getter,
                                                                     attribute.setter,
-                                                                    v8::External::New(const_cast<WrapperTypeInfo*>(attribute.data)),
+                                                                    v8::External::New(isolate, const_cast<WrapperTypeInfo*>(attribute.data)),
                                                                     attribute.settings,
                                                                     attribute.attribute);
     }
 
     template<class ObjectOrTemplate>
-    static inline void installAttribute(v8::Handle<ObjectOrTemplate> instance, v8::Handle<ObjectOrTemplate> prototype, const AttributeConfiguration& attribute, v8::Isolate*, WrapperWorldType currentWorldType)
+    static inline void installAttribute(v8::Handle<ObjectOrTemplate> instanceTemplate, v8::Handle<ObjectOrTemplate> prototype, const AttributeConfiguration& attribute, v8::Isolate* isolate, WrapperWorldType currentWorldType)
     {
         v8::AccessorGetterCallback getter = attribute.getter;
         v8::AccessorSetterCallback setter = attribute.setter;
@@ -80,10 +93,10 @@
             if (attribute.setterForMainWorld)
                 setter = attribute.setterForMainWorld;
         }
-        (attribute.onPrototype ? prototype : instance)->SetAccessor(v8::String::NewSymbol(attribute.name),
+        (attribute.onPrototype ? prototype : instanceTemplate)->SetAccessor(v8::String::NewSymbol(attribute.name),
             getter,
             setter,
-            v8::External::New(const_cast<WrapperTypeInfo*>(attribute.data)),
+            v8::External::New(isolate, const_cast<WrapperTypeInfo*>(attribute.data)),
             attribute.settings,
             attribute.attribute);
     }
@@ -109,7 +122,13 @@
 
     static void installCallbacks(v8::Handle<v8::ObjectTemplate>, v8::Handle<v8::Signature>, v8::PropertyAttribute, const MethodConfiguration*, size_t callbackCount, v8::Isolate*, WrapperWorldType);
 
-    static v8::Local<v8::Signature> installDOMClassTemplate(v8::Handle<v8::FunctionTemplate>, const char* interfaceName, v8::Handle<v8::FunctionTemplate> parentClass, size_t fieldCount, const AttributeConfiguration*, size_t attributeCount, const MethodConfiguration*, size_t callbackCount, v8::Isolate*, WrapperWorldType);
+    static void installAccessors(v8::Handle<v8::ObjectTemplate>, v8::Handle<v8::Signature>, const AccessorConfiguration*, size_t accessorCount, v8::Isolate*, WrapperWorldType);
+
+    static v8::Local<v8::Signature> installDOMClassTemplate(v8::Handle<v8::FunctionTemplate>, const char* interfaceName, v8::Handle<v8::FunctionTemplate> parentClass, size_t fieldCount,
+        const AttributeConfiguration*, size_t attributeCount,
+        const AccessorConfiguration*, size_t accessorCount,
+        const MethodConfiguration*, size_t callbackCount,
+        v8::Isolate*, WrapperWorldType);
 };
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/V8DOMWrapper.cpp b/Source/bindings/v8/V8DOMWrapper.cpp
index d30f7cd..1e4c3ba 100644
--- a/Source/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/bindings/v8/V8DOMWrapper.cpp
@@ -103,7 +103,9 @@
     v8::HandleScope scope(v8::Isolate::GetCurrent());
     ASSERT(object->GetAlignedPointerFromInternalField(v8DOMWrapperObjectIndex));
 
-    return true;
+    const WrapperTypeInfo* typeInfo = static_cast<const WrapperTypeInfo*>(object->GetAlignedPointerFromInternalField(v8DOMWrapperTypeIndex));
+
+    return typeInfo->ginEmbedder == gin::kEmbedderBlink;
 }
 #endif
 
@@ -118,8 +120,10 @@
     ASSERT(wrapper->GetAlignedPointerFromInternalField(v8DOMWrapperObjectIndex));
     ASSERT(wrapper->GetAlignedPointerFromInternalField(v8DOMWrapperTypeIndex));
 
+    const WrapperTypeInfo* typeInfo = static_cast<const WrapperTypeInfo*>(wrapper->GetAlignedPointerFromInternalField(v8DOMWrapperTypeIndex));
+
     // FIXME: Add class id checks.
-    return true;
+    return typeInfo->ginEmbedder == gin::kEmbedderBlink;
 }
 
 bool V8DOMWrapper::isWrapperOfType(v8::Handle<v8::Value> value, const WrapperTypeInfo* type)
@@ -132,7 +136,7 @@
     ASSERT(wrapper->GetAlignedPointerFromInternalField(v8DOMWrapperObjectIndex));
 
     const WrapperTypeInfo* typeInfo = static_cast<const WrapperTypeInfo*>(wrapper->GetAlignedPointerFromInternalField(v8DOMWrapperTypeIndex));
-    return typeInfo == type;
+    return typeInfo->ginEmbedder == gin::kEmbedderBlink && typeInfo == type;
 }
 
 }  // namespace WebCore
diff --git a/Source/bindings/v8/V8EventListenerList.h b/Source/bindings/v8/V8EventListenerList.h
index 78f3b84..544f37b 100644
--- a/Source/bindings/v8/V8EventListenerList.h
+++ b/Source/bindings/v8/V8EventListenerList.h
@@ -105,7 +105,7 @@
 
     RefPtr<V8EventListener> wrapperPtr = WrapperType::create(object, isAttribute, isolate);
     if (wrapperPtr)
-        object->SetHiddenValue(wrapperProperty, v8::External::New(wrapperPtr.get()));
+        object->SetHiddenValue(wrapperProperty, v8::External::New(isolate, wrapperPtr.get()));
 
     return wrapperPtr;
 }
diff --git a/Source/bindings/v8/V8GCController.cpp b/Source/bindings/v8/V8GCController.cpp
index 483d648..8e41cfe 100644
--- a/Source/bindings/v8/V8GCController.cpp
+++ b/Source/bindings/v8/V8GCController.cpp
@@ -32,7 +32,6 @@
 #include "bindings/v8/V8GCController.h"
 
 #include <algorithm>
-#include "V8MessagePort.h"
 #include "V8MutationObserver.h"
 #include "V8Node.h"
 #include "V8ScriptRunner.h"
@@ -42,9 +41,12 @@
 #include "bindings/v8/WrapperTypeInfo.h"
 #include "core/dom/Attr.h"
 #include "core/dom/NodeTraversal.h"
+#include "core/dom/TemplateContentDocumentFragment.h"
 #include "core/dom/shadow/ElementShadow.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/html/HTMLImageElement.h"
+#include "core/html/HTMLTemplateElement.h"
+#include "core/svg/SVGElement.h"
 #include "platform/TraceEvent.h"
 
 namespace WebCore {
@@ -84,7 +86,7 @@
         node = ownerElement;
     }
 
-    while (Node* parent = node->parentOrShadowHostNode())
+    while (Node* parent = node->parentOrShadowHostOrTemplateHostNode())
         node = parent;
 
     return node;
@@ -122,7 +124,7 @@
         ASSERT((*reinterpret_cast<v8::Handle<v8::Value>*>(value))->IsObject());
         v8::Handle<v8::Object>* wrapper = reinterpret_cast<v8::Handle<v8::Object>*>(value);
         ASSERT(V8DOMWrapper::maybeDOMWrapper(*wrapper));
-        ASSERT(V8Node::HasInstanceInAnyWorld(*wrapper, m_isolate));
+        ASSERT(V8Node::hasInstanceInAnyWorld(*wrapper, m_isolate));
         Node* node = V8Node::toNative(*wrapper);
         // A minor DOM GC can handle only node wrappers in the main world.
         // Note that node->wrapper().IsEmpty() returns true for nodes that
@@ -155,13 +157,14 @@
         // To make each minor GC time bounded, we might need to give up
         // traversing at some point for a large DOM tree. That being said,
         // I could not observe the need even in pathological test cases.
-        for (Node* node = rootNode; node; node = NodeTraversal::next(node)) {
+        for (Node* node = rootNode; node; node = NodeTraversal::next(*node)) {
             if (node->containsWrapper()) {
                 // FIXME: Remove the special handling for image elements.
+                // FIXME: Remove the special handling for SVG context elements.
                 // The same special handling is in V8GCController::opaqueRootForGC().
                 // Maybe should image elements be active DOM nodes?
                 // See https://code.google.com/p/chromium/issues/detail?id=164882
-                if (!node->isV8CollectableDuringMinorGC() || (node->hasTagName(HTMLNames::imgTag) && toHTMLImageElement(node)->hasPendingActivity())) {
+                if (!node->isV8CollectableDuringMinorGC() || (node->hasTagName(HTMLNames::imgTag) && toHTMLImageElement(node)->hasPendingActivity()) || (node->isSVGElement() && toSVGElement(node)->isContextElement())) {
                     // This node is not in the new space of V8. This indicates that
                     // the minor GC cannot anyway judge reachability of this DOM tree.
                     // Thus we give up traversing the DOM tree.
@@ -179,6 +182,12 @@
                         return false;
                 }
             }
+            // <template> has a |content| property holding a DOM fragment which we must traverse,
+            // just like we do for the shadow trees above.
+            if (node->hasTagName(HTMLNames::templateTag)) {
+                if (!traverseTree(toHTMLTemplateElement(node)->content(), newSpaceNodes))
+                    return false;
+            }
         }
         return true;
     }
@@ -188,8 +197,8 @@
         Vector<Node*, initialNodeVectorSize> newSpaceNodes;
 
         Node* node = startNode;
-        while (node->parentOrShadowHostNode())
-            node = node->parentOrShadowHostNode();
+        while (Node* parent = node->parentOrShadowHostOrTemplateHostNode())
+            node = parent;
 
         if (!traverseTree(node, &newSpaceNodes))
             return;
@@ -248,14 +257,7 @@
         const WrapperTypeInfo* type = toWrapperTypeInfo(*wrapper);
         void* object = toNative(*wrapper);
 
-        if (V8MessagePort::wrapperTypeInfo.equals(type)) {
-            // Mark each port as in-use if it's entangled. For simplicity's sake,
-            // we assume all ports are remotely entangled, since the Chromium port
-            // implementation can't tell the difference.
-            MessagePort* port = static_cast<MessagePort*>(object);
-            if (port->isEntangled() || port->hasPendingActivity())
-                m_isolate->SetObjectGroupId(*value, liveRootId());
-        } else if (V8MutationObserver::wrapperTypeInfo.equals(type)) {
+        if (V8MutationObserver::wrapperTypeInfo.equals(type)) {
             // FIXME: Allow opaqueRootForGC to operate on multiple roots and move this logic into V8MutationObserverCustom.
             MutationObserver* observer = static_cast<MutationObserver*>(object);
             HashSet<Node*> observedNodes = observer->getObservedNodes();
@@ -271,7 +273,7 @@
 
         if (classId == v8DOMNodeClassId) {
             UNUSED_PARAM(m_isolate);
-            ASSERT(V8Node::HasInstanceInAnyWorld(*wrapper, m_isolate));
+            ASSERT(V8Node::hasInstanceInAnyWorld(*wrapper, m_isolate));
             ASSERT(!value->IsIndependent());
 
             Node* node = static_cast<Node*>(object);
@@ -285,7 +287,7 @@
         } else if (classId == v8DOMObjectClassId) {
             ASSERT(!value->IsIndependent());
             v8::Persistent<v8::Object>* wrapperPersistent = reinterpret_cast<v8::Persistent<v8::Object>*>(value);
-            type->resolveWrapperReachability(object, *wrapperPersistent, m_isolate);
+            type->visitDOMWrapper(object, *wrapperPersistent, m_isolate);
         } else {
             ASSERT_NOT_REACHED();
         }
diff --git a/Source/bindings/v8/V8GCForContextDispose.cpp b/Source/bindings/v8/V8GCForContextDispose.cpp
index a4c58fd..e7d40bd 100644
--- a/Source/bindings/v8/V8GCForContextDispose.cpp
+++ b/Source/bindings/v8/V8GCForContextDispose.cpp
@@ -60,7 +60,7 @@
     }
 }
 
-V8GCForContextDispose& V8GCForContextDispose::instance()
+V8GCForContextDispose& V8GCForContextDispose::instanceTemplate()
 {
     DEFINE_STATIC_LOCAL(V8GCForContextDispose, staticInstance, ());
     return staticInstance;
diff --git a/Source/bindings/v8/V8GCForContextDispose.h b/Source/bindings/v8/V8GCForContextDispose.h
index d6b3a0e..3d16be4 100644
--- a/Source/bindings/v8/V8GCForContextDispose.h
+++ b/Source/bindings/v8/V8GCForContextDispose.h
@@ -41,7 +41,7 @@
     void notifyContextDisposed(bool isMainFrame);
     void notifyIdleSooner(double maximumFireInterval);
 
-    static V8GCForContextDispose& instance();
+    static V8GCForContextDispose& instanceTemplate();
 
 private:
     V8GCForContextDispose(); // Use instance() instead.
diff --git a/Source/bindings/v8/V8Initializer.cpp b/Source/bindings/v8/V8Initializer.cpp
index 44d1fbf..0cc784c 100644
--- a/Source/bindings/v8/V8Initializer.cpp
+++ b/Source/bindings/v8/V8Initializer.cpp
@@ -78,7 +78,7 @@
 
 static void reportFatalErrorInMainThread(const char* location, const char* message)
 {
-    int memoryUsageMB = WebKit::Platform::current()->actualMemoryUsageMB();
+    int memoryUsageMB = blink::Platform::current()->actualMemoryUsageMB();
     printf("V8 error: %s (%s).  Current memory usage: %d MB\n", message, location, memoryUsageMB);
     CRASH();
 }
@@ -135,9 +135,9 @@
         return;
     DOMWindow* targetWindow = target->domWindow();
 
-    ExceptionState es(v8::Isolate::GetCurrent());
-    es.throwSecurityError(targetWindow->sanitizedCrossDomainAccessErrorMessage(activeDOMWindow()), targetWindow->crossDomainAccessErrorMessage(activeDOMWindow()));
-    es.throwIfNeeded();
+    ExceptionState exceptionState(v8::Handle<v8::Object>(), v8::Isolate::GetCurrent());
+    exceptionState.throwSecurityError(targetWindow->sanitizedCrossDomainAccessErrorMessage(activeDOMWindow()), targetWindow->crossDomainAccessErrorMessage(activeDOMWindow()));
+    exceptionState.throwIfNeeded();
 }
 
 static bool codeGenerationCheckCallbackInMainThread(v8::Local<v8::Context> context)
@@ -149,8 +149,12 @@
     return false;
 }
 
-static void initializeV8Common()
+static void initializeV8Common(v8::Isolate* isolate)
 {
+    v8::ResourceConstraints constraints;
+    constraints.ConfigureDefaults(static_cast<uint64_t>(blink::Platform::current()->physicalMemoryMB()) << 20, static_cast<uint32_t>(blink::Platform::current()->numberOfProcessors()));
+    v8::SetResourceConstraints(isolate, &constraints);
+
     v8::V8::AddGCPrologueCallback(V8GCController::gcPrologue);
     v8::V8::AddGCEpilogueCallback(V8GCController::gcEpilogue);
     v8::V8::IgnoreOutOfMemoryException();
@@ -167,7 +171,7 @@
         return;
     initialized = true;
 
-    initializeV8Common();
+    initializeV8Common(isolate);
 
     v8::V8::SetFatalErrorHandler(reportFatalErrorInMainThread);
     v8::V8::AddMessageListener(messageHandlerInMainThread);
@@ -210,7 +214,7 @@
 
 void V8Initializer::initializeWorker(v8::Isolate* isolate)
 {
-    initializeV8Common();
+    initializeV8Common(isolate);
 
     v8::V8::AddMessageListener(messageHandlerInWorker);
     v8::V8::SetFatalErrorHandler(reportFatalErrorInWorker);
@@ -218,9 +222,7 @@
     v8::ResourceConstraints resourceConstraints;
     uint32_t here;
     resourceConstraints.set_stack_limit(&here - kWorkerMaxStackSize / sizeof(uint32_t*));
-    v8::SetResourceConstraints(&resourceConstraints);
-
-    V8PerIsolateData::ensureInitialized(isolate);
+    v8::SetResourceConstraints(isolate, &resourceConstraints);
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/V8NPObject.cpp b/Source/bindings/v8/V8NPObject.cpp
index bd1899e..4a4dd70 100644
--- a/Source/bindings/v8/V8NPObject.cpp
+++ b/Source/bindings/v8/V8NPObject.cpp
@@ -72,13 +72,13 @@
 
