Imported WebKit commit 1350e72f7345ced9da2bd9980deeeb5a8d62fab4 (http://svn.webkit.org/repository/webkit/trunk@117578)

Weekly snapshot

979 files changed, 26120 insertions, 11193 deletions

diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index 61c884388..7264bb654 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -3,6 +3,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/Modules/filesystem"
     "${WEBCORE_DIR}/Modules/geolocation"
     "${WEBCORE_DIR}/Modules/indexeddb"
+    "${WEBCORE_DIR}/Modules/intents"
     "${WEBCORE_DIR}/Modules/webaudio"
     "${WEBCORE_DIR}/Modules/webdatabase"
     "${WEBCORE_DIR}/Modules/websockets"
@@ -492,7 +493,6 @@ SET(WebCore_SOURCES
     css/CSSSegmentedFontFace.cpp
     css/CSSSelector.cpp
     css/CSSSelectorList.cpp
-    css/CSSStyleDeclaration.cpp
     css/CSSStyleRule.cpp
     css/CSSStyleSheet.cpp
     css/CSSTimingFunctionValue.cpp
@@ -645,7 +645,6 @@ SET(WebCore_SOURCES
     dom/TransformSourceLibxslt.cpp
     dom/Traversal.cpp
     dom/TreeScope.cpp
-    dom/TreeScopeAdjuster.cpp
     dom/TreeScopeAdopter.cpp
     dom/TreeWalker.cpp
     dom/UIEvent.cpp
@@ -900,10 +899,10 @@ SET(WebCore_SOURCES
     html/parser/TextViewSourceParser.cpp
     html/parser/XSSAuditor.cpp
 
+    html/shadow/ContentDistributor.cpp
     html/shadow/ContentSelectorQuery.cpp
     html/shadow/DetailsMarkerControl.cpp
     html/shadow/HTMLContentElement.cpp
-    html/shadow/HTMLContentSelector.cpp
     html/shadow/HTMLShadowElement.cpp
     html/shadow/InsertionPoint.cpp
     html/shadow/MediaControls.cpp
@@ -1136,6 +1135,7 @@ SET(WebCore_SOURCES
     platform/ThreadTimers.cpp
     platform/Timer.cpp
     platform/UUID.cpp
+    platform/VisitedLinks.cpp
     platform/Widget.cpp
 
     platform/animation/Animation.cpp
@@ -1212,7 +1212,6 @@ SET(WebCore_SOURCES
     platform/graphics/filters/SourceAlpha.cpp
     platform/graphics/filters/SourceGraphic.cpp
 
-    platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp
     platform/graphics/filters/arm/FECompositeArithmeticNEON.h
     platform/graphics/filters/arm/FEGaussianBlurNEON.cpp
     platform/graphics/filters/arm/FEGaussianBlurNEON.h
@@ -2451,6 +2450,7 @@ IF (ENABLE_WEB_AUDIO)
         Modules/webaudio/AudioParamTimeline.cpp
         Modules/webaudio/AudioProcessingEvent.cpp
         Modules/webaudio/AudioScheduledSourceNode.cpp
+        Modules/webaudio/AudioSummingJunction.cpp
         Modules/webaudio/BiquadDSPKernel.cpp
         Modules/webaudio/BiquadFilterNode.cpp
         Modules/webaudio/BiquadProcessor.cpp
@@ -2507,6 +2507,20 @@ IF (ENABLE_WEB_AUDIO)
     )
 ENDIF ()
 
