Imported WebKit commit 68645295d2e3e09af2c942f092556f06aa5f8b0d (http://svn.webkit.org/repository/webkit/trunk@128073)

New snapshot

85 files changed, 1228 insertions, 965 deletions

diff --git a/Source/WebCore/dom/Attr.cpp b/Source/WebCore/dom/Attr.cpp
index d6e29bd18..95c3fe052 100644
--- a/Source/WebCore/dom/Attr.cpp
+++ b/Source/WebCore/dom/Attr.cpp
@@ -138,7 +138,7 @@ void Attr::setNodeValue(const String& v, ExceptionCode& ec)
     setValue(v, ec);
 }
 
-PassRefPtr<Node> Attr::cloneNode(bool /*deep*/, ExceptionCode&)
+PassRefPtr<Node> Attr::cloneNode(bool /*deep*/)
 {
     RefPtr<Attr> clone = adoptRef(new Attr(document(), qualifiedName(), value()));
     cloneChildNodes(clone.get());
diff --git a/Source/WebCore/dom/Attr.h b/Source/WebCore/dom/Attr.h
index 86b3c4a60..8e760aa25 100644
--- a/Source/WebCore/dom/Attr.h
+++ b/Source/WebCore/dom/Attr.h
@@ -81,7 +81,7 @@ private:
 
     virtual String nodeValue() const OVERRIDE { return value(); }
     virtual void setNodeValue(const String&, ExceptionCode&);
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
 
     virtual bool isAttributeNode() const { return true; }
     virtual bool childTypeAllowed(NodeType) const;
diff --git a/Source/WebCore/dom/Attribute.h b/Source/WebCore/dom/Attribute.h
index 81a0bbda7..d182ff285 100644
--- a/Source/WebCore/dom/Attribute.h
+++ b/Source/WebCore/dom/Attribute.h
@@ -69,7 +69,7 @@ public:
 
     void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
         info.addInstrumentedMember(m_name);
         info.addInstrumentedMember(m_value);
     }
diff --git a/Source/WebCore/dom/CDATASection.cpp b/Source/WebCore/dom/CDATASection.cpp
index 2b39e8083..33a3acc58 100644
--- a/Source/WebCore/dom/CDATASection.cpp
+++ b/Source/WebCore/dom/CDATASection.cpp
@@ -46,7 +46,7 @@ Node::NodeType CDATASection::nodeType() const
     return CDATA_SECTION_NODE;
 }
 
-PassRefPtr<Node> CDATASection::cloneNode(bool /*deep*/, ExceptionCode&)
+PassRefPtr<Node> CDATASection::cloneNode(bool /*deep*/)
 {
     return create(document(), data());
 }
diff --git a/Source/WebCore/dom/CDATASection.h b/Source/WebCore/dom/CDATASection.h
index 4c26573f7..d7aca9d69 100644
--- a/Source/WebCore/dom/CDATASection.h
+++ b/Source/WebCore/dom/CDATASection.h
@@ -36,7 +36,7 @@ private:
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType) const;
     virtual PassRefPtr<Text> virtualCreate(const String&);
 };
diff --git a/Source/WebCore/dom/CharacterData.cpp b/Source/WebCore/dom/CharacterData.cpp
index 8c930d8f2..390de1821 100644
--- a/Source/WebCore/dom/CharacterData.cpp
+++ b/Source/WebCore/dom/CharacterData.cpp
@@ -26,7 +26,6 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "InspectorInstrumentation.h"
-#include "MemoryInstrumentation.h"
 #include "MutationEvent.h"
 #include "MutationObserverInterestGroup.h"
 #include "MutationRecord.h"
@@ -35,6 +34,7 @@
 #include "StyleInheritedData.h"
 #include "TextBreakIterator.h"
 #include "UndoManager.h"
+#include "WebCoreMemoryInstrumentation.h"
 
 using namespace std;
 
@@ -96,7 +96,7 @@ unsigned CharacterData::parserAppendData(const UChar* data, unsigned dataLength,
 
 void CharacterData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
     Node::reportMemoryUsage(memoryObjectInfo);
     info.addInstrumentedMember(m_data);
 }
diff --git a/Source/WebCore/dom/Comment.cpp b/Source/WebCore/dom/Comment.cpp
index 900bcd173..c2f0582ec 100644
--- a/Source/WebCore/dom/Comment.cpp
+++ b/Source/WebCore/dom/Comment.cpp
@@ -46,7 +46,7 @@ Node::NodeType Comment::nodeType() const
     return COMMENT_NODE;
 }
 
-PassRefPtr<Node> Comment::cloneNode(bool /*deep*/, ExceptionCode&)
+PassRefPtr<Node> Comment::cloneNode(bool /*deep*/)
 {
     return create(document(), data());
 }
diff --git a/Source/WebCore/dom/Comment.h b/Source/WebCore/dom/Comment.h
index e83445120..9db1f31fd 100644
--- a/Source/WebCore/dom/Comment.h
+++ b/Source/WebCore/dom/Comment.h
@@ -36,7 +36,7 @@ private:
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType) const;
 };
 
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index adafeb617..696c8432b 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -363,8 +363,9 @@ static void willRemoveChildren(ContainerNode* container)
 
         // fire removed from document mutation events.
         dispatchChildRemovalEvents(child);
-        ChildFrameDisconnector(child).disconnect();
     }
+
+    ChildFrameDisconnector(container, ChildFrameDisconnector::DoNotIncludeRoot).disconnect();
 }
 
 void ContainerNode::disconnectDescendantFrames()
@@ -395,13 +396,6 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
     }
 
     RefPtr<Node> child = oldChild;
-    willRemoveChild(child.get());
-
-    // Mutation events might have moved this child into a different parent.
-    if (child->parentNode() != this) {
-        ec = NOT_FOUND_ERR;
-        return false;
-    }
 
     document()->removeFocusedNodeOfSubtree(child.get());
 
@@ -416,6 +410,14 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
         return false;
     }
 
+    willRemoveChild(child.get());
+
+    // Mutation events might have moved this child into a different parent.
+    if (child->parentNode() != this) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+
     Node* prev = child->previousSibling();
     Node* next = child->nextSibling();
     removeBetween(prev, next, child.get());
@@ -481,10 +483,6 @@ void ContainerNode::removeChildren()
     // The container node can be removed from event handlers.
     RefPtr<ContainerNode> protect(this);
 
-    // Do any prep work needed before actually starting to detach
-    // and remove... e.g. stop loading frames, fire unload events.
-    willRemoveChildren(protect.get());
-
     // exclude this node when looking for removed focusedNode since only children will be removed
     document()->removeFocusedNodeOfSubtree(this, true);
 
@@ -492,6 +490,10 @@ void ContainerNode::removeChildren()
     document()->removeFullScreenElementOfSubtree(this, true);
 #endif
 
+    // Do any prep work needed before actually starting to detach
+    // and remove... e.g. stop loading frames, fire unload events.
+    willRemoveChildren(protect.get());
+
     forbidEventDispatch();
     Vector<RefPtr<Node>, 10> removedChildren;
     removedChildren.reserveInitialCapacity(childNodeCount());
@@ -718,135 +720,6 @@ void ContainerNode::cloneChildNodes(ContainerNode *clone)
     }
 }
 
-bool ContainerNode::getUpperLeftCorner(FloatPoint& point) const
-{
-    if (!renderer())
-        return false;
-    // What is this code really trying to do?
-    RenderObject *o = renderer();
-    RenderObject *p = o;
-
-    if (!o->isInline() || o->isReplaced()) {
-        point = o->localToAbsolute(FloatPoint(), false, true);
-        return true;
-    }
-
-    // find the next text/image child, to get a position
-    while (o) {
-        p = o;
-        if (o->firstChild())
-            o = o->firstChild();
-        else if (o->nextSibling())
-            o = o->nextSibling();
-        else {
-            RenderObject *next = 0;
-            while (!next && o->parent()) {
-                o = o->parent();
-                next = o->nextSibling();
-            }
-            o = next;
-
-            if (!o)
-                break;
-        }
-        ASSERT(o);
-
-        if (!o->isInline() || o->isReplaced()) {
-            point = o->localToAbsolute(FloatPoint(), false, true);
-            return true;
-        }
-
-        if (p->node() && p->node() == this && o->isText() && !o->isBR() && !toRenderText(o)->firstTextBox()) {
-                // do nothing - skip unrendered whitespace that is a child or next sibling of the anchor
-        } else if ((o->isText() && !o->isBR()) || o->isReplaced()) {
-            point = FloatPoint();
-            if (o->isText() && toRenderText(o)->firstTextBox()) {
-                point.move(toRenderText(o)->linesBoundingBox().x(),
-                           toRenderText(o)->firstTextBox()->root()->lineTop());
-            } else if (o->isBox()) {
-                RenderBox* box = toRenderBox(o);
-                point.moveBy(box->location());
-            }
-            point = o->container()->localToAbsolute(point, false, true);
-            return true;
-        }
-    }
-    
-    // If the target doesn't have any children or siblings that could be used to calculate the scroll position, we must be
-    // at the end of the document.  Scroll to the bottom. FIXME: who said anything about scrolling?
-    if (!o && document()->view()) {
-        point = FloatPoint(0, document()->view()->contentsHeight());
-        return true;
-    }
-    return false;
-}
-
-bool ContainerNode::getLowerRightCorner(FloatPoint& point) const
-{
-    if (!renderer())
-        return false;
-
-    RenderObject* o = renderer();
-    if (!o->isInline() || o->isReplaced()) {
-        RenderBox* box = toRenderBox(o);
-        point = o->localToAbsolute(LayoutPoint(box->size()), false, true);
-        return true;
-    }
-
-    // find the last text/image child, to get a position
-    while (o) {
-        if (o->lastChild())
-            o = o->lastChild();
-        else if (o->previousSibling())
-            o = o->previousSibling();
-        else {
-            RenderObject* prev = 0;
-            while (!prev) {
-                o = o->parent();
-                if (!o)
-                    return false;
-                prev = o->previousSibling();
-            }
-            o = prev;
-        }
-        ASSERT(o);
-        if (o->isText() || o->isReplaced()) {
-            point = FloatPoint();
-            if (o->isText()) {
-                RenderText* text = toRenderText(o);
-                IntRect linesBox = text->linesBoundingBox();
-                if (!linesBox.maxX() && !linesBox.maxY())
-                    continue;
-                point.moveBy(linesBox.maxXMaxYCorner());
-            } else {
-                RenderBox* box = toRenderBox(o);
-                point.moveBy(box->frameRect().maxXMaxYCorner());
-            }
-            point = o->container()->localToAbsolute(point, false, true);
-            return true;
-        }
-    }
-    return true;
-}
-
-LayoutRect ContainerNode::getRect() const
-{
-    FloatPoint  upperLeft, lowerRight;
-    bool foundUpperLeft = getUpperLeftCorner(upperLeft);
-    bool foundLowerRight = getLowerRightCorner(lowerRight);
-    
-    // If we've found one corner, but not the other,
-    // then we should just return a point at the corner that we did find.
-    if (foundUpperLeft != foundLowerRight) {
-        if (foundUpperLeft)
-            lowerRight = upperLeft;
-        else
-            upperLeft = lowerRight;
-    } 
-
-    return enclosingLayoutRect(FloatRect(upperLeft, lowerRight.expandedTo(upperLeft) - upperLeft));
-}
-
 void ContainerNode::setFocus(bool received)
 {
     if (focused() == received)
diff --git a/Source/WebCore/dom/ContainerNode.h b/Source/WebCore/dom/ContainerNode.h
index 8b924773e..743120abf 100644
--- a/Source/WebCore/dom/ContainerNode.h
+++ b/Source/WebCore/dom/ContainerNode.h
@@ -75,7 +75,6 @@ public:
 
     virtual void attach() OVERRIDE;
     virtual void detach() OVERRIDE;
-    virtual LayoutRect getRect() const OVERRIDE;
     virtual void setFocus(bool = true) OVERRIDE;
     virtual void setActive(bool active = true, bool pause = false) OVERRIDE;
     virtual void setHovered(bool = true) OVERRIDE;
@@ -103,7 +102,7 @@ public:
 
     virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
         Node::reportMemoryUsage(memoryObjectInfo);
         info.addInstrumentedMember(m_firstChild);
         info.addInstrumentedMember(m_lastChild);
@@ -132,9 +131,6 @@ private:
 
     static void dispatchPostAttachCallbacks();
 
-    bool getUpperLeftCorner(FloatPoint&) const;
-    bool getLowerRightCorner(FloatPoint&) const;
-
     Node* m_firstChild;
     Node* m_lastChild;
 };
diff --git a/Source/WebCore/dom/ContainerNodeAlgorithms.cpp b/Source/WebCore/dom/ContainerNodeAlgorithms.cpp
index 2edea30e0..f565adb4d 100644
--- a/Source/WebCore/dom/ContainerNodeAlgorithms.cpp
+++ b/Source/WebCore/dom/ContainerNodeAlgorithms.cpp
@@ -108,7 +108,7 @@ void ChildNodeRemovalNotifier::notifyDescendantRemovedFromTree(ContainerNode* no
 void ChildFrameDisconnector::collectDescendant(ElementShadow* shadow)
 {
     for (ShadowRoot* root = shadow->youngestShadowRoot(); root; root = root->olderShadowRoot())
-        collectDescendant(root);
+        collectDescendant(root, IncludeRoot);
 }
 
 void ChildFrameDisconnector::Target::disconnect()
diff --git a/Source/WebCore/dom/ContainerNodeAlgorithms.h b/Source/WebCore/dom/ContainerNodeAlgorithms.h
index 163295541..1358b05eb 100644
--- a/Source/WebCore/dom/ContainerNodeAlgorithms.h
+++ b/Source/WebCore/dom/ContainerNodeAlgorithms.h
@@ -268,13 +268,37 @@ inline void ChildNodeRemovalNotifier::notify(Node* node)
 
 class ChildFrameDisconnector {
 public:
-    explicit ChildFrameDisconnector(Node* root);
+    enum ShouldIncludeRoot {
+        DoNotIncludeRoot,
+        IncludeRoot
+    };
+
+    explicit ChildFrameDisconnector(Node* root, ShouldIncludeRoot shouldIncludeRoot = IncludeRoot)
+        : m_root(root)
+    {
+        collectDescendant(m_root, shouldIncludeRoot);
+        rootNodes().add(m_root);
+    }
+
+    ~ChildFrameDisconnector()
+    {
+        rootNodes().remove(m_root);
+    }
+
     void disconnect();
 
+    static bool nodeHasDisconnector(Node*);
+
 private:
-    void collectDescendant(Node* root);
+    void collectDescendant(Node* root, ShouldIncludeRoot);
     void collectDescendant(ElementShadow*);
 
+    static HashSet<Node*>& rootNodes()
+    {
+        DEFINE_STATIC_LOCAL(HashSet<Node*>, nodes, ());
+        return nodes;
+    }
+
     class Target {
     public:
         Target(HTMLFrameOwnerElement* element)
@@ -292,16 +316,13 @@ private:
     };
 
     Vector<Target, 10> m_list;
+    Node* m_root;
 };
 
-inline ChildFrameDisconnector::ChildFrameDisconnector(Node* root)
+inline void ChildFrameDisconnector::collectDescendant(Node* root, ShouldIncludeRoot shouldIncludeRoot)
 {
-    collectDescendant(root);
-}
-
-inline void ChildFrameDisconnector::collectDescendant(Node* root)
-{
-    for (Node* node = root; node; node = node->traverseNextNode(root)) {
+    for (Node* node = shouldIncludeRoot == IncludeRoot ? root : root->firstChild(); node;
+            node = node->traverseNextNode(root)) {
         if (!node->isElementNode())
             continue;
         Element* element = toElement(node);
@@ -322,6 +343,20 @@ inline void ChildFrameDisconnector::disconnect()
     }
 }
 
+inline bool ChildFrameDisconnector::nodeHasDisconnector(Node* node)
+{
+    HashSet<Node*>& nodes = rootNodes();
+
+    if (nodes.isEmpty())
+        return false;
+
+    for (; node; node = node->parentNode())
+        if (nodes.contains(node))
+            return true;
+
+    return false;
+}
+
 } // namespace WebCore
 
 #endif // ContainerNodeAlgorithms_h
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index be7bd07c1..fcb569540 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -48,6 +48,7 @@
 #include "CustomEvent.cpp"
 #include "DOMCoreException.cpp"
 #include "DOMImplementation.cpp"
+#include "DOMNamedFlowCollection.cpp"
 #include "DOMStringList.cpp"
 #include "DOMStringMap.cpp"
 #include "DatasetDOMStringMap.cpp"
@@ -99,6 +100,7 @@
 #include "MutationObserverRegistration.cpp"
 #include "MutationRecord.cpp"
 #include "NameNodeList.cpp"
+#include "NamedFlowCollection.cpp"
 #include "NodeFilter.cpp"
 #include "NodeFilterCondition.cpp"
 #include "NodeIterator.cpp"
@@ -146,7 +148,6 @@
 #include "ViewportArguments.cpp"
 #include "WebKitAnimationEvent.cpp"
 #include "WebKitNamedFlow.cpp"
-#include "WebKitNamedFlowCollection.cpp"
 #include "WebKitTransitionEvent.cpp"
 #include "WheelEvent.cpp"
 #include "WindowEventContext.cpp"
diff --git a/Source/WebCore/dom/DOMNamedFlowCollection.cpp b/Source/WebCore/dom/DOMNamedFlowCollection.cpp
new file mode 100644
index 000000000..30fbab3e7
--- /dev/null
+++ b/Source/WebCore/dom/DOMNamedFlowCollection.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include "config.h"
+#include "DOMNamedFlowCollection.h"
+
+#include "NamedFlowCollection.h"
+#include "WebKitNamedFlow.h"
+
+namespace WebCore {
+
+DOMNamedFlowCollection::DOMNamedFlowCollection(NamedFlowCollection::NamedFlowSet& set)
+{
+    m_namedFlows.swap(set);
+}
+
+unsigned long DOMNamedFlowCollection::length() const
+{
+    return m_namedFlows.size();
+}
+
+PassRefPtr<WebKitNamedFlow> DOMNamedFlowCollection::item(unsigned long index) const
+{
+    if (index >= static_cast<unsigned long>(m_namedFlows.size()))
+        return 0;
+    NamedFlowCollection::NamedFlowSet::const_iterator it = m_namedFlows.begin();
+    for (unsigned long i = 0; i < index; ++i)
+        ++it;
+    return *it;
+}
+
+PassRefPtr<WebKitNamedFlow> DOMNamedFlowCollection::namedItem(const AtomicString& name) const
+{
+    NamedFlowCollection::NamedFlowSet::const_iterator it = m_namedFlows.find<String, NamedFlowCollection::NamedFlowHashTranslator>(name);
+    if (it != m_namedFlows.end())
+        return *it;
+    return 0;
+}
+
+bool DOMNamedFlowCollection::hasNamedItem(const AtomicString& name) const
+{
+    return namedItem(name);
+}
+} // namespace WebCore
+
+
+
diff --git a/Source/WebCore/dom/WebKitNamedFlowCollection.h b/Source/WebCore/dom/DOMNamedFlowCollection.h
index bf01d4b84..02fb58cdc 100644
--- a/Source/WebCore/dom/WebKitNamedFlowCollection.h
+++ b/Source/WebCore/dom/DOMNamedFlowCollection.h
@@ -26,48 +26,36 @@
  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
+#ifndef DOMNamedFlowCollection_h
+#define DOMNamedFlowCollection_h
 
-#ifndef WebKitNamedFlowCollection_h
-#define WebKitNamedFlowCollection_h
-
-#include <wtf/Forward.h>
-#include <wtf/ListHashSet.h>
+#include "NamedFlowCollection.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
 
 namespace WebCore {
 
 class Document;
 class WebKitNamedFlow;
 
-class WebKitNamedFlowCollection : public RefCounted<WebKitNamedFlowCollection> {
+class DOMNamedFlowCollection : public RefCounted<DOMNamedFlowCollection> {
 public:
-    static PassRefPtr<WebKitNamedFlowCollection> create(Document* doc) { return adoptRef(new WebKitNamedFlowCollection(doc)); }
-
-    Vector<RefPtr<WebKitNamedFlow> > namedFlows();
-    WebKitNamedFlow* flowByName(const String&);
-    PassRefPtr<WebKitNamedFlow> ensureFlowWithName(const String&);
+    static PassRefPtr<DOMNamedFlowCollection> create(NamedFlowCollection::NamedFlowSet& set)
+    {
+        return adoptRef(new DOMNamedFlowCollection(set));
+    }
 
-    void discardNamedFlow(WebKitNamedFlow*);
+    unsigned long length() const;
+    PassRefPtr<WebKitNamedFlow> item(unsigned long index) const;
+    PassRefPtr<WebKitNamedFlow> namedItem(const AtomicString& name) const;
 