     WrapperWorldType currentWorldType = worldType(info.GetIsolate());
     // These three types are subtypes of HTMLPlugInElement.
-    if (V8HTMLAppletElement::HasInstance(info.Holder(), info.GetIsolate(), currentWorldType) || V8HTMLEmbedElement::HasInstance(info.Holder(), info.GetIsolate(), currentWorldType)
-        || V8HTMLObjectElement::HasInstance(info.Holder(), info.GetIsolate(), currentWorldType)) {
+    if (V8HTMLAppletElement::hasInstance(info.Holder(), info.GetIsolate(), currentWorldType) || V8HTMLEmbedElement::hasInstance(info.Holder(), info.GetIsolate(), currentWorldType)
+        || V8HTMLObjectElement::hasInstance(info.Holder(), info.GetIsolate(), currentWorldType)) {
         // The holder object is a subtype of HTMLPlugInElement.
         HTMLPlugInElement* element;
-        if (V8HTMLAppletElement::HasInstance(info.Holder(), info.GetIsolate(), currentWorldType))
+        if (V8HTMLAppletElement::hasInstance(info.Holder(), info.GetIsolate(), currentWorldType))
             element = V8HTMLAppletElement::toNative(info.Holder());
-        else if (V8HTMLEmbedElement::HasInstance(info.Holder(), info.GetIsolate(), currentWorldType))
+        else if (V8HTMLEmbedElement::hasInstance(info.Holder(), info.GetIsolate(), currentWorldType))
             element = V8HTMLEmbedElement::toNative(info.Holder());
         else
             element = V8HTMLObjectElement::toNative(info.Holder());
@@ -202,7 +202,7 @@
     void dispose(PrivateIdentifier* key)
     {
         MapType::iterator it = m_map.find(key);
-        ASSERT(it != m_map.end());
+        ASSERT_WITH_SECURITY_IMPLICATION(it != m_map.end());
         it->value.dispose();
         m_map.remove(it);
     }
diff --git a/Source/bindings/v8/V8NPUtils.cpp b/Source/bindings/v8/V8NPUtils.cpp
index 779b0a9..fc291b4 100644
--- a/Source/bindings/v8/V8NPUtils.cpp
+++ b/Source/bindings/v8/V8NPUtils.cpp
@@ -39,6 +39,8 @@
 #include "core/frame/DOMWindow.h"
 #include "wtf/text/WTFString.h"
 
+#include <stdlib.h>
+
 namespace WebCore {
 
 void convertV8ObjectToNPVariant(v8::Local<v8::Value> object, NPObject* owner, NPVariant* result, v8::Isolate* isolate)
diff --git a/Source/bindings/v8/V8PerContextData.cpp b/Source/bindings/v8/V8PerContextData.cpp
index d6ad06c..61cca49 100644
--- a/Source/bindings/v8/V8PerContextData.cpp
+++ b/Source/bindings/v8/V8PerContextData.cpp
@@ -35,6 +35,8 @@
 #include "bindings/v8/V8ObjectConstructor.h"
 #include "wtf/StringExtras.h"
 
+#include <stdlib.h>
+
 namespace WebCore {
 
 template<typename Map>
@@ -95,10 +97,10 @@
 
     v8::Context::Scope scope(v8::Local<v8::Context>::New(m_isolate, m_context));
     v8::Local<v8::Function> function = constructorForType(type);
-    v8::Local<v8::Object> instance = V8ObjectConstructor::newInstance(function);
-    if (!instance.IsEmpty()) {
-        m_wrapperBoilerplates.set(type, UnsafePersistent<v8::Object>(m_isolate, instance));
-        return instance->Clone();
+    v8::Local<v8::Object> instanceTemplate = V8ObjectConstructor::newInstance(function);
+    if (!instanceTemplate.IsEmpty()) {
+        m_wrapperBoilerplates.set(type, UnsafePersistent<v8::Object>(m_isolate, instanceTemplate));
+        return instanceTemplate->Clone();
     }
     return v8::Local<v8::Object>();
 }
@@ -116,10 +118,10 @@
         return v8::Local<v8::Function>();
 
     if (type->parentClass) {
-        v8::Local<v8::Object> proto = constructorForType(type->parentClass);
-        if (proto.IsEmpty())
+        v8::Local<v8::Object> prototypeTemplate = constructorForType(type->parentClass);
+        if (prototypeTemplate.IsEmpty())
             return v8::Local<v8::Function>();
-        function->SetPrototype(proto);
+        function->SetPrototype(prototypeTemplate);
     }
 
     v8::Local<v8::Value> prototypeValue = function->Get(v8::String::NewSymbol("prototype"));
@@ -128,7 +130,7 @@
         if (prototypeObject->InternalFieldCount() == v8PrototypeInternalFieldcount
             && type->wrapperTypePrototype == WrapperTypeObjectPrototype)
             prototypeObject->SetAlignedPointerInInternalField(v8PrototypeTypeIndex, const_cast<WrapperTypeInfo*>(type));
-        type->installPerContextEnabledPrototypeProperties(prototypeObject, m_isolate);
+        type->installPerContextEnabledMethods(prototypeObject, m_isolate);
         if (type->wrapperTypePrototype == WrapperTypeErrorPrototype)
             prototypeObject->SetPrototype(m_errorPrototype.newLocal(m_isolate));
     }
@@ -155,14 +157,14 @@
 void V8PerContextData::clearCustomElementBinding(CustomElementDefinition* definition)
 {
     CustomElementBindingMap::iterator it = m_customElementBindings->find(definition);
-    ASSERT(it != m_customElementBindings->end());
+    ASSERT_WITH_SECURITY_IMPLICATION(it != m_customElementBindings->end());
     m_customElementBindings->remove(it);
 }
 
 CustomElementBinding* V8PerContextData::customElementBinding(CustomElementDefinition* definition)
 {
     CustomElementBindingMap::const_iterator it = m_customElementBindings->find(definition);
-    ASSERT(it != m_customElementBindings->end());
+    ASSERT_WITH_SECURITY_IMPLICATION(it != m_customElementBindings->end());
     return it->value.get();
 }
 
diff --git a/Source/bindings/v8/V8PerIsolateData.cpp b/Source/bindings/v8/V8PerIsolateData.cpp
index 9e89d13..a76803a 100644
--- a/Source/bindings/v8/V8PerIsolateData.cpp
+++ b/Source/bindings/v8/V8PerIsolateData.cpp
@@ -58,16 +58,16 @@
 V8PerIsolateData* V8PerIsolateData::create(v8::Isolate* isolate)
 {
     ASSERT(isolate);
-    ASSERT(!isolate->GetData());
+    ASSERT(!isolate->GetData(gin::kEmbedderBlink));
     V8PerIsolateData* data = new V8PerIsolateData(isolate);
-    isolate->SetData(data);
+    isolate->SetData(gin::kEmbedderBlink, data);
     return data;
 }
 
 void V8PerIsolateData::ensureInitialized(v8::Isolate* isolate)
 {
     ASSERT(isolate);
-    if (!isolate->GetData())
+    if (!isolate->GetData(gin::kEmbedderBlink))
         create(isolate);
 }
 
@@ -80,9 +80,9 @@
 
 void V8PerIsolateData::dispose(v8::Isolate* isolate)
 {
-    void* data = isolate->GetData();
+    void* data = isolate->GetData(gin::kEmbedderBlink);
     delete static_cast<V8PerIsolateData*>(data);
-    isolate->SetData(0);
+    isolate->SetData(gin::kEmbedderBlink, 0);
 }
 
 v8::Handle<v8::FunctionTemplate> V8PerIsolateData::toStringTemplate()
diff --git a/Source/bindings/v8/V8PerIsolateData.h b/Source/bindings/v8/V8PerIsolateData.h
index fc93102..6a96357 100644
--- a/Source/bindings/v8/V8PerIsolateData.h
+++ b/Source/bindings/v8/V8PerIsolateData.h
@@ -29,6 +29,7 @@
 #include "bindings/v8/ScopedPersistent.h"
 #include "bindings/v8/UnsafePersistent.h"
 #include "bindings/v8/WrapperTypeInfo.h"
+#include "gin/public/gin_embedders.h"
 #include <v8.h>
 #include "wtf/Forward.h"
 #include "wtf/HashMap.h"
@@ -58,8 +59,8 @@
     static V8PerIsolateData* from(v8::Isolate* isolate)
     {
         ASSERT(isolate);
-        ASSERT(isolate->GetData());
-        return static_cast<V8PerIsolateData*>(isolate->GetData());
+        ASSERT(isolate->GetData(gin::kEmbedderBlink));
+        return static_cast<V8PerIsolateData*>(isolate->GetData(gin::kEmbedderBlink));
     }
     static void dispose(v8::Isolate*);
 
diff --git a/Source/bindings/v8/V8StringResource.cpp b/Source/bindings/v8/V8StringResource.cpp
index 22e5a48..888d1c2 100644
--- a/Source/bindings/v8/V8StringResource.cpp
+++ b/Source/bindings/v8/V8StringResource.cpp
@@ -187,7 +187,7 @@
     if (0 <= value && value <= kLowNumbers) {
         webCoreString = lowNumbers[value];
         if (!webCoreString) {
-            AtomicString valueString = AtomicString(String::number(value));
+            AtomicString valueString = AtomicString::number(value);
             lowNumbers[value] = valueString;
             webCoreString = valueString;
         }
diff --git a/Source/bindings/v8/V8ThrowException.cpp b/Source/bindings/v8/V8ThrowException.cpp
index 01715d0..ed31098 100644
--- a/Source/bindings/v8/V8ThrowException.cpp
+++ b/Source/bindings/v8/V8ThrowException.cpp
@@ -44,7 +44,7 @@
     info.Data()->ToObject()->Set(v8::String::NewSymbol("stack"), value);
 }
 
-v8::Handle<v8::Value> V8ThrowException::createDOMException(int ec, const String& sanitizedMessage, const String& unsanitizedMessage, v8::Isolate* isolate)
+v8::Handle<v8::Value> V8ThrowException::createDOMException(int ec, const String& sanitizedMessage, const String& unsanitizedMessage, const v8::Handle<v8::Object>& creationContext, v8::Isolate* isolate)
 {
     if (ec <= 0 || v8::V8::IsExecutionTerminating())
         return v8Undefined();
@@ -56,7 +56,7 @@
         return V8ThrowException::createTypeError(sanitizedMessage, isolate);
 
     RefPtr<DOMException> domException = DOMException::create(ec, sanitizedMessage, unsanitizedMessage);
-    v8::Handle<v8::Value> exception = toV8(domException, v8::Handle<v8::Object>(), isolate);
+    v8::Handle<v8::Value> exception = toV8(domException, creationContext, isolate);
 
     if (exception.IsEmpty())
         return v8Undefined();
@@ -70,10 +70,10 @@
     return exception;
 }
 
-v8::Handle<v8::Value> V8ThrowException::throwDOMException(int ec, const String& sanitizedMessage, const String& unsanitizedMessage, v8::Isolate* isolate)
+v8::Handle<v8::Value> V8ThrowException::throwDOMException(int ec, const String& sanitizedMessage, const String& unsanitizedMessage, const v8::Handle<v8::Object>& creationContext, v8::Isolate* isolate)
 {
     ASSERT(ec == SecurityError || unsanitizedMessage.isEmpty());
-    v8::Handle<v8::Value> exception = createDOMException(ec, sanitizedMessage, unsanitizedMessage, isolate);
+    v8::Handle<v8::Value> exception = createDOMException(ec, sanitizedMessage, unsanitizedMessage, creationContext, isolate);
     if (exception.IsEmpty())
         return v8Undefined();
 
diff --git a/Source/bindings/v8/V8ThrowException.h b/Source/bindings/v8/V8ThrowException.h
index 1f4deb2..7a4d20f 100644
--- a/Source/bindings/v8/V8ThrowException.h
+++ b/Source/bindings/v8/V8ThrowException.h
@@ -41,25 +41,21 @@
 class V8ThrowException {
 public:
 
-    static v8::Handle<v8::Value> createDOMException(int ec, v8::Isolate* isolate)
+    static v8::Handle<v8::Value> createDOMException(int ec, const String& message, const v8::Handle<v8::Object>& creationContext, v8::Isolate* isolate)
     {
-        return createDOMException(ec, String(), isolate);
+        return createDOMException(ec, message, String(), creationContext, isolate);
     }
-    static v8::Handle<v8::Value> createDOMException(int ec, const String& message, v8::Isolate* isolate)
-    {
-        return createDOMException(ec, message, String(), isolate);
-    }
-    static v8::Handle<v8::Value> createDOMException(int, const String& sanitizedMessage, const String& unsanitizedMessage, v8::Isolate*);
+    static v8::Handle<v8::Value> createDOMException(int, const String& sanitizedMessage, const String& unsanitizedMessage, const v8::Handle<v8::Object>& creationContext, v8::Isolate*);
 
-    static v8::Handle<v8::Value> throwDOMException(int ec, v8::Isolate* isolate)
+    static v8::Handle<v8::Value> throwDOMException(int ec, const v8::Handle<v8::Object>& creationContext, v8::Isolate* isolate)
     {
-        return throwDOMException(ec, String(), isolate);
+        return throwDOMException(ec, String(), creationContext, isolate);
     }
-    static v8::Handle<v8::Value> throwDOMException(int ec, const String& message, v8::Isolate* isolate)
+    static v8::Handle<v8::Value> throwDOMException(int ec, const String& message, const v8::Handle<v8::Object>& creationContext, v8::Isolate* isolate)
     {
-        return throwDOMException(ec, message, String(), isolate);
+        return throwDOMException(ec, message, String(), creationContext, isolate);
     }
-    static v8::Handle<v8::Value> throwDOMException(int, const String& sanitizedMessage, const String& unsanitizedMessage, v8::Isolate*);
+    static v8::Handle<v8::Value> throwDOMException(int, const String& sanitizedMessage, const String& unsanitizedMessage, const v8::Handle<v8::Object>& creationContext, v8::Isolate*);
 
     static v8::Handle<v8::Value> createError(V8ErrorType, const String&, v8::Isolate*);
     static v8::Handle<v8::Value> throwError(V8ErrorType, const String&, v8::Isolate*);
diff --git a/Source/bindings/v8/V8Utilities.cpp b/Source/bindings/v8/V8Utilities.cpp
index 310c64e..1e716f0 100644
--- a/Source/bindings/v8/V8Utilities.cpp
+++ b/Source/bindings/v8/V8Utilities.cpp
@@ -76,9 +76,9 @@
     if (value->IsArray()) {
         v8::Local<v8::Array> array = v8::Local<v8::Array>::Cast(value);
         length = array->Length();
-    } else {
-        if (toV8Sequence(value, length, notASequence, isolate).IsEmpty())
-            return false;
+    } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
+        notASequence = true;
+        return false;
     }
 
     v8::Local<v8::Object> transferrables = v8::Local<v8::Object>::Cast(value);
@@ -92,7 +92,7 @@
             return false;
         }
         // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
-        if (V8MessagePort::HasInstance(transferrable, isolate, worldType(isolate))) {
+        if (V8MessagePort::hasInstance(transferrable, isolate, worldType(isolate))) {
             RefPtr<MessagePort> port = V8MessagePort::toNative(v8::Handle<v8::Object>::Cast(transferrable));
             // Check for duplicate MessagePorts.
             if (ports.contains(port)) {
@@ -100,7 +100,7 @@
                 return false;
             }
             ports.append(port.release());
-        } else if (V8ArrayBuffer::HasInstance(transferrable, isolate, worldType(isolate)))
+        } else if (V8ArrayBuffer::hasInstance(transferrable, isolate, worldType(isolate)))
             arrayBuffers.append(V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(transferrable)));
         else {
             setDOMException(DataCloneError, isolate);
diff --git a/Source/bindings/v8/V8WindowShell.cpp b/Source/bindings/v8/V8WindowShell.cpp
index 7d9ca86..a4961b1 100644
--- a/Source/bindings/v8/V8WindowShell.cpp
+++ b/Source/bindings/v8/V8WindowShell.cpp
@@ -54,8 +54,8 @@
 #include "core/frame/Frame.h"
 #include "core/page/Page.h"
 #include "platform/TraceEvent.h"
+#include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
-#include "weborigin/SecurityOrigin.h"
 #include "wtf/Assertions.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/StringExtras.h"
@@ -105,8 +105,7 @@
     // It's likely that disposing the context has created a lot of
     // garbage. Notify V8 about this so it'll have a chance of cleaning
     // it up when idle.
-    bool isMainFrame = m_frame->page() && (m_frame->page()->mainFrame() == m_frame);
-    V8GCForContextDispose::instance().notifyContextDisposed(isMainFrame);
+    V8GCForContextDispose::instanceTemplate().notifyContextDisposed(m_frame->isMainFrame());
 }
 
 void V8WindowShell::clearForClose(bool destroyGlobal)
@@ -188,8 +187,6 @@
 
     v8::HandleScope handleScope(m_isolate);
 