+IF (ENABLE_WEB_INTENTS)
+    LIST(APPEND WebCore_IDL_FILES
+        Modules/intents/DOMWindowIntents.idl
+        Modules/intents/Intent.idl
+        Modules/intents/IntentResultCallback.idl
+        Modules/intents/NavigatorIntents.idl
+    )
+    LIST(APPEND WebCore_SOURCES
+       Modules/intents/Intent.cpp
+       Modules/intents/IntentRequest.cpp
+       Modules/intents/NavigatorIntents.cpp
+    )
+ENDIF ()
+
 # Modules that the bindings generator scripts may use
 SET(SCRIPTS_RESOLVE_SUPPLEMENTAL
     ${WEBCORE_DIR}/bindings/scripts/IDLParser.pm
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index b80e79b9e..8378fd993 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,9256 @@
+2012-05-18  MORITA Hajime <morrita@google.com>
+
+        Unreviewed attempt to fix build breakage on r117572
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::willDetachPage):
+
+2012-05-18  MORITA Hajime  <morrita@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=85515
+        Stale frame in WebCore::SpellChecker::didCheckSucceeded
+
+        Reviewed by Ryosuke Niwa.
+
+        Added EditorClient::frameWillDetachPage() notification to give a
+        change to invalidate pending spellcheck requests on the client.
+
+        Test: editing/spelling/spellcheck-async-remove-frame.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::Editor):
+        * editing/Editor.h:
+        (Editor):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::frameWillDetachPage):
+        * page/EditorClient.h:
+        (EditorClient):
+
+2012-05-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add ContentProvider::contentType and use it when rendering navigator tree.
+        https://bugs.webkit.org/show_bug.cgi?id=86833
+
+        Reviewed by Vsevolod Vlasov.
+
+        Added ContentProvider::contentType, regactored NavigatorView to use the icon defined by the content type.
+
+        * inspector/front-end/CompilerScriptMapping.js:
+        * inspector/front-end/ContentProvider.js:
+        (WebInspector.ContentProvider.prototype.contentType):
+        * inspector/front-end/ContentProviders.js:
+        (WebInspector.ConcatenatedScriptsContentProvider.prototype.contentType):
+        (WebInspector.CompilerSourceMappingContentProvider):
+        (WebInspector.CompilerSourceMappingContentProvider.prototype.contentType):
+        (WebInspector.CompilerSourceMappingContentProvider.prototype.requestContent):
+        (WebInspector.StaticContentProvider):
+        (WebInspector.StaticContentProvider.prototype.contentType):
+        (WebInspector.StaticContentProvider.prototype.requestContent):
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorTreeOutline.prototype.scriptTreeElements):
+        (WebInspector.NavigatorSourceTreeElement):
+        * inspector/front-end/NetworkRequest.js:
+        (WebInspector.NetworkRequest.prototype.contentType):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.contentType):
+        (WebInspector.Resource.prototype.canonicalMimeType):
+        (WebInspector.ResourceRevision.prototype.contentType):
+        * inspector/front-end/ResourceType.js:
+        (WebInspector.ResourceType.prototype.toString):
+        (WebInspector.ResourceType.prototype.canonicalMimeType):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.contentType):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.SnippetContentProvider):
+        * inspector/front-end/StylesPanel.js:
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype.contentType):
+        * inspector/front-end/navigatorView.css:
+        (.navigator-stylesheet-tree-item .icon):
+        (.navigator-document-tree-item .icon):
+
+2012-05-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r117556.
+        http://trac.webkit.org/changeset/117556
+        https://bugs.webkit.org/show_bug.cgi?id=86825
+
+        Wrong fix. IE still adds 1px padding. We're missing that in
+        textarea (Requested by rniwa on #webkit).
+
+        * css/html.css:
+        (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+
+2012-05-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: remove File abstraction from the AdvancedSearchController, migrate it to UISourceCode.
+        https://bugs.webkit.org/show_bug.cgi?id=86809
+
+        Reviewed by Yury Semikhatsky.
+
+        This change migrates AdvancedSearchController from "Object" to "UISourceCode".
+        I don't see why we need this abstraction and as a side effect, it makes search
+        across scripts work for styles.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchResult):
+        (WebInspector.FileBasedSearchResultsPane.prototype._createAnchor):
+        (WebInspector.FileBasedSearchResultsPane.prototype.addSearchResult):
+        (WebInspector.FileBasedSearchResultsPane.prototype._appendSearchMatches):
+        (WebInspector.FileBasedSearchResultsPane.prototype._regexMatchRanges):
+        (WebInspector.FileBasedSearchResultsPane.SearchResult):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchScope.prototype.createSearchResultsPane):
+        * inspector/front-end/inspector.js:
+        (WebInspector._registerShortcuts):
+
+2012-05-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add an option to show last N hidden children of node in heap profiler
+        https://bugs.webkit.org/show_bug.cgi?id=86757
+
+        Reviewed by Pavel Feldman.
+
+        Renamed "Show next N" to "Show N before" and added "Show N after" button. Also
+        when all 3 buttons would have equal effect there is now only "Show all N" button.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ShowMoreDataGridNode.js:
+        (WebInspector.ShowMoreDataGridNode):
+        (WebInspector.ShowMoreDataGridNode.prototype._showLastChunk):
+        (WebInspector.ShowMoreDataGridNode.prototype._updateLabels):
+        (WebInspector.ShowMoreDataGridNode.prototype.createCells):
+