-    void documentDestroyed();
-
-    Document* document() const { return m_document; }
+    bool hasNamedItem(const AtomicString& name) const;
 
 private:
-    explicit WebKitNamedFlowCollection(Document*);
-
-    Document* m_document;
-
-    struct NamedFlowHashFunctions;
-    struct NamedFlowHashTranslator;
-
-    typedef ListHashSet<WebKitNamedFlow*, 1, NamedFlowHashFunctions> NamedFlowSet;
-
-    NamedFlowSet m_namedFlows;
+    explicit DOMNamedFlowCollection(NamedFlowCollection::NamedFlowSet&);
+    NamedFlowCollection::NamedFlowSet m_namedFlows;
 };
 
 } // namespace WebCore
+#endif
 
-#endif // WebKitNamedFlowCollection_h
diff --git a/Source/WebCore/dom/DOMNamedFlowCollection.idl b/Source/WebCore/dom/DOMNamedFlowCollection.idl
new file mode 100644
index 000000000..3e9f3a18c
--- /dev/null
+++ b/Source/WebCore/dom/DOMNamedFlowCollection.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=CSS_REGIONS,
+        InterfaceName=WebKitNamedFlowCollection,
+        JSGenerateToJSObject,
+        IndexedGetter,
+        NamedGetter
+    ] DOMNamedFlowCollection {
+        readonly attribute unsigned long length;
+        WebKitNamedFlow item(in unsigned long index);
+        WebKitNamedFlow namedItem(in DOMString name);
+    };
+}
+
diff --git a/Source/WebCore/dom/DOMStringList.h b/Source/WebCore/dom/DOMStringList.h
index 464fa22db..d365799bc 100644
--- a/Source/WebCore/dom/DOMStringList.h
+++ b/Source/WebCore/dom/DOMStringList.h
@@ -26,10 +26,10 @@
 #ifndef DOMStringList_h
 #define DOMStringList_h
 
-#include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/DOMStringMap.h b/Source/WebCore/dom/DOMStringMap.h
index 772a700f0..2b29f22c4 100644
--- a/Source/WebCore/dom/DOMStringMap.h
+++ b/Source/WebCore/dom/DOMStringMap.h
@@ -26,9 +26,9 @@
 #ifndef DOMStringMap_h
 #define DOMStringMap_h
 
-#include "PlatformString.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index b495e22f7..9780f246d 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -47,6 +47,7 @@
 #include "ContextFeatures.h"
 #include "CookieJar.h"
 #include "DOMImplementation.h"
+#include "DOMNamedFlowCollection.h"
 #include "DOMSelection.h"
 #include "DOMWindow.h"
 #include "DateComponents.h"
@@ -107,9 +108,9 @@
 #include "Logging.h"
 #include "MediaQueryList.h"
 #include "MediaQueryMatcher.h"
-#include "MemoryInstrumentation.h"
 #include "MouseEventWithHitTestResults.h"
 #include "NameNodeList.h"
+#include "NamedFlowCollection.h"
 #include "NestingLevelIncrementer.h"
 #include "NewXMLDocumentParser.h"
 #include "NodeFilter.h"
@@ -154,8 +155,8 @@
 #include "TreeWalker.h"
 #include "UndoManager.h"
 #include "UserContentURLPattern.h"
+#include "WebCoreMemoryInstrumentation.h"
 #include "WebKitNamedFlow.h"
-#include "WebKitNamedFlowCollection.h"
 #include "XMLDocumentParser.h"
 #include "XMLHttpRequest.h"
 #include "XMLNSNames.h"
@@ -1157,12 +1158,23 @@ PassRefPtr<WebKitNamedFlow> Document::webkitGetFlowByName(const String& flowName
 
     return namedFlows()->flowByName(flowName);
 }
+
+PassRefPtr<DOMNamedFlowCollection> Document::webkitGetNamedFlows()
+{
+    if (!cssRegionsEnabled() || !renderer())
+        return 0;
+
+    updateStyleIfNeeded();
+
+    return namedFlows()->createCSSOMSnapshot();
+}
+
 #endif
 
-WebKitNamedFlowCollection* Document::namedFlows()
+NamedFlowCollection* Document::namedFlows()
 {
     if (!m_namedFlows)
-        m_namedFlows = WebKitNamedFlowCollection::create(this);
+        m_namedFlows = NamedFlowCollection::create(this);
 
     return m_namedFlows.get();
 }
@@ -1184,9 +1196,9 @@ PassRefPtr<Element> Document::createElementNS(const String& namespaceURI, const
 
 String Document::readyState() const
 {
-    DEFINE_STATIC_LOCAL(const String, loading, ("loading"));
-    DEFINE_STATIC_LOCAL(const String, interactive, ("interactive"));
-    DEFINE_STATIC_LOCAL(const String, complete, ("complete"));
+    DEFINE_STATIC_LOCAL(const String, loading, (ASCIILiteral("loading")));
+    DEFINE_STATIC_LOCAL(const String, interactive, (ASCIILiteral("interactive")));
+    DEFINE_STATIC_LOCAL(const String, complete, (ASCIILiteral("complete")));
 
     switch (m_readyState) {
     case Loading:
@@ -1372,7 +1384,7 @@ String Document::suggestedMIMEType() const
 // * making it receive a rect as parameter, i.e. nodesFromRect(x, y, w, h);
 // * making it receive the expading size of each direction separately,
 //   i.e. nodesFromRect(x, y, topSize, rightSize, bottomSize, leftSize);
-PassRefPtr<NodeList> Document::nodesFromRect(int centerX, int centerY, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding, bool ignoreClipping, bool allowShadowContent) const
+PassRefPtr<NodeList> Document::nodesFromRect(int centerX, int centerY, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding, HitTestRequest::HitTestRequestType hitType) const
 {
     // FIXME: Share code between this, elementFromPoint and caretRangeFromPoint.
     if (!renderer())
@@ -1387,16 +1399,12 @@ PassRefPtr<NodeList> Document::nodesFromRect(int centerX, int centerY, unsigned
     float zoomFactor = frame->pageZoomFactor();
     LayoutPoint point = roundedLayoutPoint(FloatPoint(centerX * zoomFactor + view()->scrollX(), centerY * zoomFactor + view()->scrollY()));
 
-    int type = HitTestRequest::ReadOnly | HitTestRequest::Active;
+    HitTestRequest request(hitType);
 
     // When ignoreClipping is false, this method returns null for coordinates outside of the viewport.
-    if (ignoreClipping)
-        type |= HitTestRequest::IgnoreClipping;
-    else if (!frameView->visibleContentRect().intersects(HitTestResult::rectForPoint(point, topPadding, rightPadding, bottomPadding, leftPadding)))
+    if (!request.ignoreClipping() && !frameView->visibleContentRect().intersects(HitTestResult::rectForPoint(point, topPadding, rightPadding, bottomPadding, leftPadding)))
         return 0;
 
-    HitTestRequest request(type);
-
     // Passing a zero padding will trigger a rect hit test, however for the purposes of nodesFromRect,
     // we special handle this case in order to return a valid NodeList.
     if (!topPadding && !rightPadding && !bottomPadding && !leftPadding) {
@@ -1404,8 +1412,7 @@ PassRefPtr<NodeList> Document::nodesFromRect(int centerX, int centerY, unsigned
         return handleZeroPadding(request, result);
     }
 
-    enum ShadowContentFilterPolicy shadowContentFilterPolicy = allowShadowContent ? AllowShadowContent : DoNotAllowShadowContent;
-    HitTestResult result(point, topPadding, rightPadding, bottomPadding, leftPadding, shadowContentFilterPolicy);
+    HitTestResult result(point, topPadding, rightPadding, bottomPadding, leftPadding);
     renderView()->hitTest(request, result);
 
     return StaticHashSetNodeList::adopt(result.rectBasedTestResult());
@@ -1786,10 +1793,9 @@ bool Document::childNeedsAndNotInStyleRecalc()
 void Document::recalcStyle(StyleChange change)
 {
     // we should not enter style recalc while painting
-    if (view() && view()->isPainting()) {
-        ASSERT(!view()->isPainting());
+    ASSERT(!view() || !view()->isPainting());
+    if (view() && view()->isPainting())
         return;
-    }
     
     if (m_inStyleRecalc)
         return; // Guard against re-entrancy. -dwh
@@ -3051,7 +3057,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
                 frameLoader->stopAllLoaders();
                 frame->navigationScheduler()->scheduleLocationChange(securityOrigin(), blankURL(), String());
 
-                DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to display document because display forbidden by X-Frame-Options.\n"));
+                DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to display document because display forbidden by X-Frame-Options.\n")));
                 addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage);
             }
         }
@@ -3285,7 +3291,7 @@ bool Document::canReplaceChild(Node* newChild, Node* oldChild)
     return true;
 }
 
-PassRefPtr<Node> Document::cloneNode(bool /*deep*/, ExceptionCode&)
+PassRefPtr<Node> Document::cloneNode(bool /*deep*/)
 {
     // Spec says cloning Document nodes is "implementation dependent"
     // so we do not support it...
@@ -4874,6 +4880,10 @@ void Document::finishedParsing()
 
         InspectorInstrumentation::domContentLoadedEventFired(f.get());
     }
+
+    // The ElementAttributeData sharing cache is only used during parsing since
+    // that's when the majority of immutable attribute data will be created.
+    m_immutableAttributeDataCache.clear();
 }
 
 PassRefPtr<XPathExpression> Document::createExpression(const String& expression,
@@ -5025,8 +5035,7 @@ void Document::initSecurityContext()
                 securityOrigin()->enforceFilePathSeparation();
             }
         }
-        if (settings->thirdPartyStorageBlockingEnabled())
-            securityOrigin()->blockThirdPartyStorage();
+        securityOrigin()->setStorageBlockingPolicy(settings->storageBlockingPolicy());
     }
 
     Document* parentDocument = ownerElement() ? ownerElement()->document() : 0;
@@ -5854,7 +5863,7 @@ void Document::webkitExitPointerLock()
 
 Element* Document::webkitPointerLockElement() const
 {
-    if (!page())
+    if (!page() || page()->pointerLockController()->lockPending())
         return 0;
     if (Element* element = page()->pointerLockController()->element()) {
         if (element->document() == this)
@@ -6105,7 +6114,7 @@ void Document::setContextFeatures(PassRefPtr<ContextFeatures> features)
 
 void Document::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
     info.addInstrumentedMember(m_styleResolver);
     ContainerNode::reportMemoryUsage(memoryObjectInfo);
     info.addVector(m_customFonts);
@@ -6160,4 +6169,73 @@ PassRefPtr<UndoManager> Document::undoManager()
 }
 #endif
 
+class ImmutableAttributeDataCacheKey {
+public:
+    ImmutableAttributeDataCacheKey()
+        : m_localName(0)
+        , m_attributes(0)
+        , m_attributeCount(0)
+    { }
+
+    ImmutableAttributeDataCacheKey(const AtomicString& localName, const Attribute* attributes, unsigned attributeCount)
+        : m_localName(localName.impl())
+        , m_attributes(attributes)
+        , m_attributeCount(attributeCount)
+    { }
+
+    bool operator!=(const ImmutableAttributeDataCacheKey& other) const
+    {
+        if (m_localName != other.m_localName)
+            return true;
+        if (m_attributeCount != other.m_attributeCount)
+            return true;
+        return memcmp(m_attributes, other.m_attributes, sizeof(Attribute) * m_attributeCount);
+    }
+
+    unsigned hash() const
+    {
+        unsigned attributeHash = StringHasher::hashMemory(m_attributes, m_attributeCount * sizeof(Attribute));
+        return WTF::intHash((static_cast<uint64_t>(m_localName->existingHash()) << 32 | attributeHash));
+    }
+
+private:
+    AtomicStringImpl* m_localName;
+    const Attribute* m_attributes;
+    unsigned m_attributeCount;
+};
+
+struct ImmutableAttributeDataCacheEntry {
+    ImmutableAttributeDataCacheKey key;
+    RefPtr<ElementAttributeData> value;
+};
+
+PassRefPtr<ElementAttributeData> Document::cachedImmutableAttributeData(const Element* element, const Vector<Attribute>& attributes)
+{
+    ASSERT(!attributes.isEmpty());
+
+    ImmutableAttributeDataCacheKey cacheKey(element->localName(), attributes.data(), attributes.size());
+    unsigned cacheHash = cacheKey.hash();
+
+    ImmutableAttributeDataCache::iterator cacheIterator = m_immutableAttributeDataCache.add(cacheHash, nullptr).iterator;
+    if (cacheIterator->second && cacheIterator->second->key != cacheKey)
+        cacheHash = 0;
+
+    RefPtr<ElementAttributeData> attributeData;
+    if (cacheHash && cacheIterator->second)
+        attributeData = cacheIterator->second->value;
+    else
+        attributeData = ElementAttributeData::createImmutable(attributes);
+
+    if (!cacheHash || cacheIterator->second)
+        return attributeData.release();
+
+    OwnPtr<ImmutableAttributeDataCacheEntry> newEntry = adoptPtr(new ImmutableAttributeDataCacheEntry);
+    newEntry->key = ImmutableAttributeDataCacheKey(element->localName(), const_cast<const ElementAttributeData*>(attributeData.get())->attributeItem(0), attributeData->length());
+    newEntry->value = attributeData;
+
+    cacheIterator->second = newEntry.release();
+
+    return attributeData.release();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index a0419aa39..dafe04be3 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -34,6 +34,7 @@
 #include "DOMTimeStamp.h"
 #include "DocumentEventQueue.h"
 #include "DocumentTiming.h"
+#include "HitTestRequest.h"
 #include "IconURL.h"
 #include "InspectorCounters.h"
 #include "IntRect.h"
@@ -69,6 +70,7 @@ class CharacterData;
 class Comment;
 class ContextFeatures;
 class DOMImplementation;
+class DOMNamedFlowCollection;
 class DOMSelection;
 class DOMWindow;
 class Database;
@@ -82,6 +84,7 @@ class DocumentWeakReference;
 class DynamicNodeListCacheBase;
 class EditingText;
 class Element;
+class ElementAttributeData;
 class EntityReference;
 class Event;
 class EventListener;
@@ -110,6 +113,7 @@ class MediaCanStartListener;
 class MediaQueryList;
 class MediaQueryMatcher;
 class MouseEventWithHitTestResults;
+class NamedFlowCollection;
 class NodeFilter;
 class NodeIterator;
 class NodeRareData;
@@ -138,7 +142,6 @@ class TextResourceDecoder;
 class TreeWalker;
 class UndoManager;
 class WebKitNamedFlow;
-class WebKitNamedFlowCollection;
 class XMLHttpRequest;
 class XPathEvaluator;
 class XPathExpression;
@@ -205,6 +208,9 @@ enum NodeListInvalidationType {
 };
 const int numNodeListInvalidationTypes = InvalidateOnAnyAttrChange + 1;
 
+struct ImmutableAttributeDataCacheEntry;
+typedef HashMap<unsigned, OwnPtr<ImmutableAttributeDataCacheEntry>, AlreadyHashed> ImmutableAttributeDataCache;
+
 class Document : public ContainerNode, public TreeScope, public ScriptExecutionContext {
 public:
     static PassRefPtr<Document> create(Frame* frame, const KURL& url)
@@ -352,9 +358,10 @@ public:
     bool cssRegionsEnabled() const;
 #if ENABLE(CSS_REGIONS)
     PassRefPtr<WebKitNamedFlow> webkitGetFlowByName(const String&);
+    PassRefPtr<DOMNamedFlowCollection> webkitGetNamedFlows();
 #endif
 
-    WebKitNamedFlowCollection* namedFlows();
+    NamedFlowCollection* namedFlows();
 
     bool regionBasedColumnsEnabled() const;
 
@@ -370,11 +377,10 @@ public:
      * @param rightPadding How much to expand the right of the rectangle
      * @param bottomPadding How much to expand the bottom of the rectangle
      * @param leftPadding How much to expand the left of the rectangle
-     * @param ignoreClipping whether or not to ignore the root scroll frame when retrieving the element.
-     *        If false, this method returns null for coordinates outside of the viewport.
      */
-    PassRefPtr<NodeList> nodesFromRect(int centerX, int centerY, unsigned topPadding, unsigned rightPadding,
-                                       unsigned bottomPadding, unsigned leftPadding, bool ignoreClipping, bool allowShadowContent) const;
+    PassRefPtr<NodeList> nodesFromRect(int centerX, int centerY,
+                                       unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding,
+                                       HitTestRequest::HitTestRequestType hitType = HitTestRequest::ReadOnly | HitTestRequest::Active) const;
     Element* elementFromPoint(int x, int y) const;
     PassRefPtr<Range> caretRangeFromPoint(int x, int y);
 
@@ -1181,6 +1187,8 @@ public:
 
     virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
 
+    PassRefPtr<ElementAttributeData> cachedImmutableAttributeData(const Element*, const Vector<Attribute>&);
+
 protected:
     Document(Frame*, const KURL&, bool isXHTML, bool isHTML);
 
@@ -1206,7 +1214,7 @@ private:
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual bool childTypeAllowed(NodeType) const;
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool canReplaceChild(Node* newChild, Node* oldChild);
 
     virtual void refScriptExecutionContext() { ref(); }
@@ -1560,12 +1568,14 @@ private:
     bool m_visualUpdatesAllowed;
     Timer<Document> m_visualUpdatesSuppressionTimer;
 
-    RefPtr<WebKitNamedFlowCollection> m_namedFlows;
+    RefPtr<NamedFlowCollection> m_namedFlows;
 
 #if ENABLE(CSP_NEXT)
     RefPtr<DOMSecurityPolicy> m_domSecurityPolicy;
 #endif
 
+    ImmutableAttributeDataCache m_immutableAttributeDataCache;
+
 #ifndef NDEBUG
     bool m_didDispatchViewportPropertiesChanged;
 #endif
diff --git a/Source/WebCore/dom/Document.idl b/Source/WebCore/dom/Document.idl
index b83f40c99..bba432204 100644
--- a/Source/WebCore/dom/Document.idl
+++ b/Source/WebCore/dom/Document.idl
@@ -268,9 +268,8 @@ module core {
         [Conditional=POINTER_LOCK, V8EnabledAtRuntime=pointerLock] void webkitExitPointerLock();
         readonly attribute [Conditional=POINTER_LOCK, V8EnabledAtRuntime=pointerLock] Element webkitPointerLockElement;
 
-#if defined(ENABLE_CSS_REGIONS) && ENABLE_CSS_REGIONS
-        WebKitNamedFlow webkitGetFlowByName(in DOMString name);
-#endif
+        [Conditional=CSS_REGIONS] WebKitNamedFlow webkitGetFlowByName(in DOMString name);
+        [Conditional=CSS_REGIONS] DOMNamedFlowCollection webkitGetNamedFlows();
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         // Event handler DOM attributes
diff --git a/Source/WebCore/dom/DocumentEventQueue.cpp b/Source/WebCore/dom/DocumentEventQueue.cpp
index f9a717e40..6396f0124 100644
--- a/Source/WebCore/dom/DocumentEventQueue.cpp
+++ b/Source/WebCore/dom/DocumentEventQueue.cpp
@@ -31,10 +31,10 @@
 #include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
-#include "MemoryInstrumentation.h"
 #include "RuntimeApplicationChecks.h"
 #include "ScriptExecutionContext.h"
 #include "SuspendableTimer.h"
+#include "WebCoreMemoryInstrumentation.h"
 
 namespace WebCore {
     
@@ -110,7 +110,7 @@ void DocumentEventQueue::enqueueOrDispatchScrollEvent(PassRefPtr<Node> target, S
 
 void DocumentEventQueue::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
     info.addMember(m_pendingEventTimer);
     info.addInstrumentedHashSet(m_queuedEvents);
     info.addInstrumentedHashSet(m_nodesWithQueuedScrollEvents);
diff --git a/Source/WebCore/dom/DocumentFragment.cpp b/Source/WebCore/dom/DocumentFragment.cpp
index 77ebc2bdf..f7cfadfcc 100644
--- a/Source/WebCore/dom/DocumentFragment.cpp
+++ b/Source/WebCore/dom/DocumentFragment.cpp
@@ -68,7 +68,7 @@ bool DocumentFragment::childTypeAllowed(NodeType type) const
     }
 }
 
-PassRefPtr<Node> DocumentFragment::cloneNode(bool deep, ExceptionCode&)
+PassRefPtr<Node> DocumentFragment::cloneNode(bool deep)
 {
     RefPtr<DocumentFragment> clone = create(document());
     if (deep)
diff --git a/Source/WebCore/dom/DocumentFragment.h b/Source/WebCore/dom/DocumentFragment.h
index cefe1388b..3af5f1b28 100644
--- a/Source/WebCore/dom/DocumentFragment.h
+++ b/Source/WebCore/dom/DocumentFragment.h
@@ -44,7 +44,7 @@ protected:
 
 private:
     virtual NodeType nodeType() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType) const;
 };
 
diff --git a/Source/WebCore/dom/DocumentMarker.h b/Source/WebCore/dom/DocumentMarker.h
index c1e738d43..3faa19039 100644
--- a/Source/WebCore/dom/DocumentMarker.h
+++ b/Source/WebCore/dom/DocumentMarker.h
@@ -23,11 +23,10 @@
 #ifndef DocumentMarker_h
 #define DocumentMarker_h
 