-    V8Initializer::initializeMainThreadIfNeeded(m_isolate);
-
     createContext();
     if (m_context.isEmpty())
         return false;
@@ -290,7 +287,7 @@
     const char* histogramName = "WebCore.V8WindowShell.createContext.MainWorld";
     if (!m_world->isMainWorld())
         histogramName = "WebCore.V8WindowShell.createContext.IsolatedWorld";
-    WebKit::Platform::current()->histogramCustomCounts(histogramName, contextCreationDurationInMilliseconds, 0, 10000, 50);
+    blink::Platform::current()->histogramCustomCounts(histogramName, contextCreationDurationInMilliseconds, 0, 10000, 50);
 }
 
 bool V8WindowShell::installDOMWindow()
diff --git a/Source/bindings/v8/V8WindowShell.h b/Source/bindings/v8/V8WindowShell.h
index 44de752..f1ae57d 100644
--- a/Source/bindings/v8/V8WindowShell.h
+++ b/Source/bindings/v8/V8WindowShell.h
@@ -35,7 +35,7 @@
 #include "bindings/v8/ScopedPersistent.h"
 #include "bindings/v8/V8PerContextData.h"
 #include "bindings/v8/WrapperTypeInfo.h"
-#include "weborigin/SecurityOrigin.h"
+#include "platform/weborigin/SecurityOrigin.h"
 #include "wtf/Forward.h"
 #include "wtf/HashMap.h"
 #include "wtf/PassRefPtr.h"
diff --git a/Source/bindings/v8/V8WorkerGlobalScopeEventListener.cpp b/Source/bindings/v8/V8WorkerGlobalScopeEventListener.cpp
index 5bb0510..da79d52 100644
--- a/Source/bindings/v8/V8WorkerGlobalScopeEventListener.cpp
+++ b/Source/bindings/v8/V8WorkerGlobalScopeEventListener.cpp
@@ -91,7 +91,8 @@
         int lineNumber = 1;
         v8::ScriptOrigin origin = handlerFunction->GetScriptOrigin();
         if (!origin.ResourceName().IsEmpty()) {
-            resourceName = toWebCoreString(origin.ResourceName());
+            V8TRYCATCH_FOR_V8STRINGRESOURCE_RETURN(V8StringResource<>, stringResourceName, origin.ResourceName(), v8::Local<v8::Value>());
+            resourceName = stringResourceName;
             lineNumber = handlerFunction->GetScriptLineNumber() + 1;
         }
         cookie = InspectorInstrumentation::willCallFunction(context, resourceName, lineNumber);
diff --git a/Source/bindings/v8/WorkerScriptController.cpp b/Source/bindings/v8/WorkerScriptController.cpp
index 0eb4950..cfef767 100644
--- a/Source/bindings/v8/WorkerScriptController.cpp
+++ b/Source/bindings/v8/WorkerScriptController.cpp
@@ -33,6 +33,7 @@
 #include "bindings/v8/WorkerScriptController.h"
 
 #include "V8DedicatedWorkerGlobalScope.h"
+#include "V8ServiceWorkerGlobalScope.h"
 #include "V8SharedWorkerGlobalScope.h"
 #include "V8WorkerGlobalScope.h"
 #include "bindings/v8/ScriptSourceCode.h"
@@ -45,10 +46,10 @@
 #include "bindings/v8/WrapperTypeInfo.h"
 #include "core/inspector/ScriptCallStack.h"
 #include "core/frame/DOMTimer.h"
+#include "core/workers/SharedWorkerGlobalScope.h"
 #include "core/workers/WorkerGlobalScope.h"
 #include "core/workers/WorkerObjectProxy.h"
 #include "core/workers/WorkerThread.h"
-#include <v8-defaults.h>
 #include <v8.h>
 
 #include "public/platform/Platform.h"
@@ -63,13 +64,11 @@
     , m_executionScheduledToTerminate(false)
 {
     m_isolate->Enter();
-    v8::SetDefaultResourceConstraintsForCurrentPlatform();
+    V8Initializer::initializeWorker(m_isolate);
     v8::V8::Initialize();
     V8PerIsolateData* data = V8PerIsolateData::create(m_isolate);
     m_domDataStore = adoptPtr(new DOMDataStore(WorkerWorld));
     data->setWorkerDOMDataStore(m_domDataStore.get());
-
-    V8Initializer::initializeWorker(m_isolate);
 }
 
 WorkerScriptController::~WorkerScriptController()
@@ -79,7 +78,7 @@
     // The corresponding call to didStartWorkerRunLoop is in
     // WorkerThread::workerThread().
     // See http://webkit.org/b/83104#c14 for why this is here.
-    WebKit::Platform::current()->didStopWorkerRunLoop(WebKit::WebWorkerRunLoop(&m_workerGlobalScope.thread()->runLoop()));
+    blink::Platform::current()->didStopWorkerRunLoop(blink::WebWorkerRunLoop(&m_workerGlobalScope.thread()->runLoop()));
 
     disposeContext();
     V8PerIsolateData::dispose(m_isolate);
@@ -118,7 +117,9 @@
 
     // Create a new JS object and use it as the prototype for the shadow global object.
     const WrapperTypeInfo* contextType = &V8DedicatedWorkerGlobalScope::wrapperTypeInfo;
-    if (!m_workerGlobalScope.isDedicatedWorkerGlobalScope())
+    if (m_workerGlobalScope.isServiceWorkerGlobalScope())
+        contextType = &V8ServiceWorkerGlobalScope::wrapperTypeInfo;
+    else if (!m_workerGlobalScope.isDedicatedWorkerGlobalScope())
         contextType = &V8SharedWorkerGlobalScope::wrapperTypeInfo;
     v8::Handle<v8::Function> workerGlobalScopeConstructor = m_perContextData->constructorForType(contextType);
     v8::Local<v8::Object> jsWorkerGlobalScope = V8ObjectConstructor::newInstance(workerGlobalScopeConstructor);
diff --git a/Source/bindings/v8/WorkerScriptDebugServer.cpp b/Source/bindings/v8/WorkerScriptDebugServer.cpp
index 73a085f..9962c10 100644
--- a/Source/bindings/v8/WorkerScriptDebugServer.cpp
+++ b/Source/bindings/v8/WorkerScriptDebugServer.cpp
@@ -63,7 +63,7 @@
     ensureDebuggerScriptCompiled();
     v8::Local<v8::Object> debuggerScript = m_debuggerScript.newLocal(m_isolate);
     ASSERT(!debuggerScript->IsUndefined());
-    v8::Debug::SetDebugEventListener2(&WorkerScriptDebugServer::v8DebugEventCallback, v8::External::New(this));
+    v8::Debug::SetDebugEventListener2(&WorkerScriptDebugServer::v8DebugEventCallback, v8::External::New(m_isolate, this));
 
     v8::Handle<v8::Function> getScriptsFunction = v8::Local<v8::Function>::Cast(debuggerScript->Get(v8::String::NewSymbol("getWorkerScripts")));
     v8::Handle<v8::Value> value = V8ScriptRunner::callInternalFunction(getScriptsFunction, debuggerScript, 0, 0, m_isolate);
diff --git a/Source/bindings/v8/WrapperTypeInfo.h b/Source/bindings/v8/WrapperTypeInfo.h
index 97d1dd0..acf4cbe 100644
--- a/Source/bindings/v8/WrapperTypeInfo.h
+++ b/Source/bindings/v8/WrapperTypeInfo.h
@@ -31,6 +31,7 @@
 #ifndef WrapperTypeInfo_h
 #define WrapperTypeInfo_h
 
+#include "gin/public/wrapper_info.h"
 #include "wtf/Assertions.h"
 #include <v8.h>
 
@@ -41,9 +42,9 @@
     class EventTarget;
     class Node;
 
-    static const int v8DOMWrapperTypeIndex = 0;
-    static const int v8DOMWrapperObjectIndex = 1;
-    static const int v8DefaultWrapperInternalFieldCount = 2;
+    static const int v8DOMWrapperTypeIndex = static_cast<int>(gin::kWrapperInfoIndex);
+    static const int v8DOMWrapperObjectIndex = static_cast<int>(gin::kEncodedValueIndex);
+    static const int v8DefaultWrapperInternalFieldCount = static_cast<int>(gin::kNumberOfInternalFields);
     static const int v8PrototypeTypeIndex = 0;
     static const int v8PrototypeInternalFieldcount = 1;
 
@@ -107,10 +108,10 @@
                 derefObjectFunction(object);
         }
 
-        void installPerContextEnabledPrototypeProperties(v8::Handle<v8::Object> proto, v8::Isolate* isolate) const
+        void installPerContextEnabledMethods(v8::Handle<v8::Object> prototypeTemplate, v8::Isolate* isolate) const
         {
-            if (installPerContextEnabledPrototypePropertiesFunction)
-                installPerContextEnabledPrototypePropertiesFunction(proto, isolate);
+            if (installPerContextEnabledMethodsFunction)
+                installPerContextEnabledMethodsFunction(prototypeTemplate, isolate);
         }
 
         ActiveDOMObject* toActiveDOMObject(v8::Handle<v8::Object> object) const
@@ -127,24 +128,30 @@
             return toEventTargetFunction(object);
         }
 
-        void resolveWrapperReachability(void* object, const v8::Persistent<v8::Object>& wrapper, v8::Isolate* isolate) const
+        void visitDOMWrapper(void* object, const v8::Persistent<v8::Object>& wrapper, v8::Isolate* isolate) const
         {
-            if (!resolveWrapperReachabilityFunction)
+            if (!visitDOMWrapperFunction)
                 setObjectGroup(object, wrapper, isolate);
             else
-                resolveWrapperReachabilityFunction(object, wrapper, isolate);
+                visitDOMWrapperFunction(object, wrapper, isolate);
         }
 
+        // This field must be the first member of the struct WrapperTypeInfo. This is also checked by a COMPILE_ASSERT() below.
+        const gin::GinEmbedder ginEmbedder;
+
         const GetTemplateFunction getTemplateFunction;
         const DerefObjectFunction derefObjectFunction;
         const ToActiveDOMObjectFunction toActiveDOMObjectFunction;
         const ToEventTargetFunction toEventTargetFunction;
-        const ResolveWrapperReachabilityFunction resolveWrapperReachabilityFunction;
-        const InstallPerContextEnabledPrototypePropertiesFunction installPerContextEnabledPrototypePropertiesFunction;
+        const ResolveWrapperReachabilityFunction visitDOMWrapperFunction;
+        const InstallPerContextEnabledPrototypePropertiesFunction installPerContextEnabledMethodsFunction;
         const WrapperTypeInfo* parentClass;
         const WrapperTypePrototype wrapperTypePrototype;
     };
 
+
+    COMPILE_ASSERT(offsetof(struct WrapperTypeInfo, ginEmbedder) == offsetof(struct gin::WrapperInfo, embedder), wrapper_type_info_compatible_to_gin);
+
     template<typename T, int offset>
     inline T* getInternalField(const v8::Persistent<v8::Object>& persistent)
     {
diff --git a/Source/bindings/v8/custom/V8AlgorithmCustom.cpp b/Source/bindings/v8/custom/V8AlgorithmCustom.cpp
index 9c50137..c8c4cca 100644
--- a/Source/bindings/v8/custom/V8AlgorithmCustom.cpp
+++ b/Source/bindings/v8/custom/V8AlgorithmCustom.cpp
@@ -32,6 +32,7 @@
 #include "V8Algorithm.h"
 
 #include "V8AesCbcParams.h"
+#include "V8AesCtrParams.h"
 #include "V8AesKeyGenParams.h"
 #include "V8HmacKeyParams.h"
 #include "V8HmacParams.h"
@@ -47,22 +48,24 @@
 
     // Wrap as the more derived type.
     switch (impl->type()) {
-    case WebKit::WebCryptoAlgorithmParamsTypeNone:
+    case blink::WebCryptoAlgorithmParamsTypeNone:
         return V8Algorithm::createWrapper(impl, creationContext, isolate);
-    case WebKit::WebCryptoAlgorithmParamsTypeAesCbcParams:
+    case blink::WebCryptoAlgorithmParamsTypeAesCbcParams:
         return wrap(static_cast<AesCbcParams*>(impl), creationContext, isolate);
-    case WebKit::WebCryptoAlgorithmParamsTypeAesKeyGenParams:
+    case blink::WebCryptoAlgorithmParamsTypeAesKeyGenParams:
         return wrap(static_cast<AesKeyGenParams*>(impl), creationContext, isolate);
-    case WebKit::WebCryptoAlgorithmParamsTypeHmacParams:
+    case blink::WebCryptoAlgorithmParamsTypeHmacParams:
         return wrap(static_cast<HmacParams*>(impl), creationContext, isolate);
-    case WebKit::WebCryptoAlgorithmParamsTypeHmacKeyParams:
+    case blink::WebCryptoAlgorithmParamsTypeHmacKeyParams:
         return wrap(static_cast<HmacKeyParams*>(impl), creationContext, isolate);
-    case WebKit::WebCryptoAlgorithmParamsTypeRsaSsaParams:
+    case blink::WebCryptoAlgorithmParamsTypeRsaSsaParams:
         return wrap(static_cast<RsaSsaParams*>(impl), creationContext, isolate);
-    case WebKit::WebCryptoAlgorithmParamsTypeRsaKeyGenParams:
+    case blink::WebCryptoAlgorithmParamsTypeRsaKeyGenParams:
         return wrap(static_cast<RsaKeyGenParams*>(impl), creationContext, isolate);
-    case WebKit::WebCryptoAlgorithmParamsTypeAesGcmParams:
-    case WebKit::WebCryptoAlgorithmParamsTypeRsaOaepParams:
+    case blink::WebCryptoAlgorithmParamsTypeAesCtrParams:
+        return wrap(static_cast<AesCtrParams*>(impl), creationContext, isolate);
+    case blink::WebCryptoAlgorithmParamsTypeAesGcmParams:
+    case blink::WebCryptoAlgorithmParamsTypeRsaOaepParams:
         // TODO
         notImplemented();
         break;
diff --git a/Source/bindings/v8/custom/V8ArrayBufferCustom.cpp b/Source/bindings/v8/custom/V8ArrayBufferCustom.cpp
index c37ed6a..25d8e7d 100644
--- a/Source/bindings/v8/custom/V8ArrayBufferCustom.cpp
+++ b/Source/bindings/v8/custom/V8ArrayBufferCustom.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "bindings/v8/custom/V8ArrayBufferCustom.h"
 
+#include "bindings/v8/ScriptPromiseResolver.h"
 #include "bindings/v8/V8Binding.h"
 #include "wtf/ArrayBuffer.h"
 #include "wtf/StdLibExtras.h"
@@ -39,23 +40,24 @@
 
 using namespace WTF;
 
-V8ArrayBufferDeallocationObserver* V8ArrayBufferDeallocationObserver::instance()
+V8ArrayBufferDeallocationObserver* V8ArrayBufferDeallocationObserver::instanceTemplate()
 {
     DEFINE_STATIC_LOCAL(V8ArrayBufferDeallocationObserver, deallocationObserver, ());
     return &deallocationObserver;
 }
 
 const WrapperTypeInfo V8ArrayBuffer::wrapperTypeInfo = {
+    gin::kEmbedderBlink,
     0, V8ArrayBuffer::derefObject,
     0, 0, 0, 0, 0, WrapperTypeObjectPrototype
 };
 
-bool V8ArrayBuffer::HasInstance(v8::Handle<v8::Value> value, v8::Isolate*, WrapperWorldType)
+bool V8ArrayBuffer::hasInstance(v8::Handle<v8::Value> value, v8::Isolate*, WrapperWorldType)
 {
     return value->IsArrayBuffer();
 }
 
-bool V8ArrayBuffer::HasInstanceInAnyWorld(v8::Handle<v8::Value> value, v8::Isolate*)
+bool V8ArrayBuffer::hasInstanceInAnyWorld(v8::Handle<v8::Value> value, v8::Isolate*)
 {
     return value->IsArrayBuffer();
 }
@@ -71,7 +73,7 @@
     ASSERT(!DOMDataStore::containsWrapper<V8ArrayBuffer>(impl.get(), isolate));
 
     v8::Handle<v8::Object> wrapper = v8::ArrayBuffer::New(impl->data(), impl->byteLength());
-    impl->setDeallocationObserver(V8ArrayBufferDeallocationObserver::instance());
+    impl->setDeallocationObserver(V8ArrayBufferDeallocationObserver::instanceTemplate());
 
     V8DOMWrapper::associateObjectWithWrapper<V8ArrayBuffer>(impl, &wrapperTypeInfo, wrapper, isolate, WrapperConfiguration::Independent);
     return wrapper;
@@ -89,7 +91,7 @@
 
     v8::ArrayBuffer::Contents v8Contents = v8buffer->Externalize();
     ArrayBufferContents contents(v8Contents.Data(), v8Contents.ByteLength(),
-        V8ArrayBufferDeallocationObserver::instance());
+        V8ArrayBufferDeallocationObserver::instanceTemplate());
     RefPtr<ArrayBuffer> buffer = ArrayBuffer::create(contents);
     V8DOMWrapper::associateObjectWithWrapper<V8ArrayBuffer>(buffer.release(), &wrapperTypeInfo, object, v8::Isolate::GetCurrent(), WrapperConfiguration::Dependent);
 
@@ -98,4 +100,10 @@
     return reinterpret_cast<ArrayBuffer*>(arraybufferPtr);
 }
 