+2012-05-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        WebKit erroneously add 1px padding in input elements
+        https://bugs.webkit.org/show_bug.cgi?id=86784
+
+        Reviewed by Kent Tamura.
+
+        Fixed the bug by removing the code that added left and right paddings in input elements.
+        The code was added in r13567 to match a very old version of Internet Explorer but this quirk
+        does not seem to exists in IE9 (both in quirks and standard modes).
+
+        A lot of tests need to be rebaselined due to 1px difference inside input elements, and 2px
+        differences for the width of input elements. (In some extreme cases, line breaking changed
+        due to the width change).
+
+        Test: fast/forms/input-textarea-padding-match.html
+
+        * css/html.css:
+        (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+
+2012-05-18  Zalan Bujtas  <zbujtas@gmail.com>
+
+        [Qt] Gesture tap highlighter needs to take overflow clip into account.
+        https://bugs.webkit.org/show_bug.cgi?id=84989
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Apply overflow clip on the focus ring if needed.
+
+        Follow up patches are needed to address the following cases.
+
+        [Qt] Gesture tap highlighter should take parent iframe's transform into account.
+        https://bugs.webkit.org/show_bug.cgi?id=86645
+
+        [Qt] Gesture tap highlighter needs to take frame clipping into account.
+        https://bugs.webkit.org/show_bug.cgi?id=86646
+
+        [Qt] Gesture tap highlighter's overflow clip is not always correct when
+        nested enclosing containers have transforms.
+        https://bugs.webkit.org/show_bug.cgi?id=86641
+
+        Manual test: ManualTests/qt/tap-highlighting-overflow-hidden.html
+
+        * page/GestureTapHighlighter.cpp:
+        (WebCore::GestureTapHighlighter::pathForNodeHighlight):
+
+2012-05-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] KURL::fileSystemPath() should strip the query of the uri
+        https://bugs.webkit.org/show_bug.cgi?id=86721
+
+        Reviewed by Martin Robinson.
+
+        * platform/gtk/KURLGtk.cpp:
+        (WebCore::KURL::fileSystemPath): Use the already parsed path to
+        create the GFile instead of the whole URL string. The parsed path
+        doesn't include neither the fragment (#) nor the query (?) parts.
+
+2012-05-17  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Refactoring] Remove V8Proxy::deletionNotHandledByInterceptor()
+        https://bugs.webkit.org/show_bug.cgi?id=86803
+
+        Reviewed by Dimitri Glazkov.
+
+        V8Proxy::deletionNotHandledByInterceptor() is used by V8StorageCustom.cpp
+        only, just in order to return v8::Handle<v8::Boolean>(). In such cases,
+        other custom bindings are hard-coding 'return v8::Handle<v8::Boolean>()'.
+        Thus we can hard-code 'return v8::Handle<v8::Boolean>()' in V8StorageCustom.cpp
+        too, and remove V8Proxy::deletionNotHandledByInterceptor().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::storageDeleter):
+
+2012-05-17  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: speed-up markQueriableHeapObjects function.
+        https://bugs.webkit.org/show_bug.cgi?id=86732
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshot.prototype._flagsOfNode):
+        (WebInspector.HeapSnapshot.prototype._markDetachedDOMTreeNodes):
+        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):
+        (WebInspector.HeapSnapshot.prototype._calculateFlags):
+
+2012-05-15  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Some Spelling Mistakes Result in Compile Errors with ENABLE(FILE_SYSTEM) in LocalFileSystem.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=86103
+
+        Reviewed by Rob Buis.
+
+        Added build fixes and some (limited) common implementation for non-chromium ports.
+
+        No new tests as this should have no functionality changes.
+
+        * Modules/filesystem/DOMFileSystemBase.cpp:
+        (WebCore::DOMFileSystemBase::isValidType): Added common implementation for non-chromium ports.
+        (WebCore::DOMFileSystemBase::crackFileSystemURL): Ditto.
+        (WebCore::DOMFileSystemBase::supportsToURL): Ditto.
+        (WebCore::DOMFileSystemBase::createFileSystemURL): Ditto.
+        * Modules/filesystem/LocalFileSystem.cpp:
+        (WebCore::LocalFileSystem::readFileSystem): Fixed.
+        (WebCore::LocalFileSystem::requestFileSystem): Fixed.
+        * platform/blackberry/AsyncFileSystemBlackBerry.cpp:
+        (WebCore::AsyncFileSystem::openFileSystem): Fixed.
+        * platform/gtk/AsyncFileSystemGtk.cpp:
+        (WebCore::AsyncFileSystem::openFileSystem): Fixed.
+
+2012-05-17  Wei James  <james.wei@intel.com>
+
+        AudioBufferSourceNode and MediaElementAudioSourceNode should support multi-channel > stereo
+        https://bugs.webkit.org/show_bug.cgi?id=75119
+
+        Reviewed by Chris Rogers.
+
+        As multiple channel support in AudioBus and other places is already
+        implemented, the check can be removed here.  
+
+        * Modules/webaudio/MediaElementAudioSourceNode.cpp:
+        (WebCore::MediaElementAudioSourceNode::setFormat):
+
+2012-05-17  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11419933> Problems with flipped writing modes and compositing
+        https://bugs.webkit.org/show_bug.cgi?id=86032
+
+        Reviewed by Anders Carlsson.
+
+        Test: compositing/bounds-in-flipped-writing-mode.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateLayerBounds): Apply a writing-mode flip to the bounding box
+        if needed.
+
+2012-05-17  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Refactoring] Remove V8Proxy::throwError(const char*, v8::Isolate* = 0)
+        https://bugs.webkit.org/show_bug.cgi?id=86794
+
+        Reviewed by Adam Barth.
+
+        As commented here (https://bugs.webkit.org/show_bug.cgi?id=84074#c5),
+        I am refactoring a series of confusing