-#include "PlatformString.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
-
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/DocumentMarkerController.h b/Source/WebCore/dom/DocumentMarkerController.h
index 8dd2b04ff..d9ad012b8 100644
--- a/Source/WebCore/dom/DocumentMarkerController.h
+++ b/Source/WebCore/dom/DocumentMarkerController.h
@@ -28,6 +28,7 @@
 #define DocumentMarkerController_h
 
 #include "DocumentMarker.h"
+#include "IntRect.h"
 #include "LayoutTypes.h"
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
diff --git a/Source/WebCore/dom/DocumentType.cpp b/Source/WebCore/dom/DocumentType.cpp
index 29b5c7d44..cd1d48534 100644
--- a/Source/WebCore/dom/DocumentType.cpp
+++ b/Source/WebCore/dom/DocumentType.cpp
@@ -51,7 +51,7 @@ Node::NodeType DocumentType::nodeType() const
     return DOCUMENT_TYPE_NODE;
 }
 
-PassRefPtr<Node> DocumentType::cloneNode(bool /*deep*/, ExceptionCode&)
+PassRefPtr<Node> DocumentType::cloneNode(bool /*deep*/)
 {
     return create(document(), m_name, m_publicId, m_systemId);
 }
diff --git a/Source/WebCore/dom/DocumentType.h b/Source/WebCore/dom/DocumentType.h
index 65416164c..6c6412459 100644
--- a/Source/WebCore/dom/DocumentType.h
+++ b/Source/WebCore/dom/DocumentType.h
@@ -52,7 +52,7 @@ private:
     virtual KURL baseURI() const;
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
 
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
     virtual void removedFrom(ContainerNode*) OVERRIDE;
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 04bc20b0b..5372c2228 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -170,7 +170,7 @@ DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(Element, error);
 DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(Element, focus);
 DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(Element, load);
 
-PassRefPtr<Node> Element::cloneNode(bool deep, ExceptionCode&)
+PassRefPtr<Node> Element::cloneNode(bool deep)
 {
     return deep ? cloneElementWithChildren() : cloneElementWithoutChildren();
 }
@@ -283,7 +283,7 @@ void Element::scrollIntoView(bool alignToTop)
     if (!renderer())
         return;
 
-    LayoutRect bounds = getRect();
+    LayoutRect bounds = boundingBox();
     // Align to the top / bottom and to the closest edge.
     if (alignToTop)
         renderer()->scrollRectToVisible(bounds, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
@@ -298,7 +298,7 @@ void Element::scrollIntoViewIfNeeded(bool centerIfNeeded)
     if (!renderer())
         return;
 
-    LayoutRect bounds = getRect();
+    LayoutRect bounds = boundingBox();
     if (centerIfNeeded)
         renderer()->scrollRectToVisible(bounds, ScrollAlignment::alignCenterIfNeeded, ScrollAlignment::alignCenterIfNeeded);
     else
@@ -532,7 +532,7 @@ IntRect Element::boundsInRootViewSpace()
         // Get the bounding rectangle from the SVG model.
         SVGElement* svgElement = static_cast<SVGElement*>(this);
         FloatRect localRect;
-        if (svgElement->boundingBox(localRect))
+        if (svgElement->getBoundingBox(localRect))
             quads.append(renderer()->localToAbsoluteQuad(localRect));
     } else
 #endif
@@ -580,7 +580,7 @@ PassRefPtr<ClientRect> Element::getBoundingClientRect()
         // Get the bounding rectangle from the SVG model.
         SVGElement* svgElement = static_cast<SVGElement*>(this);
         FloatRect localRect;
-        if (svgElement->boundingBox(localRect))
+        if (svgElement->getBoundingBox(localRect))
             quads.append(renderer()->localToAbsoluteQuad(localRect));
     } else
 #endif
@@ -823,7 +823,15 @@ void Element::parserSetAttributes(const Vector<Attribute>& attributeVector, Frag
         }
     }
 
-    m_attributeData = ElementAttributeData::createImmutable(filteredAttributes);
+    // When the document is in parsing state, we cache immutable ElementAttributeData objects with the
+    // input attribute vector as key. (This cache is held by Document.)
+    if (!document() || !document()->parsing())
+        m_attributeData = ElementAttributeData::createImmutable(filteredAttributes);
+    else if (!isHTMLElement()) {
+        // FIXME: Support attribute data sharing for non-HTML elements.
+        m_attributeData = ElementAttributeData::createImmutable(filteredAttributes);
+    } else
+        m_attributeData = document()->cachedImmutableAttributeData(this, filteredAttributes);
 
     // Iterate over the set of attributes we already have on the stack in case
     // attributeChanged mutates m_attributeData.
@@ -1389,31 +1397,28 @@ void Element::finishParsingChildren()
 #ifndef NDEBUG
 void Element::formatForDebugger(char* buffer, unsigned length) const
 {
-    String result;
+    StringBuilder result;
     String s;
-    
-    s = nodeName();
-    if (s.length() > 0) {
-        result += s;
-    }
-          
+
+    result.append(nodeName());
+
     s = getIdAttribute();
     if (s.length() > 0) {
         if (result.length() > 0)
-            result += "; ";
-        result += "id=";
-        result += s;
+            result.appendLiteral("; ");
+        result.appendLiteral("id=");
+        result.append(s);
     }
-          
+
     s = getAttribute(classAttr);
     if (s.length() > 0) {
         if (result.length() > 0)
-            result += "; ";
-        result += "class=";
-        result += s;
+            result.appendLiteral("; ");
+        result.appendLiteral("class=");
+        result.append(s);
     }
-          
-    strncpy(buffer, result.utf8().data(), length - 1);
+
+    strncpy(buffer, result.toString().utf8().data(), length - 1);
 }
 #endif
 
@@ -1439,20 +1444,14 @@ PassRefPtr<Attr> Element::setAttributeNode(Attr* attr, ExceptionCode& ec)
     ElementAttributeData* attributeData = mutableAttributeData();
 
     size_t index = attributeData->getAttributeItemIndex(attr->qualifiedName());
-    Attribute* oldAttribute = index != notFound ? attributeData->attributeItem(index) : 0;
-
-    if (!oldAttribute) {
-        attributeData->addAttribute(Attribute(attr->qualifiedName(), attr->value()), this);
-        attributeData->setAttr(this, attr->qualifiedName(), attr);
-        return 0;
+    if (index != notFound) {
+        if (oldAttr)
+            oldAttr->detachFromElementWithValue(attributeData->attributeItem(index)->value());
+        else
+            oldAttr = Attr::create(document(), attr->qualifiedName(), attributeData->attributeItem(index)->value());
     }
 
-    if (oldAttr)
-        oldAttr->detachFromElementWithValue(oldAttribute->value());
-    else
-        oldAttr = Attr::create(document(), oldAttribute->name(), oldAttribute->value());
-
-    attributeData->replaceAttribute(index, Attribute(attr->name(), attr->value()), this);
+    setAttributeInternal(index, attr->qualifiedName(), attr->value(), NotInSynchronizationOfLazyAttribute);
     attributeData->setAttr(this, attr->qualifiedName(), attr);
     return oldAttr.release();
 }
@@ -1640,7 +1639,7 @@ void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
             frame->selection()->revealSelection();
         }
     } else if (renderer() && !renderer()->isWidget())
-        renderer()->scrollRectToVisible(getRect());
+        renderer()->scrollRectToVisible(boundingBox());
 }
 
 void Element::blur()
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index f79227e9e..ce505463c 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -275,6 +275,7 @@ public:
     ElementShadow* shadow() const;
     ElementShadow* ensureShadow();
     virtual void willAddAuthorShadowRoot() { }
+    virtual bool areAuthorShadowsAllowed() const { return true; }
 
     ShadowRoot* userAgentShadowRoot() const;
 
@@ -303,7 +304,7 @@ public:
 
     virtual void focus(bool restorePreviousSelection = true);
     virtual void updateFocusAppearance(bool restorePreviousSelection);
-    void blur();
+    virtual void blur();
 
     String innerText();
     String outerText();
@@ -436,7 +437,7 @@ public:
 
     virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
         ContainerNode::reportMemoryUsage(memoryObjectInfo);
         info.addInstrumentedMember(m_tagName);
         info.addInstrumentedMember(m_attributeData);
@@ -500,7 +501,7 @@ private:
     
     // cloneNode is private so that non-virtual cloneElementWithChildren and cloneElementWithoutChildren
     // are used instead.
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual PassRefPtr<Element> cloneElementWithoutAttributesAndChildren();
 
     QualifiedName m_tagName;
@@ -519,7 +520,7 @@ private:
     ElementRareData* elementRareData() const;
     ElementRareData* ensureElementRareData();
 
-    OwnPtr<ElementAttributeData> m_attributeData;
+    RefPtr<ElementAttributeData> m_attributeData;
 };
     
 inline Element* toElement(Node* node)
diff --git a/Source/WebCore/dom/ElementAttributeData.cpp b/Source/WebCore/dom/ElementAttributeData.cpp
index 471e519e0..1db20f954 100644
--- a/Source/WebCore/dom/ElementAttributeData.cpp
+++ b/Source/WebCore/dom/ElementAttributeData.cpp
@@ -29,8 +29,8 @@
 #include "Attr.h"
 #include "CSSParser.h"
 #include "CSSStyleSheet.h"
-#include "MemoryInstrumentation.h"
 #include "StyledElement.h"
+#include "WebCoreMemoryInstrumentation.h"
 
 namespace WebCore {
 
@@ -39,10 +39,10 @@ static size_t immutableElementAttributeDataSize(unsigned count)
     return sizeof(ElementAttributeData) - sizeof(void*) + sizeof(Attribute) * count;
 }
 
-PassOwnPtr<ElementAttributeData> ElementAttributeData::createImmutable(const Vector<Attribute>& attributes)
+PassRefPtr<ElementAttributeData> ElementAttributeData::createImmutable(const Vector<Attribute>& attributes)
 {
     void* slot = WTF::fastMalloc(immutableElementAttributeDataSize(attributes.size()));
-    return adoptPtr(new (slot) ElementAttributeData(attributes));
+    return adoptRef(new (slot) ElementAttributeData(attributes));
 }
 
 ElementAttributeData::ElementAttributeData()
@@ -62,17 +62,21 @@ ElementAttributeData::ElementAttributeData(const Vector<Attribute>& attributes)
 }
 
 ElementAttributeData::ElementAttributeData(const ElementAttributeData& other)
-    : m_inlineStyleDecl(other.m_inlineStyleDecl)
+    : RefCounted<ElementAttributeData>()
+    , m_isMutable(true)
+    , m_arraySize(0)
+    , m_inlineStyleDecl(other.m_inlineStyleDecl)
     , m_attributeStyle(other.m_attributeStyle)
     , m_classNames(other.m_classNames)
     , m_idForStyleResolution(other.m_idForStyleResolution)
-    , m_isMutable(true)
-    , m_arraySize(0)
     , m_mutableAttributeVector(new Vector<Attribute, 4>)
 {
     // This copy constructor should only be used by makeMutable() to go from immutable to mutable.
     ASSERT(!other.m_isMutable);
 
+    // An immutable ElementAttributeData should never have a mutable inline StylePropertySet attached.
+    ASSERT(!other.m_inlineStyleDecl || !other.m_inlineStyleDecl->isMutable());
+
     const Attribute* otherBuffer = reinterpret_cast<const Attribute*>(&other.m_attributes);
     for (unsigned i = 0; i < other.m_arraySize; ++i)
         m_mutableAttributeVector->append(otherBuffer[i]);
@@ -294,7 +298,7 @@ void ElementAttributeData::detachAttrObjectsFromElement(Element* element) const
 void ElementAttributeData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
     size_t actualSize = m_isMutable ? sizeof(ElementAttributeData) : immutableElementAttributeDataSize(m_arraySize);
-    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM, actualSize);
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM, actualSize);
     info.addInstrumentedMember(m_inlineStyleDecl);
     info.addInstrumentedMember(m_attributeStyle);
     info.addMember(m_classNames);
@@ -363,9 +367,7 @@ void ElementAttributeData::cloneDataFrom(const ElementAttributeData& sourceData,
     }
 
     if (targetElement.isStyledElement() && sourceData.m_inlineStyleDecl) {
-        StylePropertySet* inlineStyle = ensureMutableInlineStyle(static_cast<StyledElement*>(&targetElement));
-        inlineStyle->copyPropertiesFrom(*sourceData.m_inlineStyleDecl);
-        inlineStyle->setCSSParserMode(sourceData.m_inlineStyleDecl->cssParserMode());
+        m_inlineStyleDecl = sourceData.m_inlineStyleDecl->immutableCopyIfNeeded();
         targetElement.setIsStyleAttributeValid(sourceElement.isStyleAttributeValid());
     }
 }
@@ -381,17 +383,6 @@ void ElementAttributeData::clearAttributes(Element* element)
     m_mutableAttributeVector->clear();
 }
 
-void ElementAttributeData::replaceAttribute(size_t index, const Attribute& attribute, Element* element)
-{
-    ASSERT(isMutable());
-    ASSERT(element);
-    ASSERT(index < length());
-
-    element->willModifyAttribute(attribute.name(), m_mutableAttributeVector->at(index).value(), attribute.value());
-    (*m_mutableAttributeVector)[index] = attribute;
-    element->didModifyAttribute(attribute);
-}
-
 PassRefPtr<Attr> ElementAttributeData::getAttributeNode(const String& name, bool shouldIgnoreAttributeCase, Element* element) const
 {
     ASSERT(element);
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index b96b95b54..72125f6fe 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -39,11 +39,11 @@ class MemoryObjectInfo;
 
 enum SynchronizationOfLazyAttribute { NotInSynchronizationOfLazyAttribute, InSynchronizationOfLazyAttribute };
 
-class ElementAttributeData {
+class ElementAttributeData : public RefCounted<ElementAttributeData> {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<ElementAttributeData> create() { return adoptPtr(new ElementAttributeData); }
-    static PassOwnPtr<ElementAttributeData> createImmutable(const Vector<Attribute>&);
+    static PassRefPtr<ElementAttributeData> create() { return adoptRef(new ElementAttributeData); }
+    static PassRefPtr<ElementAttributeData> createImmutable(const Vector<Attribute>&);
     ~ElementAttributeData();
 
     void clearClass() { m_classNames.clear(); }
@@ -108,19 +108,18 @@ private:
     size_t getAttributeItemIndexSlowCase(const AtomicString& name, bool shouldIgnoreAttributeCase) const;
     void cloneDataFrom(const ElementAttributeData& sourceData, const Element& sourceElement, Element& targetElement);
     void clearAttributes(Element*);
-    void replaceAttribute(size_t index, const Attribute&, Element*);
 
     bool isMutable() const { return m_isMutable; }
-    PassOwnPtr<ElementAttributeData> makeMutable() const { return adoptPtr(new ElementAttributeData(*this)); }
+    PassRefPtr<ElementAttributeData> makeMutable() const { return adoptRef(new ElementAttributeData(*this)); }
+
+    unsigned m_isMutable : 1;
+    unsigned m_arraySize : 31;
 
     mutable RefPtr<StylePropertySet> m_inlineStyleDecl;
     mutable RefPtr<StylePropertySet> m_attributeStyle;
     mutable SpaceSplitString m_classNames;
     mutable AtomicString m_idForStyleResolution;
 
-    unsigned m_isMutable : 1;
-    unsigned m_arraySize : 31;
-
     union {
         Vector<Attribute, 4>* m_mutableAttributeVector;
         void* m_attributes;
diff --git a/Source/WebCore/dom/ElementShadow.cpp b/Source/WebCore/dom/ElementShadow.cpp
index 017be4b58..aeb5b5b47 100644
--- a/Source/WebCore/dom/ElementShadow.cpp
+++ b/Source/WebCore/dom/ElementShadow.cpp
@@ -83,8 +83,11 @@ void ElementShadow::addShadowRoot(Element* shadowHost, PassRefPtr<ShadowRoot> sh
     invalidateDistribution(shadowHost);
     ChildNodeInsertionNotifier(shadowHost).notify(shadowRoot.get());
 
-    if (shadowHost->attached() && !shadowRoot->attached())
-        shadowRoot->attach();
+    // FIXME(94905): ShadowHost should be reattached during recalcStyle.
+    // Set some flag here and recreate shadow hosts' renderer in
+    // Element::recalcStyle.
+    if (shadowHost->attached())
+        shadowHost->lazyReattach();
 
     InspectorInstrumentation::didPushShadowRoot(shadowHost, shadowRoot.get());
 }
@@ -205,8 +208,9 @@ void ElementShadow::invalidateDistribution(Element* host)
     bool needsReattach = needsInvalidation ? m_distributor.invalidate(host) : false;
 
     if (needsReattach && host->attached()) {
-        host->detach();
-        host->lazyAttach();
+        for (Node* n = host->firstChild(); n; n = n->nextSibling())
+            n->lazyReattach();
+        host->setNeedsStyleRecalc();
     }
 
     if (needsInvalidation)
diff --git a/Source/WebCore/dom/ElementShadow.h b/Source/WebCore/dom/ElementShadow.h
index f58616efb..9d839a4f1 100644
--- a/Source/WebCore/dom/ElementShadow.h
+++ b/Source/WebCore/dom/ElementShadow.h
@@ -28,7 +28,6 @@
 #define ElementShadow_h
 
 #include "ContentDistributor.h"
-#include "Element.h"
 #include "ExceptionCode.h"
 #include "ShadowRoot.h"
 #include <wtf/DoublyLinkedList.h>
diff --git a/Source/WebCore/dom/EntityReference.cpp b/Source/WebCore/dom/EntityReference.cpp
index fb9e2478c..72944ec52 100644
--- a/Source/WebCore/dom/EntityReference.cpp
+++ b/Source/WebCore/dom/EntityReference.cpp
@@ -46,7 +46,7 @@ Node::NodeType EntityReference::nodeType() const
     return ENTITY_REFERENCE_NODE;
 }
 
-PassRefPtr<Node> EntityReference::cloneNode(bool, ExceptionCode&)
+PassRefPtr<Node> EntityReference::cloneNode(bool)
 {
     return create(document(), m_entityName);
 }
diff --git a/Source/WebCore/dom/EntityReference.h b/Source/WebCore/dom/EntityReference.h
index 49f80161a..7a6f6c36b 100644
--- a/Source/WebCore/dom/EntityReference.h
+++ b/Source/WebCore/dom/EntityReference.h
@@ -35,7 +35,7 @@ private:
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
 
     String m_entityName;
 };
diff --git a/Source/WebCore/dom/ErrorEvent.h b/Source/WebCore/dom/ErrorEvent.h
index 7f9e66356..5dde9492e 100644
--- a/Source/WebCore/dom/ErrorEvent.h
+++ b/Source/WebCore/dom/ErrorEvent.h
@@ -32,7 +32,7 @@
 #define ErrorEvent_h
 
 #include "Event.h"
-#include "PlatformString.h"
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/Event.cpp b/Source/WebCore/dom/Event.cpp
index f19cbdda7..a0bf439b5 100644
--- a/Source/WebCore/dom/Event.cpp
+++ b/Source/WebCore/dom/Event.cpp
@@ -27,6 +27,7 @@
 #include "EventNames.h"
 #include "EventTarget.h"
 #include "UserGestureIndicator.h"
+#include "WebCoreMemoryInstrumentation.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/text/AtomicString.h>
 
@@ -157,7 +158,7 @@ void Event::storeResult(const String&)
 
 void Event::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
     info.addInstrumentedMember(m_type);
     info.addMember(m_currentTarget);
     info.addMember(m_target);
diff --git a/Source/WebCore/dom/Event.h b/Source/WebCore/dom/Event.h
index 5c7d7c753..6fd34a742 100644
--- a/Source/WebCore/dom/Event.h
+++ b/Source/WebCore/dom/Event.h
@@ -24,166 +24,174 @@
 #ifndef Event_h
 #define Event_h
 
-#include "Clipboard.h"
 #include "DOMTimeStamp.h"
+#include "EventNames.h"
+#include <wtf/HashMap.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
-    class EventTarget;
-    class EventDispatcher;
-    class HTMLIFrameElement;
-    class MemoryInstrumentation;
+class Clipboard;
+class EventTarget;
+class EventDispatcher;
+class HTMLIFrameElement;
+class MemoryInstrumentation;
+class MemoryObjectInfo;
+
+struct EventInit {
+    EventInit();
+     
+    bool bubbles;
+    bool cancelable;
+};
+
+class Event : public RefCounted<Event> {
+public:
+    enum PhaseType { 
+        NONE                = 0,
+        CAPTURING_PHASE     = 1, 
+        AT_TARGET           = 2,
+        BUBBLING_PHASE      = 3 
+    };
 
-    struct EventInit {
-        EventInit();
-        
-        bool bubbles;
-        bool cancelable;
+    enum EventType {
+        MOUSEDOWN           = 1,
+        MOUSEUP             = 2,
+        MOUSEOVER           = 4,
+        MOUSEOUT            = 8,
+        MOUSEMOVE           = 16,
+        MOUSEDRAG           = 32,
+        CLICK               = 64,
+        DBLCLICK            = 128,
+        KEYDOWN             = 256,
+        KEYUP               = 512,
+        KEYPRESS            = 1024,
+        DRAGDROP            = 2048,
+        FOCUS               = 4096,
+        BLUR                = 8192,
+        SELECT              = 16384,
+        CHANGE              = 32768
     };
 