+template<>
+v8::Handle<v8::Value> toV8NoInline(ArrayBuffer* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
+{
+    return toV8(impl, creationContext, isolate);
+}
+
 } // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8ArrayBufferCustom.h b/Source/bindings/v8/custom/V8ArrayBufferCustom.h
index 8185809..085a844 100644
--- a/Source/bindings/v8/custom/V8ArrayBufferCustom.h
+++ b/Source/bindings/v8/custom/V8ArrayBufferCustom.h
@@ -40,7 +40,7 @@
     {
         v8::V8::AdjustAmountOfExternalAllocatedMemory(-static_cast<int>(sizeInBytes));
     }
-    static V8ArrayBufferDeallocationObserver* instance();
+    static V8ArrayBufferDeallocationObserver* instanceTemplate();
 
 protected:
     virtual void blinkAllocatedMemory(unsigned sizeInBytes) OVERRIDE
@@ -51,14 +51,14 @@
 
 class V8ArrayBuffer {
 public:
-    static bool HasInstance(v8::Handle<v8::Value>, v8::Isolate*, WrapperWorldType);
-    static bool HasInstanceInAnyWorld(v8::Handle<v8::Value>, v8::Isolate*);
+    static bool hasInstance(v8::Handle<v8::Value>, v8::Isolate*, WrapperWorldType);
+    static bool hasInstanceInAnyWorld(v8::Handle<v8::Value>, v8::Isolate*);
     static ArrayBuffer* toNative(v8::Handle<v8::Object>);
     static void derefObject(void*);
     static const WrapperTypeInfo wrapperTypeInfo;
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount;
     static void installPerContextEnabledProperties(v8::Handle<v8::Object>, ArrayBuffer*, v8::Isolate*) { }
-    static void installPerContextEnabledPrototypeProperties(v8::Handle<v8::Object>, v8::Isolate*) { }
+    static void installPerContextEnabledMethods(v8::Handle<v8::Object>, v8::Isolate*) { }
 
     static inline void* toInternalPointer(ArrayBuffer* impl)
     {
diff --git a/Source/bindings/v8/custom/V8ArrayBufferViewCustom.h b/Source/bindings/v8/custom/V8ArrayBufferViewCustom.h
index 95c87cc..94fcd13 100644
--- a/Source/bindings/v8/custom/V8ArrayBufferViewCustom.h
+++ b/Source/bindings/v8/custom/V8ArrayBufferViewCustom.h
@@ -43,11 +43,11 @@
 
 class V8ArrayBufferView {
 public:
-    static bool HasInstance(v8::Handle<v8::Value> value, v8::Isolate*, WrapperWorldType)
+    static bool hasInstance(v8::Handle<v8::Value> value, v8::Isolate*, WrapperWorldType)
     {
         return value->IsArrayBufferView();
     }
-    static bool HasInstanceInAnyWorld(v8::Handle<v8::Value> value, v8::Isolate*)
+    static bool hasInstanceInAnyWorld(v8::Handle<v8::Value> value, v8::Isolate*)
     {
         return value->IsArrayBufferView();
     }
diff --git a/Source/bindings/v8/custom/V8BlobCustom.cpp b/Source/bindings/v8/custom/V8BlobCustom.cpp
index d514a4e..be506f8 100644
--- a/Source/bindings/v8/custom/V8BlobCustom.cpp
+++ b/Source/bindings/v8/custom/V8BlobCustom.cpp
@@ -31,13 +31,8 @@
 #include "config.h"
 #include "V8Blob.h"
 
-#include "bindings/v8/Dictionary.h"
-#include "bindings/v8/V8Binding.h"
-#include "bindings/v8/V8Utilities.h"
-#include "bindings/v8/custom/V8ArrayBufferCustom.h"
-#include "bindings/v8/custom/V8ArrayBufferViewCustom.h"
+#include "bindings/v8/custom/V8BlobCustomHelpers.h"
 #include "core/fileapi/BlobBuilder.h"
-#include "wtf/RefPtr.h"
 
 namespace WebCore {
 
@@ -45,74 +40,40 @@
 {
     if (!info.Length()) {
         RefPtr<Blob> blob = Blob::create();
-        info.GetReturnValue().Set(toV8(blob.get(), info.Holder(), info.GetIsolate()));
+        v8SetReturnValue(info, blob.release());
         return;
     }
 
-    v8::Local<v8::Value> firstArg = info[0];
-    if (!firstArg->IsArray()) {
-        throwTypeError("First argument of the constructor is not of type Array", info.GetIsolate());
-        return;
+    uint32_t length = 0;
+    if (info[0]->IsArray()) {
+        length = v8::Local<v8::Array>::Cast(info[0])->Length();
+    } else {
+        const int sequenceArgumentIndex = 0;
+        if (toV8Sequence(info[sequenceArgumentIndex], length, info.GetIsolate()).IsEmpty()) {
+            throwTypeError(ExceptionMessages::failedToConstruct("Blob", ExceptionMessages::notAnArrayTypeArgumentOrValue(sequenceArgumentIndex + 1)), info.GetIsolate());
+            return;
+        }
     }
 
-    String type;
-    String endings = "transparent";
-
+    String contentType;
+    String endings = "transparent"; // default if no BlobPropertyBag is passed
     if (info.Length() > 1) {
         if (!info[1]->IsObject()) {
-            throwTypeError("Second argument of the constructor is not of type Object", info.GetIsolate());
+            throwTypeError(ExceptionMessages::failedToConstruct("Blob", "The 2nd argument is not of type Object."), info.GetIsolate());
             return;
         }
 
-        V8TRYCATCH_VOID(Dictionary, dictionary, Dictionary(info[1], info.GetIsolate()));
-
-        V8TRYCATCH_VOID(bool, containsEndings, dictionary.get("endings", endings));
-        if (containsEndings) {
-            if (endings != "transparent" && endings != "native") {
-                throwTypeError("The endings property must be either \"transparent\" or \"native\"", info.GetIsolate());
-                return;
-            }
-        }
-
-        V8TRYCATCH_VOID(bool, containsType, dictionary.get("type", type));
-        UNUSED_PARAM(containsType);
-        if (!type.containsOnlyASCII()) {
-            throwError(v8SyntaxError, "type must consist of ASCII characters", info.GetIsolate());
+        if (!V8BlobCustomHelpers::processBlobPropertyBag(info[1], "Blob", contentType, endings, info.GetIsolate()))
             return;
-        }
-        type = type.lower();
     }
 
-    ASSERT(endings == "transparent" || endings == "native");
-
     BlobBuilder blobBuilder;
+    v8::Local<v8::Object> blobParts = v8::Local<v8::Object>::Cast(info[0]);
+    if (!V8BlobCustomHelpers::processBlobParts(blobParts, length, endings, blobBuilder, info.GetIsolate()))
+        return;
 
-    V8TRYCATCH_VOID(v8::Local<v8::Array>, blobParts, v8::Local<v8::Array>::Cast(firstArg));
-    uint32_t length = blobParts->Length();
-
-    for (uint32_t i = 0; i < length; ++i) {
-        v8::Local<v8::Value> item = blobParts->Get(v8::Uint32::New(i, info.GetIsolate()));
-        ASSERT(!item.IsEmpty());
-        if (V8ArrayBuffer::HasInstance(item, info.GetIsolate(), worldType(info.GetIsolate()))) {
-            ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(item));
-            ASSERT(arrayBuffer);
-            blobBuilder.append(arrayBuffer);
-        } else if (V8ArrayBufferView::HasInstance(item, info.GetIsolate(), worldType(info.GetIsolate()))) {
-            ArrayBufferView* arrayBufferView = V8ArrayBufferView::toNative(v8::Handle<v8::Object>::Cast(item));
-            ASSERT(arrayBufferView);
-            blobBuilder.append(arrayBufferView);
-        } else if (V8Blob::HasInstance(item, info.GetIsolate(), worldType(info.GetIsolate()))) {
-            Blob* blob = V8Blob::toNative(v8::Handle<v8::Object>::Cast(item));
-            ASSERT(blob);
-            blobBuilder.append(blob);
-        } else {
-            V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, stringValue, item);
-            blobBuilder.append(stringValue, endings);
-        }
-    }
-
-    RefPtr<Blob> blob = blobBuilder.getBlob(type);
-    info.GetReturnValue().Set(toV8(blob.get(), info.Holder(), info.GetIsolate()));
+    RefPtr<Blob> blob = blobBuilder.createBlob(contentType);
+    v8SetReturnValue(info, blob.release());
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8BlobCustomHelpers.cpp b/Source/bindings/v8/custom/V8BlobCustomHelpers.cpp
new file mode 100644
index 0000000..ee35937
--- /dev/null
+++ b/Source/bindings/v8/custom/V8BlobCustomHelpers.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8BlobCustomHelpers.h"
+
+#include "V8Blob.h"
+#include "bindings/v8/Dictionary.h"
+#include "bindings/v8/V8Binding.h"
+#include "bindings/v8/V8Utilities.h"
+#include "bindings/v8/custom/V8ArrayBufferCustom.h"
+#include "bindings/v8/custom/V8ArrayBufferViewCustom.h"
+#include "core/fileapi/BlobBuilder.h"
+
+namespace WebCore {
+
+namespace V8BlobCustomHelpers {
+
+bool processBlobPropertyBag(v8::Local<v8::Value> propertyBag, const char* blobClassName, String& contentType, String& endings, v8::Isolate* isolate)
+{
+    ASSERT(endings == "transparent");
+
+    V8TRYCATCH_RETURN(Dictionary, dictionary, Dictionary(propertyBag, isolate), false);
+
+    V8TRYCATCH_RETURN(bool, containsEndings, dictionary.get("endings", endings), false);
+    if (containsEndings) {
+        if (endings != "transparent" && endings != "native") {
+            throwTypeError(ExceptionMessages::failedToConstruct(blobClassName, "The \"endings\" property must be either \"transparent\" or \"native\"."), isolate);
+            return false;
+        }
+    }
+
+    V8TRYCATCH_RETURN(bool, containsType, dictionary.get("type", contentType), false);
+    if (containsType) {
+        if (!contentType.containsOnlyASCII()) {
+            throwError(v8SyntaxError, ExceptionMessages::failedToConstruct(blobClassName, "The \"type\" property must consist of ASCII characters."), isolate);
+            return false;
+        }
+        contentType = contentType.lower();
+    }
+    return true;
+}
+
+bool processBlobParts(v8::Local<v8::Object> blobParts, uint32_t blobPartsLength, const String& endings, BlobBuilder& blobBuilder, v8::Isolate* isolate)
+{
+    ASSERT(endings == "transparent" || endings == "native");
+
+    for (uint32_t i = 0; i < blobPartsLength; ++i) {
+        v8::Local<v8::Value> item = blobParts->Get(v8::Uint32::New(i, isolate));
+        if (item.IsEmpty())
+            return false;
+
+        if (V8ArrayBuffer::hasInstance(item, isolate, worldType(isolate))) {
+            ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(item));
+            ASSERT(arrayBuffer);
+            blobBuilder.append(arrayBuffer);
+        } else if (V8ArrayBufferView::hasInstance(item, isolate, worldType(isolate))) {
+            ArrayBufferView* arrayBufferView = V8ArrayBufferView::toNative(v8::Handle<v8::Object>::Cast(item));
+            ASSERT(arrayBufferView);
+            blobBuilder.append(arrayBufferView);
+        } else if (V8Blob::hasInstance(item, isolate, worldType(isolate))) {
+            Blob* blob = V8Blob::toNative(v8::Handle<v8::Object>::Cast(item));
+            ASSERT(blob);
+            blobBuilder.append(blob);
+        } else {
+            V8TRYCATCH_FOR_V8STRINGRESOURCE_RETURN(V8StringResource<>, stringValue, item, false);
+            blobBuilder.append(stringValue, endings);
+        }
+    }
+    return true;
+}
+
+} // namespace V8BlobCustomHelpers
+
+} // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8BlobCustomHelpers.h b/Source/bindings/v8/custom/V8BlobCustomHelpers.h
new file mode 100644
index 0000000..8bb22f0
--- /dev/null
+++ b/Source/bindings/v8/custom/V8BlobCustomHelpers.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8BlobCustomHelpers_h
+#define V8BlobCustomHelpers_h
+
+#include "bindings/v8/V8Binding.h"
+
+namespace WebCore {
+
+class BlobBuilder;
+
+// Shared code between the custom constructor bindings for Blob and File.
+namespace V8BlobCustomHelpers {
+
+// Extracts the "type" and "endings" properties out of the BlobPropertyBag passed to a Blob constructor.
+// http://www.w3.org/TR/FileAPI/#constructorParams
+// Returns true if everything went well, false if a JS exception was thrown.
+bool processBlobPropertyBag(v8::Local<v8::Value> propertyBag, const char* blobClassName, String& contentType, String& endings, v8::Isolate*);
+
+// Appends the blobParts passed to a Blob constructor into a BlobBuilder.
+// http://www.w3.org/TR/FileAPI/#constructorParams
+// Returns true if everything went well, false if a JS exception was thrown.
+bool processBlobParts(v8::Local<v8::Object> blobParts, uint32_t blobPartsLength, const String& endings, BlobBuilder&, v8::Isolate*);
+
+} // namespace V8BlobCustomHelpers
+
+} // namespace WebCore
+
+#endif // V8BlobCustomHelpers_h
diff --git a/Source/bindings/v8/custom/V8CSSRuleCustom.cpp b/Source/bindings/v8/custom/V8CSSRuleCustom.cpp
index e5d320e..a5d3704 100644
--- a/Source/bindings/v8/custom/V8CSSRuleCustom.cpp
+++ b/Source/bindings/v8/custom/V8CSSRuleCustom.cpp
@@ -33,7 +33,6 @@
 
 #include "V8CSSCharsetRule.h"
 #include "V8CSSFontFaceRule.h"
-#include "V8CSSHostRule.h"
 #include "V8CSSImportRule.h"
 #include "V8CSSKeyframeRule.h"
 #include "V8CSSKeyframesRule.h"
@@ -78,8 +77,6 @@
         return wrap(static_cast<CSSViewportRule*>(impl), creationContext, isolate);
     case CSSRule::WEBKIT_REGION_RULE:
         return wrap(static_cast<CSSRegionRule*>(impl), creationContext, isolate);
-    case CSSRule::HOST_RULE:
-        return wrap(static_cast<CSSHostRule*>(impl), creationContext, isolate);
     case CSSRule::WEBKIT_FILTER_RULE:
         return wrap(static_cast<CSSFilterRule*>(impl), creationContext, isolate);
     }
diff --git a/Source/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp b/Source/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
index 6f01b92..e72279d 100644
--- a/Source/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
+++ b/Source/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
@@ -53,8 +53,6 @@
 
 namespace WebCore {
 
-// FIXME: Next two functions look lifted verbatim from JSCSSStyleDeclarationCustom. Please remove duplication.
-
 // Check for a CSS prefix.
 // Passed prefix is all lowercase.
 // First character of the prefix within the property name may be upper or lowercase.
@@ -230,12 +228,11 @@
     if (!propInfo)
         return;
 
-    String propertyValue = toWebCoreStringWithNullCheck(value);
+    V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithNullCheck>, propertyValue, value);
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    imp->setPropertyInternal(static_cast<CSSPropertyID>(propInfo->propID), propertyValue, false, exceptionState);
 
-    ExceptionState es(info.GetIsolate());
-    imp->setPropertyInternal(static_cast<CSSPropertyID>(propInfo->propID), propertyValue, false, es);
-
-    if (es.throwIfNeeded())
+    if (exceptionState.throwIfNeeded())
         return;
 
     v8SetReturnValue(info, value);
diff --git a/Source/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp b/Source/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
index e644946..c52843a 100644
--- a/Source/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
+++ b/Source/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
@@ -59,10 +59,10 @@
 
 static PassRefPtr<CanvasStyle> toCanvasStyle(v8::Handle<v8::Value> value, v8::Isolate* isolate)
 {
-    if (V8CanvasGradient::HasInstance(value, isolate, worldType(isolate)))
+    if (V8CanvasGradient::hasInstance(value, isolate, worldType(isolate)))
         return CanvasStyle::createFromGradient(V8CanvasGradient::toNative(v8::Handle<v8::Object>::Cast(value)));
 
-    if (V8CanvasPattern::HasInstance(value, isolate, worldType(isolate)))
+    if (V8CanvasPattern::hasInstance(value, isolate, worldType(isolate)))
         return CanvasStyle::createFromPattern(V8CanvasPattern::toNative(v8::Handle<v8::Object>::Cast(value)));
 
     return 0;
diff --git a/Source/bindings/v8/custom/V8CryptoCustom.cpp b/Source/bindings/v8/custom/V8CryptoCustom.cpp
index 9ad21c0..a515a77 100644
--- a/Source/bindings/v8/custom/V8CryptoCustom.cpp
+++ b/Source/bindings/v8/custom/V8CryptoCustom.cpp
@@ -47,7 +47,7 @@
     }
 
     v8::Handle<v8::Value> buffer = info[0];
-    if (!V8ArrayBufferView::HasInstance(buffer, info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (!V8ArrayBufferView::hasInstance(buffer, info.GetIsolate(), worldType(info.GetIsolate()))) {
         throwTypeError("First argument is not an ArrayBufferView", info.GetIsolate());
         return;
     }
@@ -55,10 +55,10 @@
     ArrayBufferView* arrayBufferView = V8ArrayBufferView::toNative(v8::Handle<v8::Object>::Cast(buffer));
     ASSERT(arrayBufferView);
 