-    class Event : public RefCounted<Event> {
-    public:
-        enum PhaseType { 
-            NONE                = 0,
-            CAPTURING_PHASE     = 1, 
-            AT_TARGET           = 2,
-            BUBBLING_PHASE      = 3 
-        };
-
-        enum EventType {
-            MOUSEDOWN           = 1,
-            MOUSEUP             = 2,
-            MOUSEOVER           = 4,
-            MOUSEOUT            = 8,
-            MOUSEMOVE           = 16,
-            MOUSEDRAG           = 32,
-            CLICK               = 64,
-            DBLCLICK            = 128,
-            KEYDOWN             = 256,
-            KEYUP               = 512,
-            KEYPRESS            = 1024,
-            DRAGDROP            = 2048,
-            FOCUS               = 4096,
-            BLUR                = 8192,
-            SELECT              = 16384,
-            CHANGE              = 32768
-        };
-
-        static PassRefPtr<Event> create()
-        {
-            return adoptRef(new Event);
-        }
-        static PassRefPtr<Event> create(const AtomicString& type, bool canBubble, bool cancelable)
-        {
-            return adoptRef(new Event(type, canBubble, cancelable));
-        }
-
-        static PassRefPtr<Event> create(const AtomicString& type, const EventInit& initializer)
-        {
-            return adoptRef(new Event(type, initializer));
-        }
-
-        virtual ~Event();
-
-        void initEvent(const AtomicString& type, bool canBubble, bool cancelable);
-
-        const AtomicString& type() const { return m_type; }
-        
-        EventTarget* target() const { return m_target.get(); }
-        void setTarget(PassRefPtr<EventTarget>);
-
-        EventTarget* currentTarget() const { return m_currentTarget; }
-        void setCurrentTarget(EventTarget* currentTarget) { m_currentTarget = currentTarget; }
-
-        unsigned short eventPhase() const { return m_eventPhase; }
-        void setEventPhase(unsigned short eventPhase) { m_eventPhase = eventPhase; }
-
-        bool bubbles() const { return m_canBubble; }
-        bool cancelable() const { return m_cancelable; }
-        DOMTimeStamp timeStamp() const { return m_createTime; }
-
-        void stopPropagation() { m_propagationStopped = true; }
-        void stopImmediatePropagation() { m_immediatePropagationStopped = true; }
-        
-        // IE Extensions
-        EventTarget* srcElement() const { return target(); } // MSIE extension - "the object that fired the event"
-
-        bool returnValue() const { return !defaultPrevented(); }
-        void setReturnValue(bool returnValue) { setDefaultPrevented(!returnValue); }
-
-        Clipboard* clipboardData() const { return isClipboardEvent() ? clipboard() : 0; }
-
-        virtual const AtomicString& interfaceName() const;
-        bool hasInterface(const AtomicString&) const;
-
-        // These events are general classes of events.
-        virtual bool isUIEvent() const;
-        virtual bool isMouseEvent() const;
-        virtual bool isKeyboardEvent() const;
-        virtual bool isTouchEvent() const;
-
-        // Drag events are a subset of mouse events.
-        virtual bool isDragEvent() const;
-
-        // These events lack a DOM interface.
-        virtual bool isClipboardEvent() const;
-        virtual bool isBeforeTextInsertedEvent() const;
-
-        bool propagationStopped() const { return m_propagationStopped || m_immediatePropagationStopped; }
-        bool immediatePropagationStopped() const { return m_immediatePropagationStopped; }
-
-        bool defaultPrevented() const { return m_defaultPrevented; }
-        void preventDefault() { if (m_cancelable) m_defaultPrevented = true; }
-        void setDefaultPrevented(bool defaultPrevented) { m_defaultPrevented = defaultPrevented; }
-
-        bool defaultHandled() const { return m_defaultHandled; }
-        void setDefaultHandled() { m_defaultHandled = true; }
-
-        bool cancelBubble() const { return m_cancelBubble; }
-        void setCancelBubble(bool cancel) { m_cancelBubble = cancel; }
-
-        Event* underlyingEvent() const { return m_underlyingEvent.get(); }
-        void setUnderlyingEvent(PassRefPtr<Event>);
-
-        virtual bool storesResultAsString() const;
-        virtual void storeResult(const String&);
-
-        virtual Clipboard* clipboard() const { return 0; }
-
-        bool isBeingDispatched() const { return eventPhase(); }
-
-        virtual void reportMemoryUsage(MemoryObjectInfo*) const;
-
-        virtual PassRefPtr<Event> cloneFor(HTMLIFrameElement*) const;
+    static PassRefPtr<Event> create()
+    {
+        return adoptRef(new Event);
+    }
+    static PassRefPtr<Event> create(const AtomicString& type, bool canBubble, bool cancelable)
+    {
+        return adoptRef(new Event(type, canBubble, cancelable));
+    }
 
-    protected:
-        Event();
-        Event(const AtomicString& type, bool canBubble, bool cancelable);
-        Event(const AtomicString& type, const EventInit&);
+    static PassRefPtr<Event> create(const AtomicString& type, const EventInit& initializer)
+    {
+        return adoptRef(new Event(type, initializer));
+    }
 
-        virtual void receivedTarget();
-        bool dispatched() const { return m_target; }
+    virtual ~Event();
 
-    private:
-        AtomicString m_type;
-        bool m_canBubble;
-        bool m_cancelable;
+    void initEvent(const AtomicString& type, bool canBubble, bool cancelable);
 
-        bool m_propagationStopped;
-        bool m_immediatePropagationStopped;
-        bool m_defaultPrevented;
-        bool m_defaultHandled;
-        bool m_cancelBubble;
+    const AtomicString& type() const { return m_type; }
+    
+    EventTarget* target() const { return m_target.get(); }
+    void setTarget(PassRefPtr<EventTarget>);
 
-        unsigned short m_eventPhase;
-        EventTarget* m_currentTarget;
-        RefPtr<EventTarget> m_target;
-        DOMTimeStamp m_createTime;
+    EventTarget* currentTarget() const { return m_currentTarget; }
+    void setCurrentTarget(EventTarget* currentTarget) { m_currentTarget = currentTarget; }
 
-        RefPtr<Event> m_underlyingEvent;
-    };
+    unsigned short eventPhase() const { return m_eventPhase; }
+    void setEventPhase(unsigned short eventPhase) { m_eventPhase = eventPhase; }
+
+    bool bubbles() const { return m_canBubble; }
+    bool cancelable() const { return m_cancelable; }
+    DOMTimeStamp timeStamp() const { return m_createTime; }
+
+    void stopPropagation() { m_propagationStopped = true; }
+    void stopImmediatePropagation() { m_immediatePropagationStopped = true; }
+    
+    // IE Extensions
+    EventTarget* srcElement() const { return target(); } // MSIE extension - "the object that fired the event"
+
+    bool returnValue() const { return !defaultPrevented(); }
+    void setReturnValue(bool returnValue) { setDefaultPrevented(!returnValue); }
+
+    Clipboard* clipboardData() const { return isClipboardEvent() ? clipboard() : 0; }
+
+    virtual const AtomicString& interfaceName() const;
+    bool hasInterface(const AtomicString&) const;
+
+    // These events are general classes of events.
+    virtual bool isUIEvent() const;
+    virtual bool isMouseEvent() const;
+    virtual bool isKeyboardEvent() const;
+    virtual bool isTouchEvent() const;
+
+    // Drag events are a subset of mouse events.
+    virtual bool isDragEvent() const;
+
+    // These events lack a DOM interface.
+    virtual bool isClipboardEvent() const;
+    virtual bool isBeforeTextInsertedEvent() const;
+
+    bool propagationStopped() const { return m_propagationStopped || m_immediatePropagationStopped; }
+    bool immediatePropagationStopped() const { return m_immediatePropagationStopped; }
+
+    bool defaultPrevented() const { return m_defaultPrevented; }
+    void preventDefault()
+    {
+        if (m_cancelable)
+            m_defaultPrevented = true;
+    }
+    void setDefaultPrevented(bool defaultPrevented) { m_defaultPrevented = defaultPrevented; }
+
+    bool defaultHandled() const { return m_defaultHandled; }
+    void setDefaultHandled() { m_defaultHandled = true; }
+
+    bool cancelBubble() const { return m_cancelBubble; }
+    void setCancelBubble(bool cancel) { m_cancelBubble = cancel; }
+
+    Event* underlyingEvent() const { return m_underlyingEvent.get(); }
+    void setUnderlyingEvent(PassRefPtr<Event>);
+
+    virtual bool storesResultAsString() const;
+    virtual void storeResult(const String&);
+
+    virtual Clipboard* clipboard() const { return 0; }
+
+    bool isBeingDispatched() const { return eventPhase(); }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+
+    virtual PassRefPtr<Event> cloneFor(HTMLIFrameElement*) const;
+
+protected:
+    Event();
+    Event(const AtomicString& type, bool canBubble, bool cancelable);
+    Event(const AtomicString& type, const EventInit&);
+
+    virtual void receivedTarget();
+    bool dispatched() const { return m_target; }
+
+private:
+    AtomicString m_type;
+    bool m_canBubble;
+    bool m_cancelable;
+
+    bool m_propagationStopped;
+    bool m_immediatePropagationStopped;
+    bool m_defaultPrevented;
+    bool m_defaultHandled;
+    bool m_cancelBubble;
+
+    unsigned short m_eventPhase;
+    EventTarget* m_currentTarget;
+    RefPtr<EventTarget> m_target;
+    DOMTimeStamp m_createTime;
+
+    RefPtr<Event> m_underlyingEvent;
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/dom/EventDispatchMediator.cpp b/Source/WebCore/dom/EventDispatchMediator.cpp
index b2474cb95..8db3cb1ba 100644
--- a/Source/WebCore/dom/EventDispatchMediator.cpp
+++ b/Source/WebCore/dom/EventDispatchMediator.cpp
@@ -33,6 +33,7 @@
 
 #include "Event.h"
 #include "EventDispatcher.h"
+#include "Node.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/EventListenerMap.cpp b/Source/WebCore/dom/EventListenerMap.cpp
index c1fd4d7c9..2b2dfeaed 100644
--- a/Source/WebCore/dom/EventListenerMap.cpp
+++ b/Source/WebCore/dom/EventListenerMap.cpp
@@ -35,6 +35,7 @@
 
 #include "Event.h"
 #include "EventException.h"
+#include "EventTarget.h"
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
@@ -68,43 +69,29 @@ EventListenerMap::EventListenerMap()
 {
 }
 
-bool EventListenerMap::isEmpty() const
-{
-    if (m_hashMap)
-        return m_hashMap->isEmpty();
-    return !m_singleEventListenerVector;
-}
-
 bool EventListenerMap::contains(const AtomicString& eventType) const
 {
-    if (m_hashMap)
-        return m_hashMap->contains(eventType);
-    return m_singleEventListenerType == eventType;
+    for (unsigned i = 0; i < m_entries.size(); ++i) {
+        if (m_entries[i].first == eventType)
+            return true;
+    }
+    return false;
 }
 
 void EventListenerMap::clear()
 {
     assertNoActiveIterators();
 
-    if (m_hashMap)
-        m_hashMap.clear();
-    else {
-        m_singleEventListenerType = nullAtom;
-        m_singleEventListenerVector.clear();
-    }
+    m_entries.clear();
 }
 
 Vector<AtomicString> EventListenerMap::eventTypes() const
 {
     Vector<AtomicString> types;
+    types.reserveInitialCapacity(m_entries.size());
 
-    if (m_hashMap) {
-        EventListenerHashMap::iterator it = m_hashMap->begin();
-        EventListenerHashMap::iterator end = m_hashMap->end();
-        for (; it != end; ++it)
-            types.append(it->first);
-    } else if (m_singleEventListenerVector)
-        types.append(m_singleEventListenerType);
+    for (unsigned i = 0; i < m_entries.size(); ++i)
+        types.uncheckedAppend(m_entries[i].first);
 
     return types;
 }
@@ -124,30 +111,13 @@ bool EventListenerMap::add(const AtomicString& eventType, PassRefPtr<EventListen
 {
     assertNoActiveIterators();
 
-    if (m_singleEventListenerVector && m_singleEventListenerType != eventType) {
-        // We already have a single (first) listener vector, and this event is not
-        // of that type, so create the hash map and move the first listener vector there.
-        ASSERT(!m_hashMap);
-        m_hashMap = adoptPtr(new EventListenerHashMap);
-        m_hashMap->add(m_singleEventListenerType, m_singleEventListenerVector.release());
-        m_singleEventListenerType = nullAtom;
-    }
-
-    if (m_hashMap) {
-        EventListenerHashMap::AddResult result = m_hashMap->add(eventType, nullptr);
-        if (result.isNewEntry)
-            result.iterator->second = adoptPtr(new EventListenerVector);
-
-        return addListenerToVector(result.iterator->second.get(), listener, useCapture);
+    for (unsigned i = 0; i < m_entries.size(); ++i) {
+        if (m_entries[i].first == eventType)
+            return addListenerToVector(m_entries[i].second.get(), listener, useCapture);
     }
 
-    if (!m_singleEventListenerVector) {
-        m_singleEventListenerType = eventType;
-        m_singleEventListenerVector = adoptPtr(new EventListenerVector);
-    }
-
-    ASSERT(m_singleEventListenerType == eventType);
-    return addListenerToVector(m_singleEventListenerVector.get(), listener, useCapture);
+    m_entries.append(std::make_pair(eventType, adoptPtr(new EventListenerVector)));
+    return addListenerToVector(m_entries.last().second.get(), listener, useCapture);
 }
 
 static bool removeListenerFromVector(EventListenerVector* listenerVector, EventListener* listener, bool useCapture, size_t& indexOfRemovedListener)
@@ -164,41 +134,27 @@ bool EventListenerMap::remove(const AtomicString& eventType, EventListener* list
 {
     assertNoActiveIterators();
 
-    if (!m_hashMap) {
-        if (m_singleEventListenerType != eventType)
-            return false;
-        bool wasRemoved = removeListenerFromVector(m_singleEventListenerVector.get(), listener, useCapture, indexOfRemovedListener);
-        if (m_singleEventListenerVector->isEmpty()) {
-            m_singleEventListenerVector.clear();
-            m_singleEventListenerType = nullAtom;
+    for (unsigned i = 0; i < m_entries.size(); ++i) {
+        if (m_entries[i].first == eventType) {
+            bool wasRemoved = removeListenerFromVector(m_entries[i].second.get(), listener, useCapture, indexOfRemovedListener);
+            if (m_entries[i].second->isEmpty())
+                m_entries.remove(i);
+            return wasRemoved;
         }
-        return wasRemoved;
     }
 
-    EventListenerHashMap::iterator it = m_hashMap->find(eventType);
-    if (it == m_hashMap->end())
-        return false;
-
-    bool wasRemoved = removeListenerFromVector(it->second.get(), listener, useCapture, indexOfRemovedListener);
-    if (it->second->isEmpty())
-        m_hashMap->remove(it);
-    return wasRemoved;
+    return false;
 }
 
 EventListenerVector* EventListenerMap::find(const AtomicString& eventType)
 {
     assertNoActiveIterators();
 
-    if (m_hashMap) {
-        EventListenerHashMap::iterator it = m_hashMap->find(eventType);
-        if (it == m_hashMap->end())
-            return 0;
-        return it->second.get();
+    for (unsigned i = 0; i < m_entries.size(); ++i) {
+        if (m_entries[i].first == eventType)
+            return m_entries[i].second.get();
     }
 
-    if (m_singleEventListenerType == eventType)
-        return m_singleEventListenerVector.get();
-
     return 0;
 }
 
@@ -223,28 +179,13 @@ void EventListenerMap::removeFirstEventListenerCreatedFromMarkup(const AtomicStr
 {
     assertNoActiveIterators();
 
-    if (m_hashMap) {
-        EventListenerHashMap::iterator result = m_hashMap->find(eventType);
-        ASSERT(result != m_hashMap->end());
-
-        EventListenerVector* listenerVector = result->second.get();
-        ASSERT(listenerVector);
-
-        removeFirstListenerCreatedFromMarkup(listenerVector);
-
-        if (listenerVector->isEmpty())
-            m_hashMap->remove(result);
-
-        return;
-    }
-
-    ASSERT(m_singleEventListenerVector);
-    ASSERT(m_singleEventListenerType == eventType);
-
-    removeFirstListenerCreatedFromMarkup(m_singleEventListenerVector.get());
-    if (m_singleEventListenerVector->isEmpty()) {
-        m_singleEventListenerVector.clear();
-        m_singleEventListenerType = nullAtom;
+    for (unsigned i = 0; i < m_entries.size(); ++i) {
+        if (m_entries[i].first == eventType) {
+            removeFirstListenerCreatedFromMarkup(m_entries[i].second.get());
+            if (m_entries[i].second->isEmpty())
+                m_entries.remove(i);
+            return;
+        }
     }
 }
 
@@ -262,29 +203,22 @@ void EventListenerMap::copyEventListenersNotCreatedFromMarkupToTarget(EventTarge
 {
     assertNoActiveIterators();
 
-    if (m_hashMap) {
-        EventListenerHashMap::iterator end = m_hashMap->end();
-        for (EventListenerHashMap::iterator it = m_hashMap->begin(); it != end; ++it)
-            copyListenersNotCreatedFromMarkupToTarget(it->first, it->second.get(), target);
-        return;
-    }
-
-    if (!m_singleEventListenerVector)
-        return;
-
-    copyListenersNotCreatedFromMarkupToTarget(m_singleEventListenerType, m_singleEventListenerVector.get(), target);
+    for (unsigned i = 0; i < m_entries.size(); ++i)
+        copyListenersNotCreatedFromMarkupToTarget(m_entries[i].first, m_entries[i].second.get(), target);
 }
 
 #endif // ENABLE(SVG)
 
 EventListenerIterator::EventListenerIterator()
     : m_map(0)
+    , m_entryIndex(0)
     , m_index(0)
 {
 }
 
 EventListenerIterator::EventListenerIterator(EventTarget* target)
     : m_map(0)
+    , m_entryIndex(0)
     , m_index(0)
 {
     ASSERT(target);
@@ -301,11 +235,6 @@ EventListenerIterator::EventListenerIterator(EventTarget* target)
         m_map->m_activeIteratorCount++;
     }
 #endif
-
-    if (m_map->m_hashMap) {
-        m_mapIterator = m_map->m_hashMap->begin();
-        m_mapEnd = m_map->m_hashMap->end();
-    }
 }
 
 #ifndef NDEBUG
@@ -323,21 +252,13 @@ EventListener* EventListenerIterator::nextListener()
     if (!m_map)
         return 0;
 
-    if (m_map->m_hashMap) {
-        for (; m_mapIterator != m_mapEnd; ++m_mapIterator) {
-            EventListenerVector& listeners = *m_mapIterator->second;
-            if (m_index < listeners.size())
-                return listeners[m_index++].listener.get();
-            m_index = 0;
-        }
-        return 0;
+    for (; m_entryIndex < m_map->m_entries.size(); ++m_entryIndex) {
+        EventListenerVector& listeners = *m_map->m_entries[m_entryIndex].second;
+        if (m_index < listeners.size())
+            return listeners[m_index++].listener.get();
+        m_index = 0;
     }
 
-    if (!m_map->m_singleEventListenerVector)
-        return 0;
-    EventListenerVector& listeners = *m_map->m_singleEventListenerVector;
-    if (m_index < listeners.size())
-        return listeners[m_index++].listener.get();
     return 0;
 }
 
diff --git a/Source/WebCore/dom/EventListenerMap.h b/Source/WebCore/dom/EventListenerMap.h
index 6177fd472..6a036d362 100644
--- a/Source/WebCore/dom/EventListenerMap.h
+++ b/Source/WebCore/dom/EventListenerMap.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2011 Andreas Kling (kling@webkit.org)
@@ -35,7 +35,7 @@
 
 #include "RegisteredEventListener.h"
 #include <wtf/Forward.h>
-#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/text/AtomicStringHash.h>
 
 namespace WebCore {
@@ -48,7 +48,7 @@ class EventListenerMap {
 public:
     EventListenerMap();
 
-    bool isEmpty() const;
+    bool isEmpty() const { return m_entries.isEmpty(); }
     bool contains(const AtomicString& eventType) const;
 
     void clear();
@@ -67,15 +67,7 @@ private:
 
     void assertNoActiveIterators();
 
-    struct EventListenerHashMapTraits : HashTraits<WTF::AtomicString> {
-        static const int minimumTableSize = 32;
-    };
-    typedef HashMap<AtomicString, OwnPtr<EventListenerVector>, AtomicStringHash, EventListenerHashMapTraits> EventListenerHashMap;
-
-    OwnPtr<EventListenerHashMap> m_hashMap;
-
-    AtomicString m_singleEventListenerType;
-    OwnPtr<EventListenerVector> m_singleEventListenerVector;
+    Vector<std::pair<AtomicString, OwnPtr<EventListenerVector> >, 2> m_entries;
 