-    ExceptionState es(info.GetIsolate());
-    Crypto::getRandomValues(arrayBufferView, es);
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    Crypto::getRandomValues(arrayBufferView, exceptionState);
 
-    if (es.throwIfNeeded())
+    if (exceptionState.throwIfNeeded())
         return;
 
     v8SetReturnValue(info, buffer);
diff --git a/Source/bindings/v8/custom/V8DedicatedWorkerGlobalScopeCustom.cpp b/Source/bindings/v8/custom/V8DedicatedWorkerGlobalScopeCustom.cpp
index 35964aa..a356f03 100644
--- a/Source/bindings/v8/custom/V8DedicatedWorkerGlobalScopeCustom.cpp
+++ b/Source/bindings/v8/custom/V8DedicatedWorkerGlobalScopeCustom.cpp
@@ -33,6 +33,7 @@
 
 #include "bindings/v8/ExceptionMessages.h"
 #include "bindings/v8/ExceptionState.h"
+#include "bindings/v8/SerializedScriptValue.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8Utilities.h"
 #include "bindings/v8/V8WorkerGlobalScopeEventListener.h"
@@ -59,9 +60,9 @@
     RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(info[0], &ports, &arrayBuffers, didThrow, info.GetIsolate());
     if (didThrow)
         return;
-    ExceptionState es(info.GetIsolate());
-    workerGlobalScope->postMessage(message.release(), &ports, es);
-    es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    workerGlobalScope->postMessage(message.release(), &ports, exceptionState);
+    exceptionState.throwIfNeeded();
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8DocumentCustom.cpp b/Source/bindings/v8/custom/V8DocumentCustom.cpp
index d3da93e..1cb3282 100644
--- a/Source/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/Source/bindings/v8/custom/V8DocumentCustom.cpp
@@ -60,10 +60,10 @@
 void V8Document::evaluateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     RefPtr<Document> document = V8Document::toNative(info.Holder());
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, expression, info[0]);
     RefPtr<Node> contextNode;
-    if (V8Node::HasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate())))
+    if (V8Node::hasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate())))
         contextNode = V8Node::toNative(v8::Handle<v8::Object>::Cast(info[1]));
 
     RefPtr<XPathNSResolver> resolver = toXPathNSResolver(info[2], info.GetIsolate());
@@ -74,11 +74,11 @@
 
     int type = toInt32(info[3]);
     RefPtr<XPathResult> inResult;
-    if (V8XPathResult::HasInstance(info[4], info.GetIsolate(), worldType(info.GetIsolate())))
+    if (V8XPathResult::hasInstance(info[4], info.GetIsolate(), worldType(info.GetIsolate())))
         inResult = V8XPathResult::toNative(v8::Handle<v8::Object>::Cast(info[4]));
 
-    V8TRYCATCH_VOID(RefPtr<XPathResult>, result, DocumentXPathEvaluator::evaluate(document.get(), expression, contextNode.get(), resolver.get(), type, inResult.get(), es));
-    if (es.throwIfNeeded())
+    V8TRYCATCH_VOID(RefPtr<XPathResult>, result, DocumentXPathEvaluator::evaluate(document.get(), expression, contextNode.get(), resolver.release(), type, inResult.get(), exceptionState));
+    if (exceptionState.throwIfNeeded())
         return;
 
     v8SetReturnValueFast(info, result.release(), document.get());
diff --git a/Source/bindings/v8/custom/V8FileCustom.cpp b/Source/bindings/v8/custom/V8FileCustom.cpp
new file mode 100644
index 0000000..6983ef2
--- /dev/null
+++ b/Source/bindings/v8/custom/V8FileCustom.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8File.h"
+
+#include "RuntimeEnabledFeatures.h"
+#include "bindings/v8/custom/V8BlobCustomHelpers.h"
+#include "core/fileapi/BlobBuilder.h"
+
+namespace WebCore {
+
+void V8File::constructorCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
+{
+    if (!RuntimeEnabledFeatures::fileConstructorEnabled()) {
+        throwTypeError("Illegal constructor", info.GetIsolate());
+        return;
+    }
+
+    if (info.Length() < 2) {
+        throwTypeError("File constructor requires at least two arguments", info.GetIsolate());
+        return;
+    }
+
+    uint32_t length = 0;
+    if (info[0]->IsArray()) {
+        length = v8::Local<v8::Array>::Cast(info[0])->Length();
+    } else {
+        const int sequenceArgumentIndex = 0;
+        if (toV8Sequence(info[sequenceArgumentIndex], length, info.GetIsolate()).IsEmpty()) {
+            throwTypeError(ExceptionMessages::failedToConstruct("File", ExceptionMessages::notAnArrayTypeArgumentOrValue(sequenceArgumentIndex + 1)), info.GetIsolate());
+            return;
+        }
+    }
+
+    V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, fileName, info[1]);
+
+    String contentType;
+    String endings = "transparent"; // default if no BlobPropertyBag is passed
+    if (info.Length() > 2) {
+        if (!info[2]->IsObject()) {
+            throwTypeError(ExceptionMessages::failedToConstruct("File", "The 3rd argument is not of type Object."), info.GetIsolate());
+            return;
+        }
+
+        if (!V8BlobCustomHelpers::processBlobPropertyBag(info[2], "File", contentType, endings, info.GetIsolate()))
+            return;
+    }
+
+    BlobBuilder blobBuilder;
+    v8::Local<v8::Object> blobParts = v8::Local<v8::Object>::Cast(info[0]);
+    if (!V8BlobCustomHelpers::processBlobParts(blobParts, length, endings, blobBuilder, info.GetIsolate()))
+        return;
+
+    RefPtr<File> file = blobBuilder.createFile(contentType, fileName, currentTime());
+    v8SetReturnValue(info, file.release());
+}
+
+} // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8FormDataCustom.cpp b/Source/bindings/v8/custom/V8FormDataCustom.cpp
index 2e15f1e..890bf03 100644
--- a/Source/bindings/v8/custom/V8FormDataCustom.cpp
+++ b/Source/bindings/v8/custom/V8FormDataCustom.cpp
@@ -39,18 +39,6 @@
 
 namespace WebCore {
 
-void V8FormData::constructorCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
-{
-    HTMLFormElement* form = 0;
-    if (info.Length() > 0 && V8HTMLFormElement::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())))
-        form = V8HTMLFormElement::toNative(info[0]->ToObject());
-    RefPtr<DOMFormData> domFormData = DOMFormData::create(form);
-
-    v8::Handle<v8::Object> wrapper = info.Holder();
-    V8DOMWrapper::associateObjectWithWrapper<V8FormData>(domFormData.release(), &wrapperTypeInfo, wrapper, info.GetIsolate(), WrapperConfiguration::Dependent);
-    info.GetReturnValue().Set(wrapper);
-}
-
 void V8FormData::appendMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     if (info.Length() < 2) {
@@ -59,22 +47,25 @@
     }
 
     DOMFormData* domFormData = V8FormData::toNative(info.Holder());
-
-    String name = toWebCoreStringWithNullCheck(info[0]);
+    V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithNullCheck>, name, info[0]);
 
     v8::Handle<v8::Value> arg = info[1];
-    if (V8Blob::HasInstance(arg, info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (V8Blob::hasInstance(arg, info.GetIsolate(), worldType(info.GetIsolate()))) {
         v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
         Blob* blob = V8Blob::toNative(object);
         ASSERT(blob);
 
         String filename;
-        if (info.Length() >= 3 && !info[2]->IsUndefined())
-            filename = toWebCoreStringWithNullCheck(info[2]);
+        if (info.Length() >= 3) {
+            V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithUndefinedOrNullCheck>, filenameResource, info[2]);
+            filename = filenameResource;
+        }
 
         domFormData->append(name, blob, filename);
-    } else
-        domFormData->append(name, toWebCoreStringWithNullCheck(arg));
+    } else {
+        V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithNullCheck>, argString, arg);
+        domFormData->append(name, argString);
+    }
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp b/Source/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
index 9ce1539..670b36c 100644
--- a/Source/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
+++ b/Source/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
@@ -36,7 +36,7 @@
 #include "bindings/v8/V8Binding.h"
 #include "core/dom/NamedNodesCollection.h"
 #include "core/html/HTMLAllCollection.h"
-#include "core/page/UseCounter.h"
+#include "core/frame/UseCounter.h"
 
 namespace WebCore {
 
diff --git a/Source/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/Source/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index 0f791db..c524aca 100644
--- a/Source/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/Source/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -36,6 +36,7 @@
 #include "V8Node.h"
 #include "V8WebGLRenderingContext.h"
 #include "bindings/v8/ExceptionState.h"
+#include "bindings/v8/ScriptState.h"
 #include "bindings/v8/V8Binding.h"
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/canvas/Canvas2DContextAttributes.h"
@@ -76,6 +77,9 @@
             v8::Handle<v8::String> preserveDrawingBuffer = v8::String::NewSymbol("preserveDrawingBuffer");
             if (jsAttributes->Has(preserveDrawingBuffer))
                 webGLAttributes->setPreserveDrawingBuffer(jsAttributes->Get(preserveDrawingBuffer)->BooleanValue());
+            v8::Handle<v8::String> failIfMajorPerformanceCaveat = v8::String::NewSymbol("failIfMajorPerformanceCaveat");
+            if (jsAttributes->Has(failIfMajorPerformanceCaveat))
+                webGLAttributes->setFailIfMajorPerformanceCaveat(jsAttributes->Get(failIfMajorPerformanceCaveat)->BooleanValue());
         }
         attributes = webGLAttributes;
     } else {
@@ -129,7 +133,7 @@
 {
     v8::Handle<v8::Object> holder = info.Holder();
     HTMLCanvasElement* canvas = V8HTMLCanvasElement::toNative(holder);
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
 
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, type, info[0]);
     double quality;
@@ -139,8 +143,8 @@
         qualityPtr = &quality;
     }
 
-    String result = canvas->toDataURL(type, qualityPtr, es);
-    es.throwIfNeeded();
+    String result = canvas->toDataURL(type, qualityPtr, exceptionState);
+    exceptionState.throwIfNeeded();
     v8SetReturnValueStringOrUndefined(info, result, info.GetIsolate());
 }
 
diff --git a/Source/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/Source/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index 124a4f5..5674fcb 100644
--- a/Source/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/Source/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -46,38 +46,11 @@
 #include "wtf/OwnPtr.h"
 #include "wtf/RefPtr.h"
 #include "wtf/StdLibExtras.h"
-#include "wtf/text/StringBuilder.h"
 
 namespace WebCore {
 
 // HTMLDocument ----------------------------------------------------------------
 
-// Concatenates "info" to a string. If info is empty, returns empty string.
-// Firefox/Safari/IE support non-standard arguments to document.write, ex:
-//   document.write("a", "b", "c") --> document.write("abc")
-//   document.write() --> document.write("")
-static String writeHelperGetString(const v8::FunctionCallbackInfo<v8::Value>& info)
-{
-    StringBuilder builder;
-    for (int i = 0; i < info.Length(); ++i) {
-        V8TRYCATCH_FOR_V8STRINGRESOURCE_RETURN(V8StringResource<>, stringArgument, info[i], String());
-        builder.append(stringArgument);
-    }
-    return builder.toString();
-}
-
-void V8HTMLDocument::writeMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
-{
-    HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder());
-    htmlDocument->write(writeHelperGetString(info), activeDOMWindow()->document());
-}
-
-void V8HTMLDocument::writelnMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
-{
-    HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder());
-    htmlDocument->writeln(writeHelperGetString(info), activeDOMWindow()->document());
-}
-
 void V8HTMLDocument::openMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder());
diff --git a/Source/bindings/v8/custom/V8HTMLFrameElementCustom.cpp b/Source/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
index 7acc533..8c011d0 100644
--- a/Source/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
+++ b/Source/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
@@ -45,11 +45,11 @@
 void V8HTMLFrameElement::locationAttributeSetterCustom(v8::Local<v8::Value> value, const v8::PropertyCallbackInfo<void>& info)
 {
     HTMLFrameElement* frame = V8HTMLFrameElement::toNative(info.Holder());
-    String locationValue = toWebCoreStringWithNullCheck(value);
+    V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithNullCheck>, locationValue, value);
 
-    ExceptionState es(info.GetIsolate());
-    if (protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(locationValue)) && !BindingSecurity::shouldAllowAccessToFrame(frame->contentFrame(), es)) {
-        es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    if (protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(locationValue)) && !BindingSecurity::shouldAllowAccessToFrame(frame->contentFrame(), exceptionState)) {
+        exceptionState.throwIfNeeded();
         return;
     }
 
diff --git a/Source/bindings/v8/custom/V8HTMLMediaElementCustom.cpp b/Source/bindings/v8/custom/V8HTMLMediaElementCustom.cpp
deleted file mode 100644
index fe6d6c3..0000000
--- a/Source/bindings/v8/custom/V8HTMLMediaElementCustom.cpp
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright (C) 2011 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "V8HTMLMediaElement.h"
-
-#include "V8MediaController.h"
-
-namespace WebCore {
-
-void V8HTMLMediaElement::controllerAttributeSetterCustom(v8::Local<v8::Value> value, const v8::PropertyCallbackInfo<void>& info)
-{
-    MediaController* controller = 0;
-    if (!value->IsNull()) {
-        if (!V8MediaController::HasInstance(value, info.GetIsolate(), worldType(info.GetIsolate()))) {
-            throwTypeError("Value is not of type MediaController", info.GetIsolate());
-            return;
-        }
-        controller = V8MediaController::toNative(value->ToObject());
-    }
-
-    // 4.8.10.11.2 Media controllers: controller attribute.
-    // On setting, it must first remove the element's mediagroup attribute, if any,
-    HTMLMediaElement* imp = V8HTMLMediaElement::toNative(info.Holder());
-    imp->setMediaGroup(String());
-    // and then set the current media controller to the given value.
-    imp->setController(controller);
-}
-
-}
diff --git a/Source/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp b/Source/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
index 25e85aa..e0523d7 100644
--- a/Source/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
+++ b/Source/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
@@ -73,26 +73,26 @@
 
 void V8HTMLOptionsCollection::addMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
-    if (!V8HTMLOptionElement::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (!V8HTMLOptionElement::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
         setDOMException(TypeMismatchError, info.GetIsolate());
         return;
     }
     HTMLOptionsCollection* imp = V8HTMLOptionsCollection::toNative(info.Holder());
     HTMLOptionElement* option = V8HTMLOptionElement::toNative(v8::Handle<v8::Object>(v8::Handle<v8::Object>::Cast(info[0])));
 
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     if (info.Length() < 2)
-        imp->add(option, es);
+        imp->add(option, exceptionState);
     else {
         bool ok;
         V8TRYCATCH_VOID(int, index, toInt32(info[1], ok));
         if (!ok)
-            es.throwDOMException(TypeMismatchError, ExceptionMessages::failedToExecute("add", "HTMLOptionsCollection", "The index provided could not be interpreted as an integer."));
+            exceptionState.throwDOMException(TypeMismatchError, ExceptionMessages::failedToExecute("add", "HTMLOptionsCollection", "The index provided could not be interpreted as an integer."));
         else
-            imp->add(option, index, es);
+            imp->add(option, index, exceptionState);
     }
 
-    es.throwIfNeeded();
+    exceptionState.throwIfNeeded();
 }
 
 void V8HTMLOptionsCollection::lengthAttributeSetterCustom(v8::Local<v8::Value> value, const v8::PropertyCallbackInfo<void>& info)
@@ -100,20 +100,20 @@
     HTMLOptionsCollection* imp = V8HTMLOptionsCollection::toNative(info.Holder());
     double v = value->NumberValue();
     unsigned newLength = 0;
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     if (!std::isnan(v) && !std::isinf(v)) {
         if (v < 0.0)
-            es.throwDOMException(IndexSizeError, ExceptionMessages::failedToSet("length", "HTMLOptionsCollection", "The value provided (" + String::number(v) + ") is negative. Lengths must be greater than or equal to 0."));
+            exceptionState.throwDOMException(IndexSizeError, ExceptionMessages::failedToSet("length", "HTMLOptionsCollection", "The value provided (" + String::number(v) + ") is negative. Lengths must be greater than or equal to 0."));
         else if (v > static_cast<double>(UINT_MAX))
             newLength = UINT_MAX;
         else
             newLength = static_cast<unsigned>(v);
     }
 
-    if (es.throwIfNeeded())
+    if (exceptionState.throwIfNeeded())
         return;
 