 #ifndef NDEBUG
     int m_activeIteratorCount;
@@ -95,8 +87,7 @@ public:
 
 private:
     EventListenerMap* m_map;
-    EventListenerMap::EventListenerHashMap::iterator m_mapIterator;
-    EventListenerMap::EventListenerHashMap::iterator m_mapEnd;
+    unsigned m_entryIndex;
     unsigned m_index;
 };
 
diff --git a/Source/WebCore/dom/EventNames.h b/Source/WebCore/dom/EventNames.h
index a2faec128..dc9645014 100644
--- a/Source/WebCore/dom/EventNames.h
+++ b/Source/WebCore/dom/EventNames.h
@@ -227,6 +227,8 @@ namespace WebCore {
     macro(removetrack) \
     macro(mute) \
     macro(unmute) \
+    macro(icechange) \
+    macro(icecandidate) \
     \
     macro(show) \
     \
diff --git a/Source/WebCore/dom/EventNames.in b/Source/WebCore/dom/EventNames.in
index 22aaa7b07..9e9e0c863 100644
--- a/Source/WebCore/dom/EventNames.in
+++ b/Source/WebCore/dom/EventNames.in
@@ -31,6 +31,7 @@ AudioProcessingEvent conditional=WEB_AUDIO
 OfflineAudioCompletionEvent conditional=WEB_AUDIO
 MediaStreamEvent conditional=MEDIA_STREAM
 MediaStreamTrackEvent conditional=MEDIA_STREAM
+RTCIceCandidateEvent conditional=MEDIA_STREAM
 SpeechInputEvent conditional=INPUT_SPEECH
 SpeechRecognitionError conditional=SCRIPTED_SPEECH
 SpeechRecognitionEvent conditional=SCRIPTED_SPEECH
diff --git a/Source/WebCore/dom/ExceptionBase.h b/Source/WebCore/dom/ExceptionBase.h
index 395227b55..01e5f1d9d 100644
--- a/Source/WebCore/dom/ExceptionBase.h
+++ b/Source/WebCore/dom/ExceptionBase.h
@@ -30,8 +30,8 @@
 #define ExceptionBase_h
 
 #include "ExceptionCode.h"
-#include "PlatformString.h"
 #include <wtf/RefCounted.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/MemoryInstrumentation.cpp b/Source/WebCore/dom/MemoryInstrumentation.cpp
deleted file mode 100644
index f924c876d..000000000
--- a/Source/WebCore/dom/MemoryInstrumentation.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "MemoryInstrumentation.h"
-
-#include "KURL.h"
-#include <wtf/text/StringImpl.h>
-#include <wtf/text/WTFString.h>
-
-namespace WebCore {
-
-void MemoryInstrumentation::addInstrumentedObjectImpl(const String* const& string, ObjectType objectType, OwningType owningType)
-{
-    if (!string || visited(string))
-        return;
-    if (owningType == byPointer)
-        countObjectSize(objectType, sizeof(String));
-    addInstrumentedObjectImpl(string->impl(), objectType, byPointer);
-}
-
-void MemoryInstrumentation::addInstrumentedObjectImpl(const StringImpl* const& stringImpl, ObjectType objectType, OwningType)
-{
-    if (!stringImpl || visited(stringImpl))
-        return;
-    countObjectSize(objectType, stringImpl->sizeInBytes());
-}
-
-void MemoryInstrumentation::addInstrumentedObjectImpl(const KURL* const& url, ObjectType objectType, OwningType owningType)
-{
-    if (!url || visited(url))
-        return;
-    if (owningType == byPointer)
-        countObjectSize(objectType, sizeof(KURL));
-    addInstrumentedObject(url->string(), objectType);
-    if (url->innerURL())
-        addInstrumentedObject(url->innerURL(), objectType);
-}
-
-void MemoryInstrumentation::addInstrumentedObjectImpl(const AtomicString* const& atomicString, ObjectType objectType, OwningType owningType)
-{
-    addInstrumentedObjectImpl(reinterpret_cast<const String* const>(atomicString), objectType, owningType);
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/dom/MemoryInstrumentation.h b/Source/WebCore/dom/MemoryInstrumentation.h
index 35cb6cb7a..ac67ffff6 100644
--- a/Source/WebCore/dom/MemoryInstrumentation.h
+++ b/Source/WebCore/dom/MemoryInstrumentation.h
@@ -1,4 +1,3 @@
-
 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
@@ -32,47 +31,45 @@
 #ifndef MemoryInstrumentation_h
 #define MemoryInstrumentation_h
 
-#include <wtf/Assertions.h>
-#include <wtf/Forward.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-template <typename T> class DataRef;
-class KURL;
+class MemoryClassInfo;
 class MemoryObjectInfo;
+class MemoryInstrumentation;
+
+typedef const char* MemoryObjectType;
+
+class GenericMemoryTypes {
+public:
+    static MemoryObjectType Undefined;
+};
+
+enum MemoryOwningType {
+    byPointer,
+    byReference
+};
+
+class MemoryInstrumentationTraits {
+public:
+    template<typename T> static void addInstrumentedObject(MemoryInstrumentation*, const T* const&, MemoryObjectType, MemoryOwningType);
+    template<typename T> static void addObject(MemoryInstrumentation*, const T* const&, MemoryObjectType, MemoryOwningType);
+};
 
 class MemoryInstrumentation {
 public:
     virtual ~MemoryInstrumentation() { }
 
-    enum ObjectType {
-        Other,
-        DOM,
-        CSS,
-        Binding,
-        Loader,
-        MemoryCacheStructures,
-        CachedResource,
-        CachedResourceCSS,
-        CachedResourceFont,
-        CachedResourceImage,
-        CachedResourceScript,
-        CachedResourceSVG,
-        CachedResourceShader,
-        CachedResourceXSLT,
-        LastTypeEntry
-    };
-
     template <typename T> void addRootObject(const T& t)
     {
-        addInstrumentedObject(t, Other);
+        addInstrumentedObject(t, GenericMemoryTypes::Undefined);
         processDeferredInstrumentedPointers();
     }
 
-    template <typename Container> static size_t calculateContainerSize(const Container&, bool contentOnly = false);
+    template<typename Container> static size_t calculateContainerSize(const Container&, bool contentOnly = false);
 
 protected:
     class InstrumentedPointerBase {
@@ -82,89 +79,100 @@ protected:
     };
 
 private:
-    virtual void countObjectSize(ObjectType, size_t) = 0;
+    virtual void countObjectSize(MemoryObjectType, size_t) = 0;
     virtual void deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase>) = 0;
     virtual bool visited(const void*) = 0;
     virtual void processDeferredInstrumentedPointers() = 0;
 
     friend class MemoryClassInfo;
-    template <typename T> class InstrumentedPointer : public InstrumentedPointerBase {
+    friend class MemoryInstrumentationTraits;
+
+    template<typename T> class InstrumentedPointer : public InstrumentedPointerBase {
     public:
-        explicit InstrumentedPointer(const T* pointer, ObjectType ownerObjectType) : m_pointer(pointer), m_ownerObjectType(ownerObjectType) { }
+        explicit InstrumentedPointer(const T* pointer, MemoryObjectType ownerObjectType) : m_pointer(pointer), m_ownerObjectType(ownerObjectType) { }
         virtual void process(MemoryInstrumentation*) OVERRIDE;
 
     private:
         const T* m_pointer;
-        const ObjectType m_ownerObjectType;
+        const MemoryObjectType m_ownerObjectType;
     };
 
-    template <typename T> void addObject(const T& t, ObjectType ownerObjectType)
+    template<typename T> void addObject(const T& t, MemoryObjectType ownerObjectType)
     {
         OwningTraits<T>::addObject(this, t, ownerObjectType);
     }
 
-    template <typename T> void addInstrumentedObject(const T& t, ObjectType ownerObjectType) { OwningTraits<T>::addInstrumentedObject(this, t, ownerObjectType); }
-    template <typename HashMapType> void addHashMap(const HashMapType&, ObjectType, bool contentOnly = false);
-    template <typename HashSetType> void addHashSet(const HashSetType&, ObjectType, bool contentOnly = false);
-    template <typename CollectionType> void addInstrumentedCollection(const CollectionType&, ObjectType, bool contentOnly = false);
-    template <typename MapType> void addInstrumentedMapEntries(const MapType&, ObjectType);
-    template <typename MapType> void addInstrumentedMapValues(const MapType&, ObjectType);
-    template <typename ListHashSetType> void addListHashSet(const ListHashSetType&, ObjectType, bool contentOnly = false);
-    template <typename VectorType> void addVector(const VectorType&, ObjectType, bool contentOnly = false);
-    void addRawBuffer(const void* const& buffer, ObjectType ownerObjectType, size_t size)
+    template<typename T> void addInstrumentedObject(const T& t, MemoryObjectType ownerObjectType) { OwningTraits<T>::addInstrumentedObject(this, t, ownerObjectType); }
+    template<typename HashMapType> void addHashMap(const HashMapType&, MemoryObjectType, bool contentOnly = false);
+    template<typename HashSetType> void addHashSet(const HashSetType&, MemoryObjectType, bool contentOnly = false);
+    template<typename CollectionType> void addInstrumentedCollection(const CollectionType&, MemoryObjectType, bool contentOnly = false);
+    template<typename MapType> void addInstrumentedMapEntries(const MapType&, MemoryObjectType);
+    template<typename MapType> void addInstrumentedMapValues(const MapType&, MemoryObjectType);
+    template<typename ListHashSetType> void addListHashSet(const ListHashSetType&, MemoryObjectType, bool contentOnly = false);
+    template<typename VectorType> void addVector(const VectorType&, MemoryObjectType, bool contentOnly = false);
+    void addRawBuffer(const void* const& buffer, MemoryObjectType ownerObjectType, size_t size)
     {
         if (!buffer || visited(buffer))
             return;
         countObjectSize(ownerObjectType, size);
     }
 
-    enum OwningType {
-        byPointer,
-        byReference
-    };
-
-    template <typename T>
+    template<typename T>
     struct OwningTraits { // Default byReference implementation.
-        static void addInstrumentedObject(MemoryInstrumentation* instrumentation, const T& t, ObjectType ownerObjectType) { instrumentation->addInstrumentedObjectImpl(&t, ownerObjectType, byReference); }
-        static void addObject(MemoryInstrumentation* instrumentation, const T& t, ObjectType ownerObjectType) { instrumentation->addObjectImpl(&t, ownerObjectType, byReference); }
+        static void addInstrumentedObject(MemoryInstrumentation* instrumentation, const T& t, MemoryObjectType ownerObjectType)
+        {
+            MemoryInstrumentationTraits::addInstrumentedObject<T>(instrumentation, &t, ownerObjectType, byReference);
+        }
+        static void addObject(MemoryInstrumentation* instrumentation, const T& t, MemoryObjectType ownerObjectType)
+        {
+            MemoryInstrumentationTraits::addObject<T>(instrumentation, &t, ownerObjectType, byReference);
+        }
     };
 
-    template <typename T>
+    template<typename T>
     struct OwningTraits<T*> { // Custom byPointer implementation.
-        static void addInstrumentedObject(MemoryInstrumentation* instrumentation, const T* const& t, ObjectType ownerObjectType) { instrumentation->addInstrumentedObjectImpl(t, ownerObjectType, byPointer); }
-        static void addObject(MemoryInstrumentation* instrumentation, const T* const& t, ObjectType ownerObjectType) { instrumentation->addObjectImpl(t, ownerObjectType, byPointer); }
+        static void addInstrumentedObject(MemoryInstrumentation* instrumentation, const T* const& t, MemoryObjectType ownerObjectType)
+        {
+            MemoryInstrumentationTraits::addInstrumentedObject<T>(instrumentation, t, ownerObjectType, byPointer);
+        }
+        static void addObject(MemoryInstrumentation* instrumentation, const T* const& t, MemoryObjectType ownerObjectType)
+        {
+            MemoryInstrumentationTraits::addObject<T>(instrumentation, t, ownerObjectType, byPointer);
+        }
     };
 
-    void addInstrumentedObjectImpl(const String* const&, ObjectType, OwningType);
-    void addInstrumentedObjectImpl(const StringImpl* const&, ObjectType, OwningType);
-    void addInstrumentedObjectImpl(const AtomicString* const&, ObjectType, OwningType);
-    void addInstrumentedObjectImpl(const KURL* const&, ObjectType, OwningType);
-    template <typename T> void addInstrumentedObjectImpl(const T* const&, ObjectType, OwningType);
-    template <typename T> void addInstrumentedObjectImpl(const DataRef<T>* const&, ObjectType, OwningType);
-    template <typename T> void addInstrumentedObjectImpl(const OwnPtr<T>* const&, ObjectType, OwningType);
-    template <typename T> void addInstrumentedObjectImpl(const RefPtr<T>* const&, ObjectType, OwningType);
-
-    template <typename T> void addObjectImpl(const T* const&, ObjectType, OwningType);
-    template <typename T> void addObjectImpl(const DataRef<T>* const&, ObjectType, OwningType);
-    template <typename T> void addObjectImpl(const OwnPtr<T>* const&, ObjectType, OwningType);
-    template <typename T> void addObjectImpl(const RefPtr<T>* const&, ObjectType, OwningType);
-
-    // Link time guards for special cases.
-    void addObjectImpl(const String* const&, ObjectType, OwningType);
-    void addObjectImpl(const StringImpl* const&, ObjectType, OwningType);
-    void addObjectImpl(const AtomicString* const&, ObjectType, OwningType);
-    void addObjectImpl(const KURL* const&, ObjectType, OwningType);
+    template<typename T> void addInstrumentedObjectImpl(const T* const&, MemoryObjectType, MemoryOwningType);
+    template<typename T> void addInstrumentedObjectImpl(const OwnPtr<T>* const&, MemoryObjectType, MemoryOwningType);
+    template<typename T> void addInstrumentedObjectImpl(const RefPtr<T>* const&, MemoryObjectType, MemoryOwningType);
+
+    template<typename T> void addObjectImpl(const T* const&, MemoryObjectType, MemoryOwningType);
+    template<typename T> void addObjectImpl(const OwnPtr<T>* const&, MemoryObjectType, MemoryOwningType);
+    template<typename T> void addObjectImpl(const RefPtr<T>* const&, MemoryObjectType, MemoryOwningType);
 };
 
+template<typename T>
+void MemoryInstrumentationTraits::addInstrumentedObject(MemoryInstrumentation* instrumentation, const T* const& t, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
+{
+    instrumentation->addInstrumentedObjectImpl(t, ownerObjectType, owningType);
+}
+
+template<typename T>
+void MemoryInstrumentationTraits::addObject(MemoryInstrumentation* instrumentation, const T* const& t, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
+{
+    instrumentation->addObjectImpl(t, ownerObjectType, owningType);
+}
+
 class MemoryObjectInfo {
 public:
-    MemoryObjectInfo(MemoryInstrumentation* memoryInstrumentation, MemoryInstrumentation::ObjectType ownerObjectType)
+    MemoryObjectInfo(MemoryInstrumentation* memoryInstrumentation, MemoryObjectType ownerObjectType)
         : m_memoryInstrumentation(memoryInstrumentation)
         , m_objectType(ownerObjectType)
         , m_objectSize(0)
     { }
 
-    MemoryInstrumentation::ObjectType objectType() const { return m_objectType; }
+    typedef MemoryClassInfo ClassInfo;
+
+    MemoryObjectType objectType() const { return m_objectType; }
     size_t objectSize() const { return m_objectSize; }
 
     MemoryInstrumentation* memoryInstrumentation() { return m_memoryInstrumentation; }
@@ -172,24 +180,24 @@ public:
 private:
     friend class MemoryClassInfo;
 
-    template <typename T> void reportObjectInfo(MemoryInstrumentation::ObjectType objectType, size_t actualSize)
+    template<typename T> void reportObjectInfo(MemoryObjectType objectType, size_t actualSize)
     {
         if (!m_objectSize) {
             m_objectSize = actualSize ? actualSize : sizeof(T);
-            if (objectType != MemoryInstrumentation::Other)
+            if (objectType != GenericMemoryTypes::Undefined)
                 m_objectType = objectType;
         }
     }
 
     MemoryInstrumentation* m_memoryInstrumentation;
-    MemoryInstrumentation::ObjectType m_objectType;
+    MemoryObjectType m_objectType;
     size_t m_objectSize;
 };
 
 class MemoryClassInfo {
 public:
-    template <typename T>
-    MemoryClassInfo(MemoryObjectInfo* memoryObjectInfo, const T*, MemoryInstrumentation::ObjectType objectType, size_t actualSize = 0)
+    template<typename T>
+    MemoryClassInfo(MemoryObjectInfo* memoryObjectInfo, const T*, MemoryObjectType objectType = GenericMemoryTypes::Undefined, size_t actualSize = 0)
         : m_memoryObjectInfo(memoryObjectInfo)
         , m_memoryInstrumentation(memoryObjectInfo->memoryInstrumentation())
     {
@@ -197,31 +205,31 @@ public:
         m_objectType = memoryObjectInfo->objectType();
     }
 
-    template <typename M> void addInstrumentedMember(const M& member) { m_memoryInstrumentation->addInstrumentedObject(member, m_objectType); }
-    template <typename M> void addMember(const M& member) { m_memoryInstrumentation->addObject(member, m_objectType); }
-
-    template <typename HashMapType> void addHashMap(const HashMapType& map) { m_memoryInstrumentation->addHashMap(map, m_objectType, true); }
-    template <typename HashSetType> void addHashSet(const HashSetType& set) { m_memoryInstrumentation->addHashSet(set, m_objectType, true); }
-    template <typename HashSetType> void addHashCountedSet(const HashSetType& set) { m_memoryInstrumentation->addHashSet(set, m_objectType, true); }
-    template <typename HashSetType> void addInstrumentedHashSet(const HashSetType& set) { m_memoryInstrumentation->addInstrumentedCollection(set, m_objectType, true); }
-    template <typename VectorType> void addInstrumentedVector(const VectorType& vector) { m_memoryInstrumentation->addInstrumentedCollection(vector, m_objectType, true); }
-    template <typename VectorType> void addInstrumentedVectorPtr(const OwnPtr<VectorType>& vector) { m_memoryInstrumentation->addInstrumentedCollection(*vector, m_objectType, false); }
-    template <typename VectorType> void addInstrumentedVectorPtr(const VectorType* const& vector) { m_memoryInstrumentation->addInstrumentedCollection(*vector, m_objectType, false); }
-    template <typename MapType> void addInstrumentedMapEntries(const MapType& map) { m_memoryInstrumentation->addInstrumentedMapEntries(map, m_objectType); }
-    template <typename MapType> void addInstrumentedMapValues(const MapType& map) { m_memoryInstrumentation->addInstrumentedMapValues(map, m_objectType); }
-    template <typename ListHashSetType> void addListHashSet(const ListHashSetType& set) { m_memoryInstrumentation->addListHashSet(set, m_objectType, true); }
-    template <typename VectorType> void addVector(const VectorType& vector) { m_memoryInstrumentation->addVector(vector, m_objectType, true); }
-    template <typename VectorType> void addVectorPtr(const VectorType* const vector) { m_memoryInstrumentation->addVector(*vector, m_objectType, false); }
+    template<typename M> void addInstrumentedMember(const M& member) { m_memoryInstrumentation->addInstrumentedObject(member, m_objectType); }
+    template<typename M> void addMember(const M& member) { m_memoryInstrumentation->addObject(member, m_objectType); }
+
+    template<typename HashMapType> void addHashMap(const HashMapType& map) { m_memoryInstrumentation->addHashMap(map, m_objectType, true); }
+    template<typename HashSetType> void addHashSet(const HashSetType& set) { m_memoryInstrumentation->addHashSet(set, m_objectType, true); }
+    template<typename HashSetType> void addHashCountedSet(const HashSetType& set) { m_memoryInstrumentation->addHashSet(set, m_objectType, true); }
+    template<typename HashSetType> void addInstrumentedHashSet(const HashSetType& set) { m_memoryInstrumentation->addInstrumentedCollection(set, m_objectType, true); }
+    template<typename VectorType> void addInstrumentedVector(const VectorType& vector) { m_memoryInstrumentation->addInstrumentedCollection(vector, m_objectType, true); }
+    template<typename VectorType> void addInstrumentedVectorPtr(const OwnPtr<VectorType>& vector) { m_memoryInstrumentation->addInstrumentedCollection(*vector, m_objectType, false); }
+    template<typename VectorType> void addInstrumentedVectorPtr(const VectorType* const& vector) { m_memoryInstrumentation->addInstrumentedCollection(*vector, m_objectType, false); }
+    template<typename MapType> void addInstrumentedMapEntries(const MapType& map) { m_memoryInstrumentation->addInstrumentedMapEntries(map, m_objectType); }
+    template<typename MapType> void addInstrumentedMapValues(const MapType& map) { m_memoryInstrumentation->addInstrumentedMapValues(map, m_objectType); }
+    template<typename ListHashSetType> void addListHashSet(const ListHashSetType& set) { m_memoryInstrumentation->addListHashSet(set, m_objectType, true); }
+    template<typename VectorType> void addVector(const VectorType& vector) { m_memoryInstrumentation->addVector(vector, m_objectType, true); }
+    template<typename VectorType> void addVectorPtr(const VectorType* const vector) { m_memoryInstrumentation->addVector(*vector, m_objectType, false); }
     void addRawBuffer(const void* const& buffer, size_t size) { m_memoryInstrumentation->addRawBuffer(buffer, m_objectType, size); }
 
 private:
     MemoryObjectInfo* m_memoryObjectInfo;
     MemoryInstrumentation* m_memoryInstrumentation;
-    MemoryInstrumentation::ObjectType m_objectType;
+    MemoryObjectType m_objectType;
 };
 