-    imp->setLength(newLength, es);
+    imp->setLength(newLength, exceptionState);
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp b/Source/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp
index 6de5453..d29360a 100644
--- a/Source/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp
+++ b/Source/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp
@@ -36,7 +36,7 @@
 #include "bindings/v8/SharedPersistent.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8NPObject.h"
-#include "core/page/UseCounter.h"
+#include "core/frame/UseCounter.h"
 
 namespace WebCore {
 
@@ -51,11 +51,11 @@
     if (!wrapper)
         return;
 
-    v8::Local<v8::Object> instance = wrapper->newLocal(info.GetIsolate());
-    if (instance.IsEmpty())
+    v8::Local<v8::Object> instanceTemplate = wrapper->newLocal(info.GetIsolate());
+    if (instanceTemplate.IsEmpty())
         return;
 
-    npObjectGetNamedProperty(instance, name, info);
+    npObjectGetNamedProperty(instanceTemplate, name, info);
 }
 
 template <class C>
@@ -66,11 +66,11 @@
     if (!wrapper)
         return;
 
-    v8::Local<v8::Object> instance = wrapper->newLocal(info.GetIsolate());
-    if (instance.IsEmpty())
+    v8::Local<v8::Object> instanceTemplate = wrapper->newLocal(info.GetIsolate());
+    if (instanceTemplate.IsEmpty())
         return;
 
-    npObjectSetNamedProperty(instance, name, value, info);
+    npObjectSetNamedProperty(instanceTemplate, name, value, info);
 }
 
 void V8HTMLAppletElement::namedPropertyGetterCustom(v8::Local<v8::String> name, const v8::PropertyCallbackInfo<v8::Value>& info)
@@ -132,11 +132,11 @@
     if (!wrapper)
         return;
 
-    v8::Local<v8::Object> instance = wrapper->newLocal(info.GetIsolate());
-    if (instance.IsEmpty())
+    v8::Local<v8::Object> instanceTemplate = wrapper->newLocal(info.GetIsolate());
+    if (instanceTemplate.IsEmpty())
         return;
 
-    npObjectGetIndexedProperty(instance, index, info);
+    npObjectGetIndexedProperty(instanceTemplate, index, info);
 }
 
 template <class C>
@@ -147,11 +147,11 @@
     if (!wrapper)
         return;
 
-    v8::Local<v8::Object> instance = wrapper->newLocal(info.GetIsolate());
-    if (instance.IsEmpty())
+    v8::Local<v8::Object> instanceTemplate = wrapper->newLocal(info.GetIsolate());
+    if (instanceTemplate.IsEmpty())
         return;
 
-    npObjectSetIndexedProperty(instance, index, value, info);
+    npObjectSetIndexedProperty(instanceTemplate, index, value, info);
 }
 
 void V8HTMLAppletElement::indexedPropertyGetterCustom(uint32_t index, const v8::PropertyCallbackInfo<v8::Value>& info)
diff --git a/Source/bindings/v8/custom/V8HistoryCustom.cpp b/Source/bindings/v8/custom/V8HistoryCustom.cpp
index edc5c00..427e877 100644
--- a/Source/bindings/v8/custom/V8HistoryCustom.cpp
+++ b/Source/bindings/v8/custom/V8HistoryCustom.cpp
@@ -69,11 +69,11 @@
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithUndefinedOrNullCheck>, title, info[1]);
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithUndefinedOrNullCheck>, url, argumentOrNull(info, 2));
 
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     History* history = V8History::toNative(info.Holder());
-    history->stateObjectAdded(historyState.release(), title, url, SameDocumentNavigationPushState, es);
+    history->stateObjectAdded(historyState.release(), title, url, SameDocumentNavigationPushState, exceptionState);
     info.Holder()->DeleteHiddenValue(V8HiddenPropertyName::state(info.GetIsolate()));
-    es.throwIfNeeded();
+    exceptionState.throwIfNeeded();
 }
 
 void V8History::replaceStateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
@@ -86,11 +86,11 @@
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithUndefinedOrNullCheck>, title, info[1]);
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithUndefinedOrNullCheck>, url, argumentOrNull(info, 2));
 
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     History* history = V8History::toNative(info.Holder());
-    history->stateObjectAdded(historyState.release(), title, url, SameDocumentNavigationReplaceState, es);
+    history->stateObjectAdded(historyState.release(), title, url, SameDocumentNavigationReplaceState, exceptionState);
     info.Holder()->DeleteHiddenValue(V8HiddenPropertyName::state(info.GetIsolate()));
-    es.throwIfNeeded();
+    exceptionState.throwIfNeeded();
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 666c610..362bd6a 100644
--- a/Source/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -77,8 +77,8 @@
     v8::Local<v8::Context> context = state->context();
     v8::Context::Scope contextScope(context);
 
-    ExceptionState es(isolate);
-    if (!BindingSecurity::shouldAllowAccessToNode(node, es))
+    ExceptionState exceptionState(v8::Handle<v8::Object>(), isolate);
+    if (!BindingSecurity::shouldAllowAccessToNode(node, exceptionState))
         return ScriptValue(v8::Null(isolate), isolate);
     return ScriptValue(toV8(node, v8::Handle<v8::Object>(), isolate), isolate);
 }
@@ -119,7 +119,7 @@
         return;
     }
 
-    v8SetReturnValue(info, V8HTMLAllCollection::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())));
+    v8SetReturnValue(info, V8HTMLAllCollection::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())));
 }
 
 void V8InjectedScriptHost::typeMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
@@ -153,36 +153,45 @@
         return;
     }
     WrapperWorldType currentWorldType = worldType(info.GetIsolate());
-    if (V8Node::HasInstance(value, info.GetIsolate(), currentWorldType)) {
+    if (V8Node::hasInstance(value, info.GetIsolate(), currentWorldType)) {
         v8SetReturnValue(info, v8::String::NewSymbol("node"));
         return;
     }
-    if (V8NodeList::HasInstance(value, info.GetIsolate(), currentWorldType)) {
+    if (V8NodeList::hasInstance(value, info.GetIsolate(), currentWorldType)) {
         v8SetReturnValue(info, v8::String::NewSymbol("array"));
         return;
     }
-    if (V8HTMLCollection::HasInstance(value, info.GetIsolate(), currentWorldType)) {
+    if (V8HTMLCollection::hasInstance(value, info.GetIsolate(), currentWorldType)) {
         v8SetReturnValue(info, v8::String::NewSymbol("array"));
         return;
     }
-    if (V8Int8Array::HasInstance(value, info.GetIsolate(), currentWorldType) || V8Int16Array::HasInstance(value, info.GetIsolate(), currentWorldType) || V8Int32Array::HasInstance(value, info.GetIsolate(), currentWorldType)) {
+    if (V8Int8Array::hasInstance(value, info.GetIsolate(), currentWorldType) || V8Int16Array::hasInstance(value, info.GetIsolate(), currentWorldType) || V8Int32Array::hasInstance(value, info.GetIsolate(), currentWorldType)) {
         v8SetReturnValue(info, v8::String::NewSymbol("array"));
         return;
     }
-    if (V8Uint8Array::HasInstance(value, info.GetIsolate(), currentWorldType) || V8Uint16Array::HasInstance(value, info.GetIsolate(), currentWorldType) || V8Uint32Array::HasInstance(value, info.GetIsolate(), currentWorldType)) {
+    if (V8Uint8Array::hasInstance(value, info.GetIsolate(), currentWorldType) || V8Uint16Array::hasInstance(value, info.GetIsolate(), currentWorldType) || V8Uint32Array::hasInstance(value, info.GetIsolate(), currentWorldType)) {
         v8SetReturnValue(info, v8::String::NewSymbol("array"));
         return;
     }
-    if (V8Float32Array::HasInstance(value, info.GetIsolate(), currentWorldType) || V8Float64Array::HasInstance(value, info.GetIsolate(), currentWorldType)) {
+    if (V8Float32Array::hasInstance(value, info.GetIsolate(), currentWorldType) || V8Float64Array::hasInstance(value, info.GetIsolate(), currentWorldType)) {
         v8SetReturnValue(info, v8::String::NewSymbol("array"));
         return;
     }
-    if (V8Uint8ClampedArray::HasInstance(value, info.GetIsolate(), currentWorldType)) {
+    if (V8Uint8ClampedArray::hasInstance(value, info.GetIsolate(), currentWorldType)) {
         v8SetReturnValue(info, v8::String::NewSymbol("array"));
         return;
     }
 }
 
+static bool setFunctionName(v8::Handle<v8::Object>& result, const v8::Handle<v8::Value>& value)
+{
+    if (value->IsString() && v8::Handle<v8::String>::Cast(value)->Length()) {
+        result->Set(v8::String::NewSymbol("functionName"), value);
+        return true;
+    }
+    return false;
+}
+
 void V8InjectedScriptHost::functionDetailsMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     if (info.Length() < 1)
@@ -203,15 +212,10 @@
     v8::Local<v8::Object> result = v8::Object::New();
     result->Set(v8::String::NewSymbol("location"), location);
 
-    v8::Handle<v8::Value> name = function->GetName();
-    if (name->IsString() && v8::Handle<v8::String>::Cast(name)->Length())
-        result->Set(v8::String::NewSymbol("name"), name);
-
-    v8::Handle<v8::Value> inferredName = function->GetInferredName();
-    if (inferredName->IsString() && v8::Handle<v8::String>::Cast(inferredName)->Length())
-        result->Set(v8::String::NewSymbol("inferredName"), inferredName);
-
-    // FIXME: pass function displayName from V8 (crbug.com/17356).
+    if (!setFunctionName(result, function->GetDisplayName())
+        && !setFunctionName(result, function->GetName())
+        && !setFunctionName(result, function->GetInferredName()))
+        result->Set(v8::String::NewSymbol("functionName"), v8::String::NewSymbol(""));
 
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(info.Holder());
     ScriptDebugServer& debugServer = host->scriptDebugServer();
@@ -272,7 +276,7 @@
         return;
 
     v8::Local<v8::Value> value = info[0];
-    if (!V8Node::HasInstance(value, info.GetIsolate(), worldType(info.GetIsolate())))
+    if (!V8Node::hasInstance(value, info.GetIsolate(), worldType(info.GetIsolate())))
         return;
     Node* node = V8Node::toNative(value->ToObject());
     if (!node)
@@ -307,7 +311,7 @@
 
 void V8InjectedScriptHost::databaseIdMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
-    if (info.Length() > 0 && V8Database::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (info.Length() > 0 && V8Database::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
         Database* database = V8Database::toNative(v8::Handle<v8::Object>::Cast(info[0]));
         if (database) {
             InjectedScriptHost* host = V8InjectedScriptHost::toNative(info.Holder()); {
@@ -320,7 +324,7 @@
 
 void V8InjectedScriptHost::storageIdMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
-    if (info.Length() > 0 && V8Storage::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (info.Length() > 0 && V8Storage::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
         Storage* storage = V8Storage::toNative(v8::Handle<v8::Object>::Cast(info[0]));
         if (storage) {
             InjectedScriptHost* host = V8InjectedScriptHost::toNative(info.Holder());
diff --git a/Source/bindings/v8/custom/V8InjectedScriptManager.cpp b/Source/bindings/v8/custom/V8InjectedScriptManager.cpp
index db06657..db0a585 100644
--- a/Source/bindings/v8/custom/V8InjectedScriptManager.cpp
+++ b/Source/bindings/v8/custom/V8InjectedScriptManager.cpp
@@ -52,18 +52,18 @@
         // Return if allocation failed.
         return v8::Local<v8::Object>();
     }
-    v8::Local<v8::Object> instance = V8ObjectConstructor::newInstance(function);
-    if (instance.IsEmpty()) {
+    v8::Local<v8::Object> instanceTemplate = V8ObjectConstructor::newInstance(function);
+    if (instanceTemplate.IsEmpty()) {
         // Avoid setting the wrapper if allocation failed.
         return v8::Local<v8::Object>();
     }
-    V8DOMWrapper::setNativeInfo(instance, &V8InjectedScriptHost::wrapperTypeInfo, host);
+    V8DOMWrapper::setNativeInfo(instanceTemplate, &V8InjectedScriptHost::wrapperTypeInfo, host);
     // Create a weak reference to the v8 wrapper of InspectorBackend to deref
     // InspectorBackend when the wrapper is garbage collected.
     host->ref();
-    v8::Persistent<v8::Object> weakHandle(isolate, instance);
+    v8::Persistent<v8::Object> weakHandle(isolate, instanceTemplate);
     weakHandle.MakeWeak(host, &InjectedScriptManager::makeWeakCallback);
-    return instance;
+    return instanceTemplate;
 }
 
 ScriptObject InjectedScriptManager::createInjectedScript(const String& scriptSource, ScriptState* inspectedScriptState, int id)
diff --git a/Source/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp b/Source/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
index c653395..87177fd 100644
--- a/Source/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
+++ b/Source/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
@@ -36,6 +36,7 @@
 #include "core/inspector/InspectorController.h"
 #include "core/inspector/InspectorFrontendClient.h"
 #include "core/inspector/InspectorFrontendHost.h"
+#include "platform/ContextMenu.h"
 #include "public/platform/Platform.h"
 #include "wtf/text/WTFString.h"
 
@@ -56,7 +57,7 @@
 {
 }
 
-static void populateContextMenuItems(v8::Local<v8::Array>& itemArray, ContextMenu& menu)
+static bool populateContextMenuItems(v8::Local<v8::Array>& itemArray, ContextMenu& menu)
 {
     for (size_t i = 0; i < itemArray->Length(); ++i) {
         v8::Local<v8::Object> item = v8::Local<v8::Object>::Cast(itemArray->Get(i));
@@ -77,11 +78,13 @@
         } else if (typeString == "subMenu" && subItems->IsArray()) {
             ContextMenu subMenu;
             v8::Local<v8::Array> subItemsArray = v8::Local<v8::Array>::Cast(subItems);
-            populateContextMenuItems(subItemsArray, subMenu);
+            if (!populateContextMenuItems(subItemsArray, subMenu))
+                return false;
+            V8TRYCATCH_FOR_V8STRINGRESOURCE_RETURN(V8StringResource<WithNullCheck>, labelString, label, false);
             ContextMenuItem item(SubmenuType,
-                                 ContextMenuItemCustomTagNoAction,
-                                 toWebCoreStringWithNullCheck(label),
-                                 &subMenu);
+                ContextMenuItemCustomTagNoAction,
+                labelString,
+                &subMenu);
             menu.appendItem(item);
         } else {
             ContextMenuAction typedId = static_cast<ContextMenuAction>(ContextMenuItemBaseCustomTag + id->ToInt32()->Value());
@@ -93,6 +96,7 @@
             menu.appendItem(menuItem);
         }
     }
+    return true;
 }
 
 void V8InspectorFrontendHost::showContextMenuMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
@@ -110,7 +114,8 @@
 
     v8::Local<v8::Array> array = v8::Local<v8::Array>::Cast(info[1]);
     ContextMenu menu;
-    populateContextMenuItems(array, menu);
+    if (!populateContextMenuItems(array, menu))
+        return;
 
     InspectorFrontendHost* frontendHost = V8InspectorFrontendHost::toNative(info.Holder());
     Vector<ContextMenuItem> items = menu.items();
@@ -124,7 +129,7 @@
 
     int sample = info[0]->ToInt32()->Value();
     if (sample < boundaryValue)
-        WebKit::Platform::current()->histogramEnumeration(name, sample, boundaryValue);
+        blink::Platform::current()->histogramEnumeration(name, sample, boundaryValue);
 }
 
 void V8InspectorFrontendHost::recordActionTakenMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
diff --git a/Source/bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp b/Source/bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp
index 3b61b56..581da2d 100644
--- a/Source/bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp
+++ b/Source/bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp
@@ -48,15 +48,6 @@
     v8SetReturnValue(info, impl->restart());
 }
 
-void V8JavaScriptCallFrame::setVariableValueMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
-{
-    JavaScriptCallFrame* impl = V8JavaScriptCallFrame::toNative(info.Holder());
-    int scopeIndex = info[0]->Int32Value();
-    String variableName = toWebCoreStringWithUndefinedOrNullCheck(info[1]);
-    v8::Handle<v8::Value> newValue = info[2];
-    v8SetReturnValue(info, impl->setVariableValue(scopeIndex, variableName, newValue));
-}
-
 void V8JavaScriptCallFrame::scopeChainAttributeGetterCustom(const v8::PropertyCallbackInfo<v8::Value>& info)
 {
     JavaScriptCallFrame* impl = V8JavaScriptCallFrame::toNative(info.Holder());
@@ -76,6 +67,12 @@
     v8SetReturnValue(info, impl->thisObject());
 }
 