-template <typename T>
-void MemoryInstrumentation::addInstrumentedObjectImpl(const T* const& object, ObjectType ownerObjectType, OwningType owningType)
+template<typename T>
+void MemoryInstrumentation::addInstrumentedObjectImpl(const T* const& object, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
 {
     if (owningType == byReference) {
         MemoryObjectInfo memoryObjectInfo(this, ownerObjectType);
@@ -233,56 +241,40 @@ void MemoryInstrumentation::addInstrumentedObjectImpl(const T* const& object, Ob
     }
 }
 
-template <typename T>
-void MemoryInstrumentation::addInstrumentedObjectImpl(const DataRef<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
-{
-    if (owningType == byPointer)
-        countObjectSize(ownerObjectType, sizeof(*object));
-    addInstrumentedObjectImpl(object->get(), ownerObjectType, byPointer);
-}
-
-template <typename T>
-void MemoryInstrumentation::addInstrumentedObjectImpl(const OwnPtr<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+template<typename T>
+void MemoryInstrumentation::addInstrumentedObjectImpl(const OwnPtr<T>* const& object, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
 {
     if (owningType == byPointer)
         countObjectSize(ownerObjectType, sizeof(*object));
     addInstrumentedObjectImpl(object->get(), ownerObjectType, byPointer);
 }
 
-template <typename T>
-void MemoryInstrumentation::addInstrumentedObjectImpl(const RefPtr<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+template<typename T>
+void MemoryInstrumentation::addInstrumentedObjectImpl(const RefPtr<T>* const& object, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
 {
     if (owningType == byPointer)
         countObjectSize(ownerObjectType, sizeof(*object));
     addInstrumentedObjectImpl(object->get(), ownerObjectType, byPointer);
 }
 
-template <typename T>
-void MemoryInstrumentation::addObjectImpl(const DataRef<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
-{
-    if (owningType == byPointer)
-        countObjectSize(ownerObjectType, sizeof(*object));
-    addObjectImpl(object->get(), ownerObjectType, byPointer);
-}
-
-template <typename T>
-void MemoryInstrumentation::addObjectImpl(const OwnPtr<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+template<typename T>
+void MemoryInstrumentation::addObjectImpl(const OwnPtr<T>* const& object, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
 {
     if (owningType == byPointer)
         countObjectSize(ownerObjectType, sizeof(*object));
     addObjectImpl(object->get(), ownerObjectType, byPointer);
 }
 
-template <typename T>
-void MemoryInstrumentation::addObjectImpl(const RefPtr<T>* const& object, ObjectType ownerObjectType, OwningType owningType)
+template<typename T>
+void MemoryInstrumentation::addObjectImpl(const RefPtr<T>* const& object, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
 {
     if (owningType == byPointer)
         countObjectSize(ownerObjectType, sizeof(*object));
     addObjectImpl(object->get(), ownerObjectType, byPointer);
 }
 
-template <typename T>
-void MemoryInstrumentation::addObjectImpl(const T* const& object, ObjectType ownerObjectType, OwningType owningType)
+template<typename T>
+void MemoryInstrumentation::addObjectImpl(const T* const& object, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
 {
     if (!object || visited(object))
         return;
@@ -292,7 +284,7 @@ void MemoryInstrumentation::addObjectImpl(const T* const& object, ObjectType own
 }
 
 template<typename HashMapType>
-void MemoryInstrumentation::addHashMap(const HashMapType& hashMap, ObjectType ownerObjectType, bool contentOnly)
+void MemoryInstrumentation::addHashMap(const HashMapType& hashMap, MemoryObjectType ownerObjectType, bool contentOnly)
 {
     if (visited(&hashMap))
         return;
@@ -300,15 +292,15 @@ void MemoryInstrumentation::addHashMap(const HashMapType& hashMap, ObjectType ow
 }
 
 template<typename HashSetType>
-void MemoryInstrumentation::addHashSet(const HashSetType& hashSet, ObjectType ownerObjectType, bool contentOnly)
+void MemoryInstrumentation::addHashSet(const HashSetType& hashSet, MemoryObjectType ownerObjectType, bool contentOnly)
 {
     if (visited(&hashSet))
         return;
     countObjectSize(ownerObjectType, calculateContainerSize(hashSet, contentOnly));
 }
 
-template <typename CollectionType>
-void MemoryInstrumentation::addInstrumentedCollection(const CollectionType& collection, ObjectType ownerObjectType, bool contentOnly)
+template<typename CollectionType>
+void MemoryInstrumentation::addInstrumentedCollection(const CollectionType& collection, MemoryObjectType ownerObjectType, bool contentOnly)
 {
     if (visited(&collection))
         return;
@@ -318,8 +310,8 @@ void MemoryInstrumentation::addInstrumentedCollection(const CollectionType& coll
         addInstrumentedObject(*i, ownerObjectType);
 }
 
-template <typename MapType>
-void MemoryInstrumentation::addInstrumentedMapEntries(const MapType& map, ObjectType ownerObjectType)
+template<typename MapType>
+void MemoryInstrumentation::addInstrumentedMapEntries(const MapType& map, MemoryObjectType ownerObjectType)
 {
     typename MapType::const_iterator end = map.end();
     for (typename MapType::const_iterator i = map.begin(); i != end; ++i) {
@@ -328,8 +320,8 @@ void MemoryInstrumentation::addInstrumentedMapEntries(const MapType& map, Object
     }
 }
 
-template <typename MapType>
-void MemoryInstrumentation::addInstrumentedMapValues(const MapType& map, ObjectType ownerObjectType)
+template<typename MapType>
+void MemoryInstrumentation::addInstrumentedMapValues(const MapType& map, MemoryObjectType ownerObjectType)
 {
     typename MapType::const_iterator end = map.end();
     for (typename MapType::const_iterator i = map.begin(); i != end; ++i)
@@ -337,7 +329,7 @@ void MemoryInstrumentation::addInstrumentedMapValues(const MapType& map, ObjectT
 }
 
 template<typename ListHashSetType>
-void MemoryInstrumentation::addListHashSet(const ListHashSetType& hashSet, ObjectType ownerObjectType, bool contentOnly)
+void MemoryInstrumentation::addListHashSet(const ListHashSetType& hashSet, MemoryObjectType ownerObjectType, bool contentOnly)
 {
     if (visited(&hashSet))
         return;
@@ -345,15 +337,15 @@ void MemoryInstrumentation::addListHashSet(const ListHashSetType& hashSet, Objec
     countObjectSize(ownerObjectType, size);
 }
 
-template <typename VectorType>
-void MemoryInstrumentation::addVector(const VectorType& vector, ObjectType ownerObjectType, bool contentOnly)
+template<typename VectorType>
+void MemoryInstrumentation::addVector(const VectorType& vector, MemoryObjectType ownerObjectType, bool contentOnly)
 {
     if (!vector.data() || visited(vector.data()))
         return;
     countObjectSize(ownerObjectType, calculateContainerSize(vector, contentOnly));
 }
 
-template <typename Container>
+template<typename Container>
 size_t MemoryInstrumentation::calculateContainerSize(const Container& container, bool contentOnly)
 {
     return (contentOnly ? 0 : sizeof(container)) + container.capacity() * sizeof(typename Container::ValueType);
@@ -367,7 +359,6 @@ void MemoryInstrumentation::InstrumentedPointer<T>::process(MemoryInstrumentatio
     memoryInstrumentation->countObjectSize(memoryObjectInfo.objectType(), memoryObjectInfo.objectSize());
 }
 
-
 } // namespace WebCore
 
 #endif // !defined(MemoryInstrumentation_h)
diff --git a/Source/WebCore/dom/MessagePort.cpp b/Source/WebCore/dom/MessagePort.cpp
index 50d4b16e3..95c5a6d01 100644
--- a/Source/WebCore/dom/MessagePort.cpp
+++ b/Source/WebCore/dom/MessagePort.cpp
@@ -133,9 +133,8 @@ void MessagePort::start()
 
 void MessagePort::close()
 {
-    if (!isEntangled())
-        return;
-    m_entangledChannel->close();
+    if (isEntangled())
+        m_entangledChannel->close();
     m_closed = true;
 }
 
diff --git a/Source/WebCore/dom/MessagePortChannel.h b/Source/WebCore/dom/MessagePortChannel.h
index 344b85131..a048220e0 100644
--- a/Source/WebCore/dom/MessagePortChannel.h
+++ b/Source/WebCore/dom/MessagePortChannel.h
@@ -31,16 +31,14 @@
 #ifndef MessagePortChannel_h
 #define MessagePortChannel_h
 
-#include "PlatformString.h"
-
 #include "SerializedScriptValue.h"
-
 #include <wtf/OwnPtr.h>
 #include <wtf/Forward.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/MicroDataItemList.cpp b/Source/WebCore/dom/MicroDataItemList.cpp
index 38460ce3d..91ab98267 100644
--- a/Source/WebCore/dom/MicroDataItemList.cpp
+++ b/Source/WebCore/dom/MicroDataItemList.cpp
@@ -40,8 +40,7 @@ using namespace HTMLNames;
 
 const String& MicroDataItemList::undefinedItemType()
 {
-    DEFINE_STATIC_LOCAL(String, undefinedItemTypeString, (""));
-    return undefinedItemTypeString;
+    return emptyString();
 }
 
 MicroDataItemList::MicroDataItemList(PassRefPtr<Node> rootNode, const String& typeNames)
diff --git a/Source/WebCore/dom/MouseRelatedEvent.h b/Source/WebCore/dom/MouseRelatedEvent.h
index 0bb8a26fa..249b83347 100644
--- a/Source/WebCore/dom/MouseRelatedEvent.h
+++ b/Source/WebCore/dom/MouseRelatedEvent.h
@@ -24,7 +24,7 @@
 #ifndef MouseRelatedEvent_h
 #define MouseRelatedEvent_h
 
-#include "LayoutTypes.h"
+#include "LayoutTypesInlineMethods.h"
 #include "UIEventWithKeyState.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/dom/MutationRecord.h b/Source/WebCore/dom/MutationRecord.h
index 7040e9d89..d746d4859 100644
--- a/Source/WebCore/dom/MutationRecord.h
+++ b/Source/WebCore/dom/MutationRecord.h
@@ -33,10 +33,10 @@
 
 #if ENABLE(MUTATION_OBSERVERS)
 
-#include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/WebKitNamedFlowCollection.cpp b/Source/WebCore/dom/NamedFlowCollection.cpp
index 9273727ef..1588fc6c0 100644
--- a/Source/WebCore/dom/WebKitNamedFlowCollection.cpp
+++ b/Source/WebCore/dom/NamedFlowCollection.cpp
@@ -28,8 +28,9 @@
  */
 
 #include "config.h"
-#include "WebKitNamedFlowCollection.h"
+#include "NamedFlowCollection.h"
 
+#include "DOMNamedFlowCollection.h"
 #include "Document.h"
 #include "InspectorInstrumentation.h"
 #include "WebKitNamedFlow.h"
@@ -39,12 +40,12 @@
 
 namespace WebCore {
 
-WebKitNamedFlowCollection::WebKitNamedFlowCollection(Document* doc)
+NamedFlowCollection::NamedFlowCollection(Document* doc)
     : m_document(doc)
 {
 }
 
-Vector<RefPtr<WebKitNamedFlow> > WebKitNamedFlowCollection::namedFlows()
+Vector<RefPtr<WebKitNamedFlow> > NamedFlowCollection::namedFlows()
 {
     Vector<RefPtr<WebKitNamedFlow> > namedFlows;
 
@@ -58,7 +59,7 @@ Vector<RefPtr<WebKitNamedFlow> > WebKitNamedFlowCollection::namedFlows()
     return namedFlows;
 }
 
-WebKitNamedFlow* WebKitNamedFlowCollection::flowByName(const String& flowName)
+WebKitNamedFlow* NamedFlowCollection::flowByName(const String& flowName)
 {
     NamedFlowSet::iterator it = m_namedFlows.find<String, NamedFlowHashTranslator>(flowName);
     if (it == m_namedFlows.end() || (*it)->flowState() == WebKitNamedFlow::FlowStateNull)
@@ -67,7 +68,7 @@ WebKitNamedFlow* WebKitNamedFlowCollection::flowByName(const String& flowName)
     return *it;
 }
 
-PassRefPtr<WebKitNamedFlow> WebKitNamedFlowCollection::ensureFlowWithName(const String& flowName)
+PassRefPtr<WebKitNamedFlow> NamedFlowCollection::ensureFlowWithName(const String& flowName)
 {
     NamedFlowSet::iterator it = m_namedFlows.find<String, NamedFlowHashTranslator>(flowName);
     if (it != m_namedFlows.end()) {
@@ -85,7 +86,7 @@ PassRefPtr<WebKitNamedFlow> WebKitNamedFlowCollection::ensureFlowWithName(const
     return newFlow.release();
 }
 
-void WebKitNamedFlowCollection::discardNamedFlow(WebKitNamedFlow* namedFlow)
+void NamedFlowCollection::discardNamedFlow(WebKitNamedFlow* namedFlow)
 {
     // The document is not valid anymore so the collection will be destroyed anyway.
     if (!m_document)
@@ -99,23 +100,17 @@ void WebKitNamedFlowCollection::discardNamedFlow(WebKitNamedFlow* namedFlow)
     InspectorInstrumentation::didRemoveNamedFlow(m_document, namedFlow->name());
 }
 
-void WebKitNamedFlowCollection::documentDestroyed()
+void NamedFlowCollection::documentDestroyed()
 {
     m_document = 0;
 }
-
-// The HashFunctions object used by the HashSet to compare between NamedFlows.
-// It is safe to set safeToCompareToEmptyOrDeleted because the HashSet will never contain null pointers or deleted values.
-struct WebKitNamedFlowCollection::NamedFlowHashFunctions {
-    static unsigned hash(WebKitNamedFlow* key) { return DefaultHash<String>::Hash::hash(key->name()); }
-    static bool equal(WebKitNamedFlow* a, WebKitNamedFlow* b) { return a->name() == b->name(); }
-    static const bool safeToCompareToEmptyOrDeleted = true;
-};
-
-// The HashTranslator is used to lookup a NamedFlow in the set using a name.
-struct WebKitNamedFlowCollection::NamedFlowHashTranslator {
-    static unsigned hash(const String& key) { return DefaultHash<String>::Hash::hash(key); }
-    static bool equal(WebKitNamedFlow* a, const String& b) { return a->name() == b; }
-};
+PassRefPtr<DOMNamedFlowCollection> NamedFlowCollection::createCSSOMSnapshot()
+{
+    NamedFlowSet createdFlows;
+    for (NamedFlowSet::iterator it = m_namedFlows.begin(); it != m_namedFlows.end(); ++it)
+        if ((*it)->flowState() == WebKitNamedFlow::FlowStateCreated)
+            createdFlows.add(*it);
+    return DOMNamedFlowCollection::create(createdFlows);
+}
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NamedFlowCollection.h b/Source/WebCore/dom/NamedFlowCollection.h
new file mode 100644
index 000000000..175b5e7cf
--- /dev/null
+++ b/Source/WebCore/dom/NamedFlowCollection.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef NamedFlowCollection_h
+#define NamedFlowCollection_h
+
+#include "WebKitNamedFlow.h"
+#include <wtf/Forward.h>
+#include <wtf/ListHashSet.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Document;
+class DOMNamedFlowCollection;
+
+class NamedFlowCollection : public RefCounted<NamedFlowCollection> {
+public:
+    static PassRefPtr<NamedFlowCollection> create(Document* doc) { return adoptRef(new NamedFlowCollection(doc)); }
+
+    Vector<RefPtr<WebKitNamedFlow> > namedFlows();
+    WebKitNamedFlow* flowByName(const String&);
+    PassRefPtr<WebKitNamedFlow> ensureFlowWithName(const String&);
+
+    void discardNamedFlow(WebKitNamedFlow*);
+
+    void documentDestroyed();
+
+    Document* document() const { return m_document; }
+
+    virtual ~NamedFlowCollection() { }
+
+    PassRefPtr<DOMNamedFlowCollection> createCSSOMSnapshot();
+
+    struct NamedFlowHashFunctions;
+    struct NamedFlowHashTranslator;
+
+    typedef ListHashSet<WebKitNamedFlow*, 1, NamedFlowHashFunctions> NamedFlowSet;
+
+private:
+
+    explicit NamedFlowCollection(Document*);
+
+    Document* m_document;
+    NamedFlowSet m_namedFlows;
+};
+
+// The HashFunctions object used by the HashSet to compare between NamedFlows.
+// It is safe to set safeToCompareToEmptyOrDeleted because the HashSet will never contain null pointers or deleted values.
+struct NamedFlowCollection::NamedFlowHashFunctions {
+    static unsigned hash(WebKitNamedFlow* key) { return DefaultHash<String>::Hash::hash(key->name()); }
+    static bool equal(WebKitNamedFlow* a, WebKitNamedFlow* b) { return a->name() == b->name(); }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+// The HashTranslator is used to lookup a NamedFlow in the set using a name.
+struct NamedFlowCollection::NamedFlowHashTranslator {
+    static unsigned hash(const String& key) { return DefaultHash<String>::Hash::hash(key); }
+    static bool equal(WebKitNamedFlow* a, const String& b) { return a->name() == b; }
+};
+} // namespace WebCore
+
+#endif // NamedFlowCollection_h
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index a3a1c22f2..88b5e05fe 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -40,6 +40,7 @@
 #include "CSSStyleSheet.h"
 #include "ChildNodeList.h"
 #include "ClassNodeList.h"
+#include "ContainerNodeAlgorithms.h"
 #include "ContextMenuController.h"
 #include "DOMImplementation.h"
 #include "DOMSettableTokenList.h"
@@ -67,7 +68,6 @@
 #include "KeyboardEvent.h"
 #include "LabelsNodeList.h"
 #include "Logging.h"
-#include "MemoryInstrumentation.h"
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "NameNodeList.h"
@@ -98,6 +98,7 @@
 #include "TreeScopeAdopter.h"
 #include "UIEvent.h"
 #include "UIEventWithKeyState.h"
+#include "WebCoreMemoryInstrumentation.h"
 #include "WheelEvent.h"
 #include "WindowEventContext.h"
 #include "XMLNames.h"
@@ -795,7 +796,7 @@ RenderBoxModelObject* Node::renderBoxModelObject() const
     return m_renderer && m_renderer->isBoxModelObject() ? toRenderBoxModelObject(m_renderer) : 0;
 }
 
-LayoutRect Node::getRect() const
+LayoutRect Node::boundingBox() const
 {
     if (renderer())
         return renderer()->absoluteBoundingBoxRect();
@@ -1199,6 +1200,11 @@ static void checkAcceptChild(Node* newParent, Node* newChild, ExceptionCode& ec)
         ec = HIERARCHY_REQUEST_ERR;
         return;
     }
+
+    if (newParent->inDocument() && ChildFrameDisconnector::nodeHasDisconnector(newParent)) {
+        ec = NO_MODIFICATION_ALLOWED_ERR;
+        return;
+    }
 }
 
 void Node::checkReplaceChild(Node* newChild, Node* oldChild, ExceptionCode& ec)
@@ -2091,15 +2097,17 @@ FloatPoint Node::convertFromPage(const FloatPoint& p) const
 
 #ifndef NDEBUG
 
-static void appendAttributeDesc(const Node* node, String& string, const QualifiedName& name, const char* attrDesc)
+static void appendAttributeDesc(const Node* node, StringBuilder& stringBuilder, const QualifiedName& name, const char* attrDesc)
 {
-    if (node->isElementNode()) {
-        String attr = static_cast<const Element*>(node)->getAttribute(name);
-        if (!attr.isEmpty()) {
-            string += attrDesc;
-            string += attr;
-        }
-    }
+    if (!node->isElementNode())
+        return;
+
+    String attr = static_cast<const Element*>(node)->getAttribute(name);
+    if (attr.isEmpty())
+        return;
+
+    stringBuilder.append(attrDesc);
+    stringBuilder.append(attr);
 }
 
 void Node::showNode(const char* prefix) const
@@ -2112,10 +2120,10 @@ void Node::showNode(const char* prefix) const
         value.replace('\n', "\\n");
         fprintf(stderr, "%s%s\t%p \"%s\"\n", prefix, nodeName().utf8().data(), this, value.utf8().data());
     } else {
-        String attrs = "";
+        StringBuilder attrs;
         appendAttributeDesc(this, attrs, classAttr, " CLASS=");
         appendAttributeDesc(this, attrs, styleAttr, " STYLE=");
-        fprintf(stderr, "%s%s\t%p%s\n", prefix, nodeName().utf8().data(), this, attrs.utf8().data());
+        fprintf(stderr, "%s%s\t%p%s\n", prefix, nodeName().utf8().data(), this, attrs.toString().utf8().data());
     }
 }
 