+void V8JavaScriptCallFrame::returnValueAttributeGetterCustom(const v8::PropertyCallbackInfo<v8::Value>& info)
+{
+    JavaScriptCallFrame* impl = V8JavaScriptCallFrame::toNative(info.Holder());
+    v8SetReturnValue(info, impl->returnValue());
+}
+
 void V8JavaScriptCallFrame::typeAttributeGetterCustom(const v8::PropertyCallbackInfo<v8::Value>& info)
 {
     v8SetReturnValue(info, v8::String::NewSymbol("function"));
diff --git a/Source/bindings/v8/custom/V8MessagePortCustom.cpp b/Source/bindings/v8/custom/V8MessagePortCustom.cpp
index 4c34183..c35b1d8 100644
--- a/Source/bindings/v8/custom/V8MessagePortCustom.cpp
+++ b/Source/bindings/v8/custom/V8MessagePortCustom.cpp
@@ -59,9 +59,9 @@
     RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(info[0], &portArray, &arrayBufferArray, didThrow, info.GetIsolate());
     if (didThrow)
         return;
-    ExceptionState es(info.GetIsolate());
-    messagePort->postMessage(message.release(), &portArray, es);
-    es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    messagePort->postMessage(message.release(), &portArray, exceptionState);
+    exceptionState.throwIfNeeded();
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8NodeCustom.cpp b/Source/bindings/v8/custom/V8NodeCustom.cpp
index c246d83..999498d 100644
--- a/Source/bindings/v8/custom/V8NodeCustom.cpp
+++ b/Source/bindings/v8/custom/V8NodeCustom.cpp
@@ -66,11 +66,11 @@
 
     CustomElementCallbackDispatcher::CallbackDeliveryScope deliveryScope;
 
-    ExceptionState es(info.GetIsolate());
-    Node* newChild = V8Node::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
-    Node* refChild = V8Node::HasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[1])) : 0;
-    imp->insertBefore(newChild, refChild, es);
-    if (es.throwIfNeeded())
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    Node* newChild = V8Node::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
+    Node* refChild = V8Node::hasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[1])) : 0;
+    imp->insertBefore(newChild, refChild, exceptionState);
+    if (exceptionState.throwIfNeeded())
         return;
     v8SetReturnValue(info, info[0]);
 }
@@ -82,11 +82,11 @@
 
     CustomElementCallbackDispatcher::CallbackDeliveryScope deliveryScope;
 
-    ExceptionState es(info.GetIsolate());
-    Node* newChild = V8Node::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
-    Node* oldChild = V8Node::HasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[1])) : 0;
-    imp->replaceChild(newChild, oldChild, es);
-    if (es.throwIfNeeded())
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    Node* newChild = V8Node::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
+    Node* oldChild = V8Node::hasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[1])) : 0;
+    imp->replaceChild(newChild, oldChild, exceptionState);
+    if (exceptionState.throwIfNeeded())
         return;
     v8SetReturnValue(info, info[1]);
 }
@@ -98,10 +98,10 @@
 
     CustomElementCallbackDispatcher::CallbackDeliveryScope deliveryScope;
 
-    ExceptionState es(info.GetIsolate());
-    Node* oldChild = V8Node::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
-    imp->removeChild(oldChild, es);
-    if (es.throwIfNeeded())
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    Node* oldChild = V8Node::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
+    imp->removeChild(oldChild, exceptionState);
+    if (exceptionState.throwIfNeeded())
         return;
     v8SetReturnValue(info, info[0]);
 }
@@ -113,10 +113,10 @@
 
     CustomElementCallbackDispatcher::CallbackDeliveryScope deliveryScope;
 
-    ExceptionState es(info.GetIsolate());
-    Node* newChild = V8Node::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
-    imp->appendChild(newChild, es);
-    if (es.throwIfNeeded())
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    Node* newChild = V8Node::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
+    imp->appendChild(newChild, exceptionState);
+    if (exceptionState.throwIfNeeded())
         return;
     v8SetReturnValue(info, info[0]);
 }
diff --git a/Source/bindings/v8/custom/V8NodeListCustom.cpp b/Source/bindings/v8/custom/V8NodeListCustom.cpp
index 20280a9..341f1c2 100644
--- a/Source/bindings/v8/custom/V8NodeListCustom.cpp
+++ b/Source/bindings/v8/custom/V8NodeListCustom.cpp
@@ -41,7 +41,7 @@
 
 namespace WebCore {
 
-void V8NodeList::resolveWrapperReachability(void* object, const v8::Persistent<v8::Object>& wrapper, v8::Isolate* isolate)
+void V8NodeList::visitDOMWrapper(void* object, const v8::Persistent<v8::Object>& wrapper, v8::Isolate* isolate)
 {
     NodeList* impl = static_cast<NodeList*>(object);
     if (!impl->isLiveNodeList()) {
diff --git a/Source/bindings/v8/custom/V8SQLTransactionCustom.cpp b/Source/bindings/v8/custom/V8SQLTransactionCustom.cpp
index 49cfff3..d98fcd7 100644
--- a/Source/bindings/v8/custom/V8SQLTransactionCustom.cpp
+++ b/Source/bindings/v8/custom/V8SQLTransactionCustom.cpp
@@ -108,9 +108,9 @@
         errorCallback = V8SQLStatementErrorCallback::create(info[3], executionContext);
     }
 
-    ExceptionState es(info.GetIsolate());
-    transaction->executeSQL(statement, sqlValues, callback, errorCallback, es);
-    es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    transaction->executeSQL(statement, sqlValues, callback, errorCallback, exceptionState);
+    exceptionState.throwIfNeeded();
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp b/Source/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
index aede1db..1197158 100644
--- a/Source/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
+++ b/Source/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
@@ -88,9 +88,9 @@
 
     SQLTransactionSync* transaction = V8SQLTransactionSync::toNative(info.Holder());
 
-    ExceptionState es(info.GetIsolate());
-    v8::Handle<v8::Value> result = toV8(transaction->executeSQL(statement, sqlValues, es), info.Holder(), info.GetIsolate());
-    if (es.throwIfNeeded())
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    v8::Handle<v8::Value> result = toV8(transaction->executeSQL(statement, sqlValues, exceptionState), info.Holder(), info.GetIsolate());
+    if (exceptionState.throwIfNeeded())
         return;
 
     v8SetReturnValue(info, result);
diff --git a/Source/bindings/v8/custom/V8SVGLengthCustom.cpp b/Source/bindings/v8/custom/V8SVGLengthCustom.cpp
index b4120cf..94a7948 100644
--- a/Source/bindings/v8/custom/V8SVGLengthCustom.cpp
+++ b/Source/bindings/v8/custom/V8SVGLengthCustom.cpp
@@ -44,10 +44,10 @@
 {
     SVGPropertyTearOff<SVGLength>* wrapper = V8SVGLength::toNative(info.Holder());
     SVGLength& imp = wrapper->propertyReference();
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     SVGLengthContext lengthContext(wrapper->contextElement());
-    float value = imp.value(lengthContext, es);
-    if (es.throwIfNeeded())
+    float value = imp.value(lengthContext, exceptionState);
+    if (exceptionState.throwIfNeeded())
         return;
     v8SetReturnValue(info, value);
 }
@@ -66,10 +66,10 @@
     }
 
     SVGLength& imp = wrapper->propertyReference();
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     SVGLengthContext lengthContext(wrapper->contextElement());
-    imp.setValue(static_cast<float>(value->NumberValue()), lengthContext, es);
-    if (es.throwIfNeeded())
+    imp.setValue(static_cast<float>(value->NumberValue()), lengthContext, exceptionState);
+    if (exceptionState.throwIfNeeded())
         return;
     wrapper->commitChange();
 }
@@ -88,11 +88,11 @@
     }
 
     SVGLength& imp = wrapper->propertyReference();
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     V8TRYCATCH_VOID(int, unitType, toUInt32(info[0]));
     SVGLengthContext lengthContext(wrapper->contextElement());
-    imp.convertToSpecifiedUnits(unitType, lengthContext, es);
-    if (es.throwIfNeeded())
+    imp.convertToSpecifiedUnits(unitType, lengthContext, exceptionState);
+    if (exceptionState.throwIfNeeded())
         return;
     wrapper->commitChange();
 }
diff --git a/Source/bindings/v8/custom/V8StyleSheetCustom.cpp b/Source/bindings/v8/custom/V8StyleSheetCustom.cpp
index 60c8b4a..39d28a8 100644
--- a/Source/bindings/v8/custom/V8StyleSheetCustom.cpp
+++ b/Source/bindings/v8/custom/V8StyleSheetCustom.cpp
@@ -41,7 +41,7 @@
 {
     ASSERT(impl);
     if (impl->isCSSStyleSheet())
-        return wrap(static_cast<CSSStyleSheet*>(impl), creationContext, isolate);
+        return wrap(toCSSStyleSheet(impl), creationContext, isolate);
     return V8StyleSheet::createWrapper(impl, creationContext, isolate);
 }
 
diff --git a/Source/bindings/v8/custom/V8TextTrackCueCustom.cpp b/Source/bindings/v8/custom/V8TextTrackCueCustom.cpp
new file mode 100644
index 0000000..905b2f3
--- /dev/null
+++ b/Source/bindings/v8/custom/V8TextTrackCueCustom.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2013, Opera Software ASA. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of Opera Software ASA nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8TextTrackCue.h"
+
+#include "V8VTTCue.h"
+#include "core/frame/UseCounter.h"
+
+namespace WebCore {
+
+v8::Handle<v8::Value> toV8(TextTrackCue* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
+{
+    return toV8(toVTTCue(impl), creationContext, isolate);
+}
+
+// Custom constructor to make new TextTrackCue(...) return a VTTCue. This is legacy
+// compat, not per spec, and should be removed at the earliest opportunity.
+void V8TextTrackCue::constructorCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
+{
+    if (UNLIKELY(info.Length() < 3)) {
+        throwTypeError(ExceptionMessages::failedToExecute("Constructor", "TextTrackCue", ExceptionMessages::notEnoughArguments(3, info.Length())), info.GetIsolate());
+        return;
+    }
+    V8TRYCATCH_VOID(double, startTime, static_cast<double>(info[0]->NumberValue()));
+    V8TRYCATCH_VOID(double, endTime, static_cast<double>(info[1]->NumberValue()));
+    V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, text, info[2]);
+
+    Document& document = *toDocument(getExecutionContext());
+    UseCounter::count(document, UseCounter::TextTrackCueConstructor);
+    VTTCue* impl = VTTCue::create(document, startTime, endTime, text).leakRef();
+    v8::Handle<v8::Object> wrapper = wrap(impl, info.Holder(), info.GetIsolate());
+    info.GetReturnValue().Set(wrapper);
+}
+
+} // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8TypedArrayCustom.h b/Source/bindings/v8/custom/V8TypedArrayCustom.h
index c584604..092df27 100644
--- a/Source/bindings/v8/custom/V8TypedArrayCustom.h
+++ b/Source/bindings/v8/custom/V8TypedArrayCustom.h
@@ -47,12 +47,12 @@
 template<typename TypedArray>
 class V8TypedArray {
 public:
-    static bool HasInstance(v8::Handle<v8::Value> value, v8::Isolate*, WrapperWorldType)
+    static bool hasInstance(v8::Handle<v8::Value> value, v8::Isolate*, WrapperWorldType)
     {
         return TypedArrayTraits<TypedArray>::IsInstance(value);
     }
 
-    static bool HasInstanceInAnyWorld(v8::Handle<v8::Value> value, v8::Isolate*)
+    static bool hasInstanceInAnyWorld(v8::Handle<v8::Value> value, v8::Isolate*)
     {
         return TypedArrayTraits<TypedArray>::IsInstance(value);
     }
@@ -177,6 +177,7 @@
 
 template <typename TypedArray>
 const WrapperTypeInfo V8TypedArray<TypedArray>::wrapperTypeInfo = {
+    gin::kEmbedderBlink,
     0, V8TypedArray<TypedArray>::derefObject,
     0, 0, 0, 0, 0, WrapperTypeObjectPrototype
 };
diff --git a/Source/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index f91cc87..ef18981 100644
--- a/Source/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -296,7 +296,7 @@
 {
     ok = false;
     WebGLUniformLocation* location = 0;
-    if (V8WebGLUniformLocation::HasInstance(value, isolate, worldType(isolate))) {
+    if (V8WebGLUniformLocation::hasInstance(value, isolate, worldType(isolate))) {
         location = V8WebGLUniformLocation::toNative(value->ToObject());
         ok = true;
     }
@@ -315,11 +315,11 @@
     }
 
     WebGLRenderingContext* context = V8WebGLRenderingContext::toNative(info.Holder());
-    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLProgram::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLProgram::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
         throwUninformativeAndGenericTypeError(info.GetIsolate());
         return;
     }
-    WebGLProgram* program = V8WebGLProgram::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8WebGLProgram::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
+    WebGLProgram* program = V8WebGLProgram::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8WebGLProgram::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
     Vector<RefPtr<WebGLShader> > shaders;
     bool succeed = context->getAttachedShaders(program, shaders);
     if (!succeed) {
@@ -385,11 +385,11 @@
     }
 
     WebGLRenderingContext* context = V8WebGLRenderingContext::toNative(info.Holder());
-    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLProgram::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLProgram::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
         throwUninformativeAndGenericTypeError(info.GetIsolate());
         return;
     }
-    WebGLProgram* program = V8WebGLProgram::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8WebGLProgram::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
+    WebGLProgram* program = V8WebGLProgram::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8WebGLProgram::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
     unsigned pname = toInt32(info[1]);
     WebGLGetInfo args = context->getProgramParameter(program, pname);
     v8SetReturnValue(info, toV8Object(args, info.Holder(), info.GetIsolate()));
@@ -408,11 +408,11 @@
     }
 
     WebGLRenderingContext* context = V8WebGLRenderingContext::toNative(info.Holder());
-    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLShader::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLShader::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
         throwUninformativeAndGenericTypeError(info.GetIsolate());
         return;
     }
-    WebGLShader* shader = V8WebGLShader::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8WebGLShader::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
+    WebGLShader* shader = V8WebGLShader::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8WebGLShader::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
     unsigned pname = toInt32(info[1]);
     WebGLGetInfo args = context->getShaderParameter(shader, pname);
     v8SetReturnValue(info, toV8Object(args, info.Holder(), info.GetIsolate()));
@@ -446,13 +446,13 @@
     }
 
     WebGLRenderingContext* context = V8WebGLRenderingContext::toNative(info.Holder());
-    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLProgram::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLProgram::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
         throwUninformativeAndGenericTypeError(info.GetIsolate());
         return;
     }
-    WebGLProgram* program = V8WebGLProgram::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8WebGLProgram::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
+    WebGLProgram* program = V8WebGLProgram::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate())) ? V8WebGLProgram::toNative(v8::Handle<v8::Object>::Cast(info[0])) : 0;
 
-    if (info.Length() > 1 && !isUndefinedOrNull(info[1]) && !V8WebGLUniformLocation::HasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (info.Length() > 1 && !isUndefinedOrNull(info[1]) && !V8WebGLUniformLocation::hasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate()))) {
         throwUninformativeAndGenericTypeError(info.GetIsolate());
         return;
     }
@@ -519,7 +519,7 @@
     if (isFunctionToCallForAttribute(functionToCall))
         index = toInt32(info[0]);
     else {
-        if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLUniformLocation::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+        if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLUniformLocation::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
             throwUninformativeAndGenericTypeError(info.GetIsolate());
             return;
         }
@@ -528,7 +528,7 @@
 
     WebGLRenderingContext* context = V8WebGLRenderingContext::toNative(info.Holder());
 
-    if (V8Float32Array::HasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (V8Float32Array::hasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate()))) {
         Float32Array* array = V8Float32Array::toNative(info[1]->ToObject());
         ASSERT(array != NULL);
         switch (functionToCall) {
@@ -589,14 +589,14 @@
     }
 
     WebGLRenderingContext* context = V8WebGLRenderingContext::toNative(info.Holder());
-    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLUniformLocation::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLUniformLocation::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
         throwUninformativeAndGenericTypeError(info.GetIsolate());
         return;
     }
     bool ok = false;
     WebGLUniformLocation* location = toWebGLUniformLocation(info[0], ok, info.GetIsolate());
 
-    if (V8Int32Array::HasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (V8Int32Array::hasInstance(info[1], info.GetIsolate(), worldType(info.GetIsolate()))) {
         Int32Array* array = V8Int32Array::toNative(info[1]->ToObject());
         ASSERT(array != NULL);
         switch (functionToCall) {
@@ -683,13 +683,13 @@
     //
     // FIXME: need to change to accept Float32Array as well.
     if (info.Length() != 3) {
-        throwTypeError(ExceptionMessages::failedToExecute(method, "WebGLRenderingContext", ExceptionMessages::notEnoughArguments(2, info.Length())), info.GetIsolate());
+        throwTypeError(ExceptionMessages::failedToExecute(method, "WebGLRenderingContext", ExceptionMessages::notEnoughArguments(3, info.Length())), info.GetIsolate());
         return;
     }
 
     WebGLRenderingContext* context = V8WebGLRenderingContext::toNative(info.Holder());
 