@@ -2183,16 +2191,18 @@ static void traverseTreeAndMark(const String& baseIndent, const Node* rootNode,
         if (node == markedNode2)
             fprintf(stderr, "%s", markedLabel2);
 
-        String indent = baseIndent;
+        StringBuilder indent;
+        indent.append(baseIndent);
         for (const Node* tmpNode = node; tmpNode && tmpNode != rootNode; tmpNode = tmpNode->parentOrHostNode())
-            indent += "\t";
-        fprintf(stderr, "%s", indent.utf8().data());
+            indent.append('\t');
+        fprintf(stderr, "%s", indent.toString().utf8().data());
         node->showNode();
+        indent.append('\t');
         if (node->isShadowRoot()) {
             if (ShadowRoot* youngerShadowRoot = toShadowRoot(node)->youngerShadowRoot())
-                traverseTreeAndMark(indent + "\t", youngerShadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
+                traverseTreeAndMark(indent.toString(), youngerShadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
         } else if (ShadowRoot* oldestShadowRoot = oldestShadowRootFor(node))
-            traverseTreeAndMark(indent + "\t", oldestShadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
+            traverseTreeAndMark(indent.toString(), oldestShadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
     }
 }
 
@@ -2212,13 +2222,13 @@ void Node::formatForDebugger(char* buffer, unsigned length) const
 {
     String result;
     String s;
-    
+
     s = nodeName();
-    if (s.length() == 0)
-        result += "<none>";
+    if (s.isEmpty())
+        result = "<none>";
     else
-        result += s;
-          
+        result = s;
+
     strncpy(buffer, result.utf8().data(), length - 1);
 }
 
@@ -2765,6 +2775,17 @@ bool Node::willRespondToMouseClickEvents()
     return isContentEditable() || hasEventListeners(eventNames().mouseupEvent) || hasEventListeners(eventNames().mousedownEvent) || hasEventListeners(eventNames().clickEvent) || hasEventListeners(eventNames().DOMActivateEvent);
 }
 
+bool Node::willRespondToTouchEvents()
+{
+#if ENABLE(TOUCH_EVENTS)
+    if (disabled())
+        return false;
+    return hasEventListeners(eventNames().touchstartEvent) || hasEventListeners(eventNames().touchmoveEvent) || hasEventListeners(eventNames().touchcancelEvent) || hasEventListeners(eventNames().touchendEvent);
+#else
+    return false;
+#endif
+}
+
 #if ENABLE(MICRODATA)
 DOMSettableTokenList* Node::itemProp()
 {
@@ -2821,7 +2842,7 @@ void Node::removedLastRef()
 
 void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
     TreeShared<Node, ContainerNode>::reportMemoryUsage(memoryObjectInfo);
     ScriptWrappable::reportMemoryUsage(memoryObjectInfo);
     info.addInstrumentedMember(m_document);
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 439aa936a..e9d7d5309 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -27,7 +27,7 @@
 
 #include "EditingBoundary.h"
 #include "EventTarget.h"
-#include "ExceptionCodePlaceholder.h"
+#include "FractionalLayoutRect.h"
 #include "KURLHash.h"
 #include "LayoutTypes.h"
 #include "MutationObserver.h"
@@ -187,8 +187,7 @@ public:
 
     void remove(ExceptionCode&);
     bool hasChildNodes() const { return firstChild(); }
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&) = 0;
-    PassRefPtr<Node> cloneNode(bool deep) { return cloneNode(deep, ASSERT_NO_EXCEPTION); }
+    virtual PassRefPtr<Node> cloneNode(bool deep) = 0;
     const AtomicString& localName() const { return virtualLocalName(); }
     const AtomicString& namespaceURI() const { return virtualNamespaceURI(); }
     const AtomicString& prefix() const { return virtualPrefix(); }
@@ -355,6 +354,7 @@ public:
         DoNotSetAttached
     };
     void lazyAttach(ShouldSetAttached = SetAttached);
+    void lazyReattach(ShouldSetAttached = SetAttached);
 
     virtual void setFocus(bool = true);
     virtual void setActive(bool f = true, bool /*pause*/ = false) { setFlag(f, IsActiveFlag); }
@@ -401,8 +401,8 @@ public:
     }
 
     virtual bool shouldUseInputMethod();
-    virtual LayoutRect getRect() const;
-    IntRect getPixelSnappedRect() const { return pixelSnappedIntRect(getRect()); }
+    virtual LayoutRect boundingBox() const;
+    IntRect pixelSnappedBoundingBox() const { return pixelSnappedIntRect(boundingBox()); }
     LayoutRect renderRect(bool* isReplaced);
     IntRect pixelSnappedRenderRect(bool* isReplaced) { return pixelSnappedIntRect(renderRect(isReplaced)); }
 
@@ -582,6 +582,7 @@ public:
 
     virtual bool willRespondToMouseMoveEvents();
     virtual bool willRespondToMouseClickEvents();
+    virtual bool willRespondToTouchEvents();
 
     PassRefPtr<Element> querySelector(const AtomicString& selectors, ExceptionCode&);
     PassRefPtr<NodeList> querySelectorAll(const AtomicString& selectors, ExceptionCode&);
@@ -876,6 +877,13 @@ inline void Node::reattachIfAttached()
         reattach();
 }
 
+inline void Node::lazyReattach(ShouldSetAttached shouldSetAttached)
+{
+    if (attached())
+        detach();
+    lazyAttach(shouldSetAttached);
+}
+
 } //namespace
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/dom/Node.idl b/Source/WebCore/dom/Node.idl
index 85feaee12..fc4a882ab 100644
--- a/Source/WebCore/dom/Node.idl
+++ b/Source/WebCore/dom/Node.idl
@@ -79,9 +79,7 @@ module core {
             raises(DOMException);
 
         boolean            hasChildNodes();
-        Node               cloneNode(in [Optional=DefaultIsUndefined] boolean deep)
-            raises(DOMException);
-
+        Node               cloneNode(in [Optional=DefaultIsUndefined] boolean deep);
         void               normalize();
 
         // Introduced in DOM Level 2:
diff --git a/Source/WebCore/dom/Notation.cpp b/Source/WebCore/dom/Notation.cpp
index 39592115f..f62e630aa 100644
--- a/Source/WebCore/dom/Notation.cpp
+++ b/Source/WebCore/dom/Notation.cpp
@@ -43,7 +43,7 @@ Node::NodeType Notation::nodeType() const
     return NOTATION_NODE;
 }
 
-PassRefPtr<Node> Notation::cloneNode(bool /*deep*/, ExceptionCode&)
+PassRefPtr<Node> Notation::cloneNode(bool /*deep*/)
 {
     // Spec says cloning Notation nodes is "implementation dependent". We do not support it.
     return 0;
diff --git a/Source/WebCore/dom/Notation.h b/Source/WebCore/dom/Notation.h
index 886077688..b2155ba05 100644
--- a/Source/WebCore/dom/Notation.h
+++ b/Source/WebCore/dom/Notation.h
@@ -38,7 +38,7 @@ private:
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType) const;
 
     String m_name;
diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
index 889143530..4fcf442e2 100644
--- a/Source/WebCore/dom/Position.cpp
+++ b/Source/WebCore/dom/Position.cpp
@@ -1314,20 +1314,20 @@ void Position::debugPosition(const char* msg) const
 
 void Position::formatForDebugger(char* buffer, unsigned length) const
 {
-    String result;
-    
+    StringBuilder result;
+
     if (isNull())
-        result = "<null>";
+        result.appendLiteral("<null>");
     else {
         char s[1024];
-        result += "offset ";
-        result += String::number(m_offset);
-        result += " of ";
+        result.appendLiteral("offset ");
+        result.appendNumber(m_offset);
+        result.appendLiteral(" of ");
         deprecatedNode()->formatForDebugger(s, sizeof(s));
-        result += s;
+        result.append(s);
     }
-          
-    strncpy(buffer, result.utf8().data(), length - 1);
+
+    strncpy(buffer, result.toString().utf8().data(), length - 1);
 }
 
 void Position::showAnchorTypeAndOffset() const
diff --git a/Source/WebCore/dom/ProcessingInstruction.cpp b/Source/WebCore/dom/ProcessingInstruction.cpp
index 87a0198f7..9a0eafa7b 100644
--- a/Source/WebCore/dom/ProcessingInstruction.cpp
+++ b/Source/WebCore/dom/ProcessingInstruction.cpp
@@ -97,7 +97,7 @@ void ProcessingInstruction::setNodeValue(const String& nodeValue, ExceptionCode&
     setData(nodeValue, ec);
 }
 
-PassRefPtr<Node> ProcessingInstruction::cloneNode(bool /*deep*/, ExceptionCode&)
+PassRefPtr<Node> ProcessingInstruction::cloneNode(bool /*deep*/)
 {
     // FIXME: Is it a problem that this does not copy m_localHref?
     // What about other data members?
@@ -254,7 +254,7 @@ void ProcessingInstruction::parseStyleSheet(const String& sheet)
     m_loading = false;
 
     if (m_isCSS)
-        static_cast<CSSStyleSheet*>(m_sheet.get())->contents()->checkLoaded();
+        static_cast<CSSStyleSheet*>(m_sheet.get())->contents()->checkLoadCompleted();
 #if ENABLE(XSLT)
     else if (m_isXSL)
         static_cast<XSLStyleSheet*>(m_sheet.get())->checkLoaded();
diff --git a/Source/WebCore/dom/ProcessingInstruction.h b/Source/WebCore/dom/ProcessingInstruction.h
index 0960d1574..e331e21df 100644
--- a/Source/WebCore/dom/ProcessingInstruction.h
+++ b/Source/WebCore/dom/ProcessingInstruction.h
@@ -60,7 +60,7 @@ private:
     virtual NodeType nodeType() const;
     virtual String nodeValue() const;
     virtual void setNodeValue(const String&, ExceptionCode&);
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool offsetInCharacters() const;
     virtual int maxCharacterOffset() const;
 
diff --git a/Source/WebCore/dom/QualifiedName.h b/Source/WebCore/dom/QualifiedName.h
index d1f52697f..12b782aa1 100644
--- a/Source/WebCore/dom/QualifiedName.h
+++ b/Source/WebCore/dom/QualifiedName.h
@@ -21,7 +21,7 @@
 #ifndef QualifiedName_h
 #define QualifiedName_h
 
-#include "MemoryInstrumentation.h"
+#include "WebCoreMemoryInstrumentation.h"
 
 #include <wtf/HashTraits.h>
 #include <wtf/RefCounted.h>
@@ -52,7 +52,7 @@ public:
 
         void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
         {
-            MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+            MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
             info.addInstrumentedMember(m_prefix);
             info.addInstrumentedMember(m_localName);
             info.addInstrumentedMember(m_namespace);
@@ -103,7 +103,7 @@ public:
     
     void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
         info.addInstrumentedMember(m_impl);
     }
 private:
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index c4e435a6f..c71fa1cd9 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -1652,31 +1652,30 @@ void Range::textQuads(Vector<FloatQuad>& quads, bool useSelectionHeight, RangeIn
 }
 
 #ifndef NDEBUG
-#define FormatBufferSize 1024
 void Range::formatForDebugger(char* buffer, unsigned length) const
 {
-    String result;
+    StringBuilder result;
     String s;
-    
+
     if (!m_start.container() || !m_end.container())
-        result = "<empty>";
+        result.appendLiteral("<empty>");
     else {
+        const int FormatBufferSize = 1024;
         char s[FormatBufferSize];
-        result += "from offset ";
-        result += String::number(m_start.offset());
-        result += " of ";
+        result.appendLiteral("from offset ");
+        result.appendNumber(m_start.offset());
+        result.appendLiteral(" of ");
         m_start.container()->formatForDebugger(s, FormatBufferSize);
-        result += s;
-        result += " to offset ";
-        result += String::number(m_end.offset());
-        result += " of ";
+        result.append(s);
+        result.appendLiteral(" to offset ");
+        result.appendNumber(m_end.offset());
+        result.appendLiteral(" of ");
         m_end.container()->formatForDebugger(s, FormatBufferSize);
-        result += s;
+        result.append(s);
     }
-          
-    strncpy(buffer, result.utf8().data(), length - 1);
+
+    strncpy(buffer, result.toString().utf8().data(), length - 1);
 }
-#undef FormatBufferSize
 #endif
 
 bool areRangesEqual(const Range* a, const Range* b)
diff --git a/Source/WebCore/dom/Range.h b/Source/WebCore/dom/Range.h
index dffaefc67..b6bf7711d 100644
--- a/Source/WebCore/dom/Range.h
+++ b/Source/WebCore/dom/Range.h
@@ -29,7 +29,6 @@
 #include "FloatRect.h"
 #include "FragmentScriptingPermission.h"
 #include "IntRect.h"
-#include "Node.h"
 #include "RangeBoundaryPoint.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
@@ -43,6 +42,7 @@ class ContainerNode;
 class Document;
 class DocumentFragment;
 class FloatQuad;
+class Node;
 class NodeWithIndex;
 class Text;
 
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 62e82306c..209fc79c1 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -335,7 +335,7 @@ void ScriptElement::notifyFinished(CachedResource* resource)
         && !m_cachedScript->passesAccessControlCheck(m_element->document()->securityOrigin())) {
 
         dispatchErrorEvent();
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Cross-origin script load denied by Cross-Origin Resource Sharing policy."));
+        DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Cross-origin script load denied by Cross-Origin Resource Sharing policy.")));
         m_element->document()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage);
         return;
     }
diff --git a/Source/WebCore/dom/SecurityContext.cpp b/Source/WebCore/dom/SecurityContext.cpp
index d32ab798f..7e9f83920 100644
--- a/Source/WebCore/dom/SecurityContext.cpp
+++ b/Source/WebCore/dom/SecurityContext.cpp
@@ -106,9 +106,10 @@ SandboxFlags SecurityContext::parseSandboxPolicy(const String& policy)
             flags &= ~SandboxOrigin;
         else if (equalIgnoringCase(sandboxToken, "allow-forms"))
             flags &= ~SandboxForms;
-        else if (equalIgnoringCase(sandboxToken, "allow-scripts"))
+        else if (equalIgnoringCase(sandboxToken, "allow-scripts")) {
             flags &= ~SandboxScripts;
-        else if (equalIgnoringCase(sandboxToken, "allow-top-navigation"))
+            flags &= ~SandboxAutomaticFeatures;
+        } else if (equalIgnoringCase(sandboxToken, "allow-top-navigation"))
             flags &= ~SandboxTopNavigation;
         else if (equalIgnoringCase(sandboxToken, "allow-popups"))
             flags &= ~SandboxPopups;
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 1aadc5126..9e9abc438 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -82,23 +82,7 @@ static bool allowsAuthorShadowRoot(Element* element)
     if (RuntimeEnabledFeatures::authorShadowDOMForAnyElementEnabled())
         return true;
 #endif
-
-    // FIXME: The elements in Shadow DOM of an input element assumes that they have renderer if the input
-    // element has a renderer. However, this does not hold until input elemnet is AuthorShadowDOM-ready.
-    // So we would like to prohibit having a AuthorShadowDOM for a while. The same thing happens to
-    // textarea element also.
-    // https://bugs.webkit.org/show_bug.cgi?id=92608
-    if (isHTMLInputElement(element) || isHTMLTextAreaElement(element))
-        return false;
-
-    // FIXME: We disable multiple shadow subtrees for SVG for while, because there will be problems to support it.
-    // https://bugs.webkit.org/show_bug.cgi?id=78205
-    // Especially SVG TREF recreates shadow root dynamically.
-    // https://bugs.webkit.org/show_bug.cgi?id=77938
-    if (element->isSVGElement())
-        return false;
-
-    return true;
+    return element->areAuthorShadowsAllowed();
 }
 
 PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ExceptionCode& ec)
@@ -139,13 +123,23 @@ String ShadowRoot::nodeName() const
     return "#shadow-root";
 }
 
-PassRefPtr<Node> ShadowRoot::cloneNode(bool, ExceptionCode& ec)
+PassRefPtr<Node> ShadowRoot::cloneNode(bool)
 {
     // ShadowRoot should not be arbitrarily cloned.
-    ec = DATA_CLONE_ERR;
     return 0;
 }
 
+PassRefPtr<Node> ShadowRoot::cloneNode(bool deep, ExceptionCode& ec)
+{
+    RefPtr<Node> clone = cloneNode(deep);
+    if (!clone) {
+        ec = DATA_CLONE_ERR;
+        return 0;
+    }
+
+    return clone;
+}
+
 String ShadowRoot::innerHTML() const
 {
     return createMarkup(this, ChildrenOnly);
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index 1c9f02cc0..6f7009d09 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -93,11 +93,13 @@ public:
     ShadowRootType type() const { return m_type; }
 #endif
 
+    PassRefPtr<Node> cloneNode(bool, ExceptionCode&);
+
 private:
     explicit ShadowRoot(Document*);
     virtual ~ShadowRoot();
     virtual String nodeName() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType) const;
     virtual void childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta) OVERRIDE;
 
diff --git a/Source/WebCore/dom/ShadowRoot.idl b/Source/WebCore/dom/ShadowRoot.idl
index c04c3e15d..9e9932349 100644
--- a/Source/WebCore/dom/ShadowRoot.idl
+++ b/Source/WebCore/dom/ShadowRoot.idl
@@ -39,6 +39,9 @@ module core {
         attribute [TreatNullAs=NullString] DOMString innerHTML
             setter raises(DOMException);
 
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        Node cloneNode(in [Optional=DefaultIsUndefined] boolean deep) raises(DOMException);
+#endif
         DOMSelection getSelection();
         Element getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
         NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString className);
diff --git a/Source/WebCore/dom/StyleElement.cpp b/Source/WebCore/dom/StyleElement.cpp
index dd4de2901..3fc8e7c44 100644
--- a/Source/WebCore/dom/StyleElement.cpp
+++ b/Source/WebCore/dom/StyleElement.cpp
@@ -149,6 +149,7 @@ void StyleElement::createSheet(Element* e, WTF::OrdinalNumber startLineNumber, c
 {
     ASSERT(e);
     ASSERT(e->inDocument());
+
     Document* document = e->document();
     if (m_sheet) {
         if (m_sheet->isLoading())
@@ -181,7 +182,7 @@ void StyleElement::createSheet(Element* e, WTF::OrdinalNumber startLineNumber, c
     }
 
     if (m_sheet)
-        m_sheet->contents()->checkLoaded();
+        m_sheet->contents()->checkLoadCompleted();
 }
 
 bool StyleElement::isLoading() const
diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
index 87e366362..66a16ffd7 100644
--- a/Source/WebCore/dom/Text.cpp
+++ b/Source/WebCore/dom/Text.cpp
@@ -185,7 +185,7 @@ Node::NodeType Text::nodeType() const
     return TEXT_NODE;
 }
 
-PassRefPtr<Node> Text::cloneNode(bool /*deep*/, ExceptionCode&)
+PassRefPtr<Node> Text::cloneNode(bool /*deep*/)
 {
     return create(document(), data());
 }
@@ -301,23 +301,20 @@ void Text::willRecalcTextStyle(StyleChange)
 #ifndef NDEBUG
 void Text::formatForDebugger(char *buffer, unsigned length) const
 {
-    String result;
+    StringBuilder result;
     String s;
-    
-    s = nodeName();
-    if (s.length() > 0) {
-        result += s;
-    }
-          
+
+    result.append(nodeName());
+
     s = data();
     if (s.length() > 0) {
-        if (result.length() > 0)
-            result += "; ";
-        result += "value=";
-        result += s;
+        if (result.length())
+            result.appendLiteral("; ");
+        result.appendLiteral("value=");
+        result.append(s);
     }
-          
-    strncpy(buffer, result.utf8().data(), length - 1);
+
+    strncpy(buffer, result.toString().utf8().data(), length - 1);
 }
 #endif
 
diff --git a/Source/WebCore/dom/Text.h b/Source/WebCore/dom/Text.h
index 8e97e290b..daf382240 100644
--- a/Source/WebCore/dom/Text.h
+++ b/Source/WebCore/dom/Text.h
@@ -58,7 +58,7 @@ protected:
 private:
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep, ExceptionCode&);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool childTypeAllowed(NodeType) const;
diff --git a/Source/WebCore/dom/Touch.h b/Source/WebCore/dom/Touch.h
index 1e80253e6..152e3e2e9 100644
--- a/Source/WebCore/dom/Touch.h
+++ b/Source/WebCore/dom/Touch.h
@@ -29,7 +29,7 @@
 #if ENABLE(TOUCH_EVENTS)
 
 #include "EventTarget.h"
-#include "LayoutTypes.h"
+#include "LayoutTypesInlineMethods.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
diff --git a/Source/WebCore/dom/TransformSource.h b/Source/WebCore/dom/TransformSource.h
index b1ad291ab..7ba17eeb2 100644
--- a/Source/WebCore/dom/TransformSource.h
+++ b/Source/WebCore/dom/TransformSource.h
@@ -22,8 +22,10 @@
 
 #if ENABLE(XSLT)
 