-    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLUniformLocation::HasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (info.Length() > 0 && !isUndefinedOrNull(info[0]) && !V8WebGLUniformLocation::hasInstance(info[0], info.GetIsolate(), worldType(info.GetIsolate()))) {
         throwUninformativeAndGenericTypeError(info.GetIsolate());
         return;
     }
@@ -697,7 +697,7 @@
     WebGLUniformLocation* location = toWebGLUniformLocation(info[0], ok, info.GetIsolate());
 
     bool transpose = info[1]->BooleanValue();
-    if (V8Float32Array::HasInstance(info[2], info.GetIsolate(), worldType(info.GetIsolate()))) {
+    if (V8Float32Array::hasInstance(info[2], info.GetIsolate(), worldType(info.GetIsolate()))) {
         Float32Array* array = V8Float32Array::toNative(info[2]->ToObject());
         ASSERT(array != NULL);
         switch (matrixSize) {
diff --git a/Source/bindings/v8/custom/V8WindowCustom.cpp b/Source/bindings/v8/custom/V8WindowCustom.cpp
index 51f152c..dc92353 100644
--- a/Source/bindings/v8/custom/V8WindowCustom.cpp
+++ b/Source/bindings/v8/custom/V8WindowCustom.cpp
@@ -63,17 +63,18 @@
 #include "core/page/Page.h"
 #include "core/page/Settings.h"
 #include "core/page/WindowFeatures.h"
-#include "core/platform/graphics/MediaPlayer.h"
 #include "core/storage/Storage.h"
 #include "platform/PlatformScreen.h"
+#include "platform/graphics/media/MediaPlayer.h"
 #include "wtf/ArrayBuffer.h"
+#include "wtf/Assertions.h"
 #include "wtf/OwnPtr.h"
 
 namespace WebCore {
 
 // FIXME: There is a lot of duplication with SetTimeoutOrInterval() in V8WorkerGlobalScopeCustom.cpp.
 // We should refactor this.
-void WindowSetTimeoutImpl(const v8::FunctionCallbackInfo<v8::Value>& info, bool singleShot, ExceptionState& es)
+void WindowSetTimeoutImpl(const v8::FunctionCallbackInfo<v8::Value>& info, bool singleShot, ExceptionState& exceptionState)
 {
     int argumentCount = info.Length();
 
@@ -84,7 +85,7 @@
     ExecutionContext* scriptContext = static_cast<ExecutionContext*>(imp->document());
 
     if (!scriptContext) {
-        es.throwUninformativeAndGenericDOMException(InvalidAccessError);
+        exceptionState.throwUninformativeAndGenericDOMException(InvalidAccessError);
         return;
     }
 
@@ -109,7 +110,7 @@
             return;
     }
 
-    if (!BindingSecurity::shouldAllowAccessToFrame(imp->frame(), es))
+    if (!BindingSecurity::shouldAllowAccessToFrame(imp->frame(), exceptionState))
         return;
 
     OwnPtr<ScheduledAction> action;
@@ -147,7 +148,7 @@
     // use of any idle time. Aim for the middle of the interval for simplicity.
     if (timeout >= 0) {
         double maximumFireInterval = static_cast<double>(timeout) / 1000 / 2;
-        V8GCForContextDispose::instance().notifyIdleSooner(maximumFireInterval);
+        V8GCForContextDispose::instanceTemplate().notifyIdleSooner(maximumFireInterval);
     }
 
     v8SetReturnValue(info, timerId);
@@ -160,9 +161,9 @@
         return;
 
     Frame* frame = V8Window::toNative(holder)->frame();
-    ExceptionState es(info.GetIsolate());
-    if (!BindingSecurity::shouldAllowAccessToFrame(frame, es)) {
-        es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    if (!BindingSecurity::shouldAllowAccessToFrame(frame, exceptionState)) {
+        exceptionState.throwIfNeeded();
         return;
     }
 
@@ -185,9 +186,9 @@
         return;
 
     Frame* frame = V8Window::toNative(holder)->frame();
-    ExceptionState es(info.GetIsolate());
-    if (!BindingSecurity::shouldAllowAccessToFrame(frame, es)) {
-        es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    if (!BindingSecurity::shouldAllowAccessToFrame(frame, exceptionState)) {
+        exceptionState.throwIfNeeded();
         return;
     }
 
@@ -200,12 +201,30 @@
     context->Global()->SetHiddenValue(eventSymbol, value);
 }
 
+void V8Window::frameElementAttributeGetterCustom(const v8::PropertyCallbackInfo<v8::Value>& info)
+{
+    DOMWindow* imp = V8Window::toNative(info.Holder());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    if (!BindingSecurity::shouldAllowAccessToNode(imp->frameElement(), exceptionState)) {
+        v8SetReturnValueNull(info);
+        exceptionState.throwIfNeeded();
+        return;
+    }
+
+    // The wrapper for an <iframe> should get its prototype from the context of the frame it's in, rather than its own frame.
+    // So, use its containing document as the creation context when wrapping.
+    v8::Handle<v8::Value> creationContext = toV8(&imp->frameElement()->document(), v8::Handle<v8::Object>(), info.GetIsolate());
+    RELEASE_ASSERT(!creationContext.IsEmpty());
+    v8::Handle<v8::Value> wrapper = toV8(imp->frameElement(), v8::Handle<v8::Object>::Cast(creationContext), info.GetIsolate());
+    v8SetReturnValue(info, wrapper);
+}
+
 void V8Window::openerAttributeSetterCustom(v8::Local<v8::Value> value, const v8::PropertyCallbackInfo<void>& info)
 {
     DOMWindow* imp = V8Window::toNative(info.Holder());
-    ExceptionState es(info.GetIsolate());
-    if (!BindingSecurity::shouldAllowAccessToFrame(imp->frame(), es)) {
-        es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    if (!BindingSecurity::shouldAllowAccessToFrame(imp->frame(), exceptionState)) {
+        exceptionState.throwIfNeeded();
         return;
     }
 
@@ -277,9 +296,9 @@
     if (didThrow)
         return;
 
-    ExceptionState es(info.GetIsolate());
-    window->postMessage(message.release(), &portArray, targetOrigin, source, es);
-    es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    window->postMessage(message.release(), &portArray, targetOrigin, source, exceptionState);
+    exceptionState.throwIfNeeded();
 }
 
 // FIXME(fqian): returning string is cheating, and we should
@@ -341,9 +360,9 @@
 void V8Window::showModalDialogMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     DOMWindow* impl = V8Window::toNative(info.Holder());
-    ExceptionState es(info.GetIsolate());
-    if (!BindingSecurity::shouldAllowAccessToFrame(impl->frame(), es)) {
-        es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    if (!BindingSecurity::shouldAllowAccessToFrame(impl->frame(), exceptionState)) {
+        exceptionState.throwIfNeeded();
         return;
     }
 
@@ -360,9 +379,9 @@
 void V8Window::openMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     DOMWindow* impl = V8Window::toNative(info.Holder());
-    ExceptionState es(info.GetIsolate());
-    if (!BindingSecurity::shouldAllowAccessToFrame(impl->frame(), es)) {
-        es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    if (!BindingSecurity::shouldAllowAccessToFrame(impl->frame(), exceptionState)) {
+        exceptionState.throwIfNeeded();
         return;
     }
 
@@ -423,17 +442,17 @@
 
 void V8Window::setTimeoutMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
-    ExceptionState es(info.GetIsolate());
-    WindowSetTimeoutImpl(info, true, es);
-    es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    WindowSetTimeoutImpl(info, true, exceptionState);
+    exceptionState.throwIfNeeded();
 }
 
 
 void V8Window::setIntervalMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
-    ExceptionState es(info.GetIsolate());
-    WindowSetTimeoutImpl(info, false, es);
-    es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    WindowSetTimeoutImpl(info, false, exceptionState);
+    exceptionState.throwIfNeeded();
 }
 
 bool V8Window::namedSecurityCheckCustom(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType type, v8::Local<v8::Value>)
diff --git a/Source/bindings/v8/custom/V8WorkerCustom.cpp b/Source/bindings/v8/custom/V8WorkerCustom.cpp
index 680e91c..6fbc95e 100644
--- a/Source/bindings/v8/custom/V8WorkerCustom.cpp
+++ b/Source/bindings/v8/custom/V8WorkerCustom.cpp
@@ -60,9 +60,9 @@
     RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(info[0], &ports, &arrayBuffers, didThrow, info.GetIsolate());
     if (didThrow)
         return;
-    ExceptionState es(info.GetIsolate());
-    worker->postMessage(message.release(), &ports, es);
-    es.throwIfNeeded();
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    worker->postMessage(message.release(), &ports, exceptionState);
+    exceptionState.throwIfNeeded();
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/Source/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 86c26fd..177533d 100644
--- a/Source/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/Source/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -72,9 +72,9 @@
 void V8XMLHttpRequest::responseTextAttributeGetterCustom(const v8::PropertyCallbackInfo<v8::Value>& info)
 {
     XMLHttpRequest* xmlHttpRequest = V8XMLHttpRequest::toNative(info.Holder());
-    ExceptionState es(info.GetIsolate());
-    ScriptValue text = xmlHttpRequest->responseText(es);
-    if (es.throwIfNeeded())
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+    ScriptValue text = xmlHttpRequest->responseText(exceptionState);
+    if (exceptionState.throwIfNeeded())
         return;
     if (text.hasNoValue()) {
         v8SetReturnValueString(info, emptyString(), info.GetIsolate());
@@ -97,9 +97,9 @@
         {
             v8::Isolate* isolate = info.GetIsolate();
 
-            ExceptionState es(isolate);
+            ExceptionState exceptionState(info.Holder(), isolate);
             ScriptString jsonSource = xmlHttpRequest->responseJSONSource();
-            if (es.throwIfNeeded())
+            if (exceptionState.throwIfNeeded())
                 return;
 
             if (jsonSource.hasNoValue() || !jsonSource.v8Value()->IsString()) {
@@ -122,9 +122,9 @@
 
     case XMLHttpRequest::ResponseTypeDocument:
         {
-            ExceptionState es(info.GetIsolate());
-            Document* document = xmlHttpRequest->responseXML(es);
-            if (es.throwIfNeeded())
+            ExceptionState exceptionState(info.Holder(), info.GetIsolate());
+            Document* document = xmlHttpRequest->responseXML(exceptionState);
+            if (exceptionState.throwIfNeeded())
                 return;
             v8SetReturnValueFast(info, document, xmlHttpRequest);
             return;
@@ -148,7 +148,7 @@
         {
             ArrayBuffer* arrayBuffer = xmlHttpRequest->responseArrayBuffer();
             if (arrayBuffer) {
-                arrayBuffer->setDeallocationObserver(V8ArrayBufferDeallocationObserver::instance());
+                arrayBuffer->setDeallocationObserver(V8ArrayBufferDeallocationObserver::instanceTemplate());
             }
             v8SetReturnValueFast(info, arrayBuffer, xmlHttpRequest);
             return;
@@ -177,34 +177,34 @@
     ExecutionContext* context = getExecutionContext();
     KURL url = context->completeURL(urlstring);
 
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
 
     if (info.Length() >= 3) {
         bool async = info[2]->BooleanValue();
 
         if (info.Length() >= 4 && !info[3]->IsUndefined()) {
-            String user = toWebCoreStringWithNullCheck(info[3]);
+            V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithNullCheck>, user, info[3]);
 
             if (info.Length() >= 5 && !info[4]->IsUndefined()) {
-                String passwd = toWebCoreStringWithNullCheck(info[4]);
-                xmlHttpRequest->open(method, url, async, user, passwd, es);
+                V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithNullCheck>, password, info[4]);
+                xmlHttpRequest->open(method, url, async, user, password, exceptionState);
             } else {
-                xmlHttpRequest->open(method, url, async, user, es);
+                xmlHttpRequest->open(method, url, async, user, exceptionState);
             }
         } else {
-            xmlHttpRequest->open(method, url, async, es);
+            xmlHttpRequest->open(method, url, async, exceptionState);
         }
     } else {
-        xmlHttpRequest->open(method, url, es);
+        xmlHttpRequest->open(method, url, exceptionState);
     }
 
-    es.throwIfNeeded();
+    exceptionState.throwIfNeeded();
 }
 
 static bool isDocumentType(v8::Handle<v8::Value> value, v8::Isolate* isolate, WrapperWorldType currentWorldType)
 {
     // FIXME: add other document types.
-    return V8Document::HasInstance(value, isolate, currentWorldType) || V8HTMLDocument::HasInstance(value, isolate, currentWorldType);
+    return V8Document::hasInstance(value, isolate, currentWorldType) || V8HTMLDocument::hasInstance(value, isolate, currentWorldType);
 }
 
 void V8XMLHttpRequest::sendMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
@@ -213,45 +213,46 @@
 
     InspectorInstrumentation::willSendXMLHttpRequest(xmlHttpRequest->executionContext(), xmlHttpRequest->url());
 
-    ExceptionState es(info.GetIsolate());
+    ExceptionState exceptionState(info.Holder(), info.GetIsolate());
     if (info.Length() < 1)
-        xmlHttpRequest->send(es);
+        xmlHttpRequest->send(exceptionState);
     else {
         v8::Handle<v8::Value> arg = info[0];
         WrapperWorldType currentWorldType = worldType(info.GetIsolate());
         if (isUndefinedOrNull(arg)) {
-            xmlHttpRequest->send(es);
+            xmlHttpRequest->send(exceptionState);
         } else if (isDocumentType(arg, info.GetIsolate(), currentWorldType)) {
             v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
             Document* document = V8Document::toNative(object);
             ASSERT(document);
-            xmlHttpRequest->send(document, es);
-        } else if (V8Blob::HasInstance(arg, info.GetIsolate(), currentWorldType)) {
+            xmlHttpRequest->send(document, exceptionState);
+        } else if (V8Blob::hasInstance(arg, info.GetIsolate(), currentWorldType)) {
             v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
             Blob* blob = V8Blob::toNative(object);
             ASSERT(blob);
-            xmlHttpRequest->send(blob, es);
-        } else if (V8FormData::HasInstance(arg, info.GetIsolate(), currentWorldType)) {
+            xmlHttpRequest->send(blob, exceptionState);
+        } else if (V8FormData::hasInstance(arg, info.GetIsolate(), currentWorldType)) {
             v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
             DOMFormData* domFormData = V8FormData::toNative(object);
             ASSERT(domFormData);
-            xmlHttpRequest->send(domFormData, es);
-        } else if (V8ArrayBuffer::HasInstance(arg, info.GetIsolate(), currentWorldType)) {
+            xmlHttpRequest->send(domFormData, exceptionState);
+        } else if (V8ArrayBuffer::hasInstance(arg, info.GetIsolate(), currentWorldType)) {
             v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
             ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(object);
             ASSERT(arrayBuffer);
-            xmlHttpRequest->send(arrayBuffer, es);
-        } else if (V8ArrayBufferView::HasInstance(arg, info.GetIsolate(), currentWorldType)) {
+            xmlHttpRequest->send(arrayBuffer, exceptionState);
+        } else if (V8ArrayBufferView::hasInstance(arg, info.GetIsolate(), currentWorldType)) {
             v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
             ArrayBufferView* arrayBufferView = V8ArrayBufferView::toNative(object);
             ASSERT(arrayBufferView);
-            xmlHttpRequest->send(arrayBufferView, es);
+            xmlHttpRequest->send(arrayBufferView, exceptionState);
         } else {
-            xmlHttpRequest->send(toWebCoreStringWithNullCheck(arg), es);
+            V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<WithNullCheck>, argString, arg);
+            xmlHttpRequest->send(argString, exceptionState);
         }
     }
 
-    es.throwIfNeeded();
+    exceptionState.throwIfNeeded();
 }
 
 } // namespace WebCore
diff --git a/Source/bindings/v8/npruntime.cpp b/Source/bindings/v8/npruntime.cpp
index 0c75c09..d3e1755 100644
--- a/Source/bindings/v8/npruntime.cpp
+++ b/Source/bindings/v8/npruntime.cpp
@@ -36,6 +36,8 @@
 #include "wtf/HashSet.h"
 #include "wtf/HashTableDeletedValueType.h"
 
+#include <stdlib.h>
+
 using namespace WebCore;
 
 // FIXME: Consider removing locks if we're singlethreaded already.
@@ -408,7 +410,7 @@
 void _NPN_UnregisterObject(NPObject* npObject)
 {
     ASSERT(npObject);
-    ASSERT(liveObjectMap().find(npObject) != liveObjectMap().end());
+    ASSERT_WITH_SECURITY_IMPLICATION(liveObjectMap().find(npObject) != liveObjectMap().end());
 
     NPObject* owner = 0;
     if (liveObjectMap().find(npObject) != liveObjectMap().end())
@@ -416,11 +418,11 @@
 
     if (!owner) {
         // Unregistering a owner object; also unregister it's descendants.
-        ASSERT(rootObjectMap().find(npObject) != rootObjectMap().end());
+        ASSERT_WITH_SECURITY_IMPLICATION(rootObjectMap().find(npObject) != rootObjectMap().end());
         NPObjectSet* set = rootObjectMap().get(npObject);
         while (set->size() > 0) {
 #ifndef NDEBUG
-            int size = set->size();
+            unsigned size = set->size();
 #endif
             NPObject* sub_object = *(set->begin());
             // The sub-object should not be a owner!