-#include "PlatformString.h"
+#include <wtf/FastAllocBase.h>
+#include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/TreeScopeAdopter.h b/Source/WebCore/dom/TreeScopeAdopter.h
index d2bd4d4f0..4ca418219 100644
--- a/Source/WebCore/dom/TreeScopeAdopter.h
+++ b/Source/WebCore/dom/TreeScopeAdopter.h
@@ -25,10 +25,12 @@
 #ifndef TreeScopeAdopter_h
 #define TreeScopeAdopter_h
 
-#include "Element.h"
+#include "Node.h"
 
 namespace WebCore {
 
+class TreeScope;
+
 class TreeScopeAdopter {
 public:
     explicit TreeScopeAdopter(Node* toAdopt, TreeScope* newScope);
diff --git a/Source/WebCore/dom/UIEvent.cpp b/Source/WebCore/dom/UIEvent.cpp
index 9e73316fb..367372670 100644
--- a/Source/WebCore/dom/UIEvent.cpp
+++ b/Source/WebCore/dom/UIEvent.cpp
@@ -26,6 +26,7 @@
 #include "Console.h"
 #include "DOMWindow.h"
 #include "EventDispatcher.h"
+#include "Node.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/dom/UserGestureIndicator.cpp b/Source/WebCore/dom/UserGestureIndicator.cpp
index 10e46ee94..de1323659 100644
--- a/Source/WebCore/dom/UserGestureIndicator.cpp
+++ b/Source/WebCore/dom/UserGestureIndicator.cpp
@@ -34,6 +34,7 @@ static bool isDefinite(ProcessingUserGestureState state)
 }
 
 ProcessingUserGestureState UserGestureIndicator::s_state = DefinitelyNotProcessingUserGesture;
+size_t UserGestureIndicator::s_consumableGestures = 0;
 
 UserGestureIndicator::UserGestureIndicator(ProcessingUserGestureState state)
     : m_previousState(s_state)
@@ -41,13 +42,26 @@ UserGestureIndicator::UserGestureIndicator(ProcessingUserGestureState state)
     // We overwrite s_state only if the caller is definite about the gesture state.
     if (isDefinite(state))
         s_state = state;
+
+    if (s_state == DefinitelyProcessingUserGesture)
+        s_consumableGestures++;
     ASSERT(isDefinite(s_state));
 }
 
 UserGestureIndicator::~UserGestureIndicator()
 {
+    if (s_consumableGestures && s_state == DefinitelyProcessingUserGesture)
+        s_consumableGestures--;
     s_state = m_previousState;
     ASSERT(isDefinite(s_state));
 }
 
+bool UserGestureIndicator::consumeUserGesture()
+{
+    if (!s_consumableGestures)
+        return false;
+    s_consumableGestures--;
+    return true;
+}
+
 }
diff --git a/Source/WebCore/dom/UserGestureIndicator.h b/Source/WebCore/dom/UserGestureIndicator.h
index 1d0100814..50aabfbed 100644
--- a/Source/WebCore/dom/UserGestureIndicator.h
+++ b/Source/WebCore/dom/UserGestureIndicator.h
@@ -39,13 +39,15 @@ enum ProcessingUserGestureState {
 class UserGestureIndicator {
     WTF_MAKE_NONCOPYABLE(UserGestureIndicator);
 public:
-    static bool processingUserGesture() { return s_state == DefinitelyProcessingUserGesture; }
+    static bool processingUserGesture() { return s_consumableGestures && s_state == DefinitelyProcessingUserGesture; }
+    static bool consumeUserGesture();
 
     explicit UserGestureIndicator(ProcessingUserGestureState);
     ~UserGestureIndicator();
 
 private:
     static ProcessingUserGestureState s_state;
+    static size_t s_consumableGestures;
     ProcessingUserGestureState m_previousState;
 };
 
diff --git a/Source/WebCore/dom/ViewportArguments.cpp b/Source/WebCore/dom/ViewportArguments.cpp
index 4da905029..e457b037a 100644
--- a/Source/WebCore/dom/ViewportArguments.cpp
+++ b/Source/WebCore/dom/ViewportArguments.cpp
@@ -34,8 +34,8 @@
 #include "Frame.h"
 #include "IntSize.h"
 #include "Page.h"
-#include "PlatformString.h"
 #include "ScriptableDocumentParser.h"
+#include <wtf/text/WTFString.h>
 
 using namespace std;
 
diff --git a/Source/WebCore/dom/WebCoreMemoryInstrumentation.cpp b/Source/WebCore/dom/WebCoreMemoryInstrumentation.cpp
new file mode 100644
index 000000000..4ce0df282
--- /dev/null
+++ b/Source/WebCore/dom/WebCoreMemoryInstrumentation.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCoreMemoryInstrumentation.h"
+
+#include "KURL.h"
+#include <wtf/text/StringImpl.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+MemoryObjectType GenericMemoryTypes::Undefined = 0;
+
+MemoryObjectType WebCoreMemoryTypes::Page = "Page";
+MemoryObjectType WebCoreMemoryTypes::DOM = "Page.DOM";
+MemoryObjectType WebCoreMemoryTypes::CSS = "Page.CSS";
+MemoryObjectType WebCoreMemoryTypes::Binding = "Page.Binding";
+MemoryObjectType WebCoreMemoryTypes::Loader = "Page.Loader";
+
+MemoryObjectType WebCoreMemoryTypes::MemoryCache = "MemoryCache";
+MemoryObjectType WebCoreMemoryTypes::MemoryCacheStructures = "MemoryCache.InternalStructures";
+MemoryObjectType WebCoreMemoryTypes::CachedResource = "MemoryCache.Resource";
+MemoryObjectType WebCoreMemoryTypes::CachedResourceRaw = "MemoryCache.RawResource";
+MemoryObjectType WebCoreMemoryTypes::CachedResourceCSS = "MemoryCache.CSS";
+MemoryObjectType WebCoreMemoryTypes::CachedResourceFont = "MemoryCache.Font";
+MemoryObjectType WebCoreMemoryTypes::CachedResourceImage = "MemoryCache.Image";
+MemoryObjectType WebCoreMemoryTypes::CachedResourceScript = "MemoryCache.Script";
+MemoryObjectType WebCoreMemoryTypes::CachedResourceSVG = "MemoryCache.SVG";
+MemoryObjectType WebCoreMemoryTypes::CachedResourceShader = "MemoryCache.Shader";
+MemoryObjectType WebCoreMemoryTypes::CachedResourceXSLT = "MemoryCache.XSLT";
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<String>(MemoryInstrumentation* instrumentation, const String* const& string, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
+{
+    MemoryInstrumentationTraits::addInstrumentedObject<const String>(instrumentation, string, ownerObjectType, owningType);
+}
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<const String>(MemoryInstrumentation* instrumentation, const String* const& string, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
+{
+    if (!string || instrumentation->visited(string))
+        return;
+    if (owningType == byPointer)
+        instrumentation->countObjectSize(ownerObjectType, sizeof(String));
+    instrumentation->addInstrumentedObject(string->impl(), ownerObjectType);
+}
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<StringImpl>(MemoryInstrumentation* instrumentation, const StringImpl* const& stringImpl, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
+{
+    MemoryInstrumentationTraits::addInstrumentedObject<const StringImpl>(instrumentation, stringImpl, ownerObjectType, owningType);
+}
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<const StringImpl>(MemoryInstrumentation* instrumentation, const StringImpl* const& stringImpl, MemoryObjectType ownerObjectType, MemoryOwningType)
+{
+    if (!stringImpl || instrumentation->visited(stringImpl))
+        return;
+    instrumentation->countObjectSize(ownerObjectType, stringImpl->sizeInBytes());
+}
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<KURL>(MemoryInstrumentation* instrumentation, const KURL* const& url, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
+{
+    MemoryInstrumentationTraits::addInstrumentedObject<const KURL>(instrumentation, url, ownerObjectType, owningType);
+}
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<const KURL>(MemoryInstrumentation* instrumentation, const KURL* const& url, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
+{
+    if (!url || instrumentation->visited(url))
+        return;
+    if (owningType == byPointer)
+        instrumentation->countObjectSize(ownerObjectType, sizeof(KURL));
+    instrumentation->addInstrumentedObject(url->string(), ownerObjectType);
+    if (url->innerURL())
+        instrumentation->addInstrumentedObject(url->innerURL(), ownerObjectType);
+}
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<AtomicString>(MemoryInstrumentation* instrumentation, const AtomicString* const& atomicString, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
+{
+    MemoryInstrumentationTraits::addInstrumentedObject<const AtomicString>(instrumentation, atomicString, ownerObjectType, owningType);
+}
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<const AtomicString>(MemoryInstrumentation* instrumentation, const AtomicString* const& atomicString, MemoryObjectType ownerObjectType, MemoryOwningType owningType)
+{
+    MemoryInstrumentationTraits::addInstrumentedObject<const String>(instrumentation, reinterpret_cast<const String* const>(atomicString), ownerObjectType, owningType);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/dom/WebCoreMemoryInstrumentation.h b/Source/WebCore/dom/WebCoreMemoryInstrumentation.h
new file mode 100644
index 000000000..c8684bba7
--- /dev/null
+++ b/Source/WebCore/dom/WebCoreMemoryInstrumentation.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCoreMemoryInstrumentation_h
+#define WebCoreMemoryInstrumentation_h
+
+#include "MemoryInstrumentation.h"
+
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class KURL;
+
+// Explicit specializations for some types.
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<KURL>(MemoryInstrumentation*, const KURL* const&, MemoryObjectType, MemoryOwningType);
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<const KURL>(MemoryInstrumentation*, const KURL* const&, MemoryObjectType, MemoryOwningType);
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<String>(MemoryInstrumentation*, const String* const&, MemoryObjectType, MemoryOwningType);
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<const String>(MemoryInstrumentation*, const String* const&, MemoryObjectType, MemoryOwningType);
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<StringImpl>(MemoryInstrumentation*, const StringImpl* const&, MemoryObjectType, MemoryOwningType);
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<const StringImpl>(MemoryInstrumentation*, const StringImpl* const&, MemoryObjectType, MemoryOwningType);
+
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<AtomicString>(MemoryInstrumentation*, const AtomicString* const&, MemoryObjectType, MemoryOwningType);
+template<> void MemoryInstrumentationTraits::addInstrumentedObject<const AtomicString>(MemoryInstrumentation*, const AtomicString* const&, MemoryObjectType, MemoryOwningType);
+
+
+// Link time guards with no body.
+template<> void MemoryInstrumentationTraits::addObject<KURL>(MemoryInstrumentation*, const KURL* const&, MemoryObjectType, MemoryOwningType);
+template<> void MemoryInstrumentationTraits::addObject<const KURL>(MemoryInstrumentation*, const KURL* const&, MemoryObjectType, MemoryOwningType);
+
+template<> void MemoryInstrumentationTraits::addObject<String>(MemoryInstrumentation*, const String* const&, MemoryObjectType, MemoryOwningType);
+template<> void MemoryInstrumentationTraits::addObject<const String>(MemoryInstrumentation*, const String* const&, MemoryObjectType, MemoryOwningType);
+
+template<> void MemoryInstrumentationTraits::addObject<StringImpl>(MemoryInstrumentation*, const StringImpl* const&, MemoryObjectType, MemoryOwningType);
+template<> void MemoryInstrumentationTraits::addObject<const StringImpl>(MemoryInstrumentation*, const StringImpl* const&, MemoryObjectType, MemoryOwningType);
+
+template<> void MemoryInstrumentationTraits::addObject<AtomicString>(MemoryInstrumentation*, const AtomicString* const&, MemoryObjectType, MemoryOwningType);
+template<> void MemoryInstrumentationTraits::addObject<const AtomicString>(MemoryInstrumentation*, const AtomicString* const&, MemoryObjectType, MemoryOwningType);
+
+class WebCoreMemoryTypes {
+public:
+    static MemoryObjectType Page;
+    static MemoryObjectType DOM;
+    static MemoryObjectType CSS;
+    static MemoryObjectType Binding;
+    static MemoryObjectType Loader;
+
+    static MemoryObjectType MemoryCache;
+    static MemoryObjectType MemoryCacheStructures;
+    static MemoryObjectType CachedResource;
+    static MemoryObjectType CachedResourceRaw;
+    static MemoryObjectType CachedResourceCSS;
+    static MemoryObjectType CachedResourceFont;
+    static MemoryObjectType CachedResourceImage;
+    static MemoryObjectType CachedResourceScript;
+    static MemoryObjectType CachedResourceSVG;
+    static MemoryObjectType CachedResourceShader;
+    static MemoryObjectType CachedResourceXSLT;
+};
+
+} // namespace WebCore
+
+#endif // !defined(WebCoreMemoryInstrumentation_h)
diff --git a/Source/WebCore/dom/WebKitNamedFlow.cpp b/Source/WebCore/dom/WebKitNamedFlow.cpp
index aa5901b67..8009eae2a 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.cpp
+++ b/Source/WebCore/dom/WebKitNamedFlow.cpp
@@ -31,16 +31,16 @@
 #include "WebKitNamedFlow.h"
 
 #include "EventNames.h"
+#include "NamedFlowCollection.h"
 #include "RenderNamedFlowThread.h"
 #include "RenderRegion.h"
 #include "ScriptExecutionContext.h"
 #include "StaticNodeList.h"
 #include "UIEvent.h"
-#include "WebKitNamedFlowCollection.h"
 
 namespace WebCore {
 
-WebKitNamedFlow::WebKitNamedFlow(PassRefPtr<WebKitNamedFlowCollection> manager, const AtomicString& flowThreadName)
+WebKitNamedFlow::WebKitNamedFlow(PassRefPtr<NamedFlowCollection> manager, const AtomicString& flowThreadName)
     : m_flowThreadName(flowThreadName)
     , m_flowManager(manager)
     , m_parentFlowThread(0)
@@ -53,7 +53,7 @@ WebKitNamedFlow::~WebKitNamedFlow()
     m_flowManager->discardNamedFlow(this);
 }
 
-PassRefPtr<WebKitNamedFlow> WebKitNamedFlow::create(PassRefPtr<WebKitNamedFlowCollection> manager, const AtomicString& flowThreadName)
+PassRefPtr<WebKitNamedFlow> WebKitNamedFlow::create(PassRefPtr<NamedFlowCollection> manager, const AtomicString& flowThreadName)
 {
     return adoptRef(new WebKitNamedFlow(manager, flowThreadName));
 }
@@ -117,7 +117,7 @@ PassRefPtr<NodeList> WebKitNamedFlow::getRegionsByContent(Node* contentNode)
         const RenderRegionList& regionList = m_parentFlowThread->renderRegionList();
         for (RenderRegionList::const_iterator iter = regionList.begin(); iter != regionList.end(); ++iter) {
             const RenderRegion* renderRegion = *iter;
-            // FIXME: Pseudo-elements are not included in the list
+            // FIXME: Pseudo-elements are not included in the list.
             if (!renderRegion->isValid() || !renderRegion->node())
                 continue;
             if (m_parentFlowThread->objectInFlowRegion(contentNode->renderer(), renderRegion))
@@ -143,7 +143,7 @@ PassRefPtr<NodeList> WebKitNamedFlow::getRegions()
     const RenderRegionList& regionList = m_parentFlowThread->renderRegionList();
     for (RenderRegionList::const_iterator iter = regionList.begin(); iter != regionList.end(); ++iter) {
         const RenderRegion* renderRegion = *iter;
-        // FIXME: Pseudo-elements are not included in the list
+        // FIXME: Pseudo-elements are not included in the list.
         if (!renderRegion->isValid() || !renderRegion->node())
             continue;
         regionNodes.append(renderRegion->node());
@@ -179,7 +179,7 @@ void WebKitNamedFlow::setRenderer(RenderNamedFlowThread* parentFlowThread)
     // The named flow can either go from a no_renderer->renderer or renderer->no_renderer state; anything else could indicate a bug.
     ASSERT((!m_parentFlowThread && parentFlowThread) || (m_parentFlowThread && !parentFlowThread));
 
-    // If parentFlowThread is 0, the flow thread will move in the "NULL" state"
+    // If parentFlowThread is 0, the flow thread will move in the "NULL" state.
     m_parentFlowThread = parentFlowThread;
 }
 
diff --git a/Source/WebCore/dom/WebKitNamedFlow.h b/Source/WebCore/dom/WebKitNamedFlow.h
index b51eadfb9..9069ad580 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.h
+++ b/Source/WebCore/dom/WebKitNamedFlow.h
@@ -40,15 +40,15 @@
 namespace WebCore {
 
 class Document;
+class NamedFlowCollection;
 class Node;
 class NodeList;
 class RenderNamedFlowThread;
 class ScriptExecutionContext;
-class WebKitNamedFlowCollection;
 
 class WebKitNamedFlow : public RefCounted<WebKitNamedFlow>, public EventTarget {
 public:
-    static PassRefPtr<WebKitNamedFlow> create(PassRefPtr<WebKitNamedFlowCollection> manager, const AtomicString& flowThreadName);
+    static PassRefPtr<WebKitNamedFlow> create(PassRefPtr<NamedFlowCollection> manager, const AtomicString& flowThreadName);
 
     ~WebKitNamedFlow();
 
@@ -81,7 +81,7 @@ public:
     void dispatchRegionLayoutUpdateEvent();
 
 private:
-    WebKitNamedFlow(PassRefPtr<WebKitNamedFlowCollection>, const AtomicString&);
+    WebKitNamedFlow(PassRefPtr<NamedFlowCollection>, const AtomicString&);
 
     // EventTarget implementation.
     virtual void refEventTarget() { ref(); }
@@ -93,7 +93,7 @@ private:
     // The name of the flow thread as specified in CSS.
     AtomicString m_flowThreadName;
 
-    RefPtr<WebKitNamedFlowCollection> m_flowManager;
+    RefPtr<NamedFlowCollection> m_flowManager;
     RenderNamedFlowThread* m_parentFlowThread;
 
     EventTargetData m_eventTargetData;
diff --git a/Source/WebCore/dom/make_names.pl b/Source/WebCore/dom/make_names.pl
index 5bd5e97d9..887c1a9db 100755
--- a/Source/WebCore/dom/make_names.pl
+++ b/Source/WebCore/dom/make_names.pl
@@ -1041,12 +1041,12 @@ END
         } elsif ($wrapperFactoryType eq "V8") {
             if ($enabledTags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
                 print F <<END
-static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate)
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
     Settings* settings = element->document()->settings();
     if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
-        return V8$parameters{namespace}Element::wrap(element, isolate);
-    return toV8(static_cast<${JSInterfaceName}*>(element), isolate);
+        return V8$parameters{namespace}Element::wrap(element, creationContext, isolate);
+    return toV8(static_cast<${JSInterfaceName}*>(element), creationContext, isolate);
 }
 
 END
@@ -1054,28 +1054,28 @@ END
             } elsif ($enabledTags{$tagName}{contextConditional}) {
                 my $contextConditional = $enabledTags{$tagName}{contextConditional};
                 print F <<END
-static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate)
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
     if (!ContextFeatures::${contextConditional}Enabled(element->document()))
-        return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element), isolate);
-    return toV8(static_cast<${JSInterfaceName}*>(element), isolate);
+        return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element), creationContext, isolate);
+    return toV8(static_cast<${JSInterfaceName}*>(element), creationContext, isolate);
 }
 END
 ;
             } elsif (${JSInterfaceName} eq "HTMLElement") {
                 print F <<END
-static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate)
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-    return V8$parameters{namespace}Element::wrap(element, isolate);
+    return V8$parameters{namespace}Element::wrap(element, creationContext, isolate);
 }
 
 END
 ;
              } else {
             print F <<END
-static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate)
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-    return toV8(static_cast<${JSInterfaceName}*>(element), isolate);
+    return toV8(static_cast<${JSInterfaceName}*>(element), creationContext, isolate);
 }
 
 
@@ -1157,7 +1157,7 @@ END
 ;
     } elsif ($wrapperFactoryType eq "V8") {
         print F <<END
-typedef v8::Handle<v8::Value> (*Create$parameters{namespace}ElementWrapperFunction)($parameters{namespace}Element*, v8::Isolate*);
+typedef v8::Handle<v8::Value> (*Create$parameters{namespace}ElementWrapperFunction)($parameters{namespace}Element*, v8::Handle<v8::Object> creationContext, v8::Isolate*);
 
 END
 ;
@@ -1176,7 +1176,7 @@ END
 ;
     } elsif ($wrapperFactoryType eq "V8") {
         print F <<END
-v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate, bool forceNewObject)
+v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element* element, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate, bool forceNewObject)
 {
     typedef HashMap<WTF::AtomicStringImpl*, Create$parameters{namespace}ElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
@@ -1217,8 +1217,8 @@ END
 ;
     } elsif ($wrapperFactoryType eq "V8") {
         print F <<END
-        return createWrapperFunction(element, isolate);
-    return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element), 0, forceNewObject);
+        return createWrapperFunction(element, creationContext, isolate);
+    return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element), creationContext, isolate, forceNewObject);
 END
 ;
     }
@@ -1278,7 +1278,7 @@ namespace WebCore {
 
     class $parameters{namespace}Element;
 
-    v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element*, v8::Isolate*, bool);
+    v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element*, v8::Handle<v8::Object> creationContext, v8::Isolate*, bool);
 }
 END
 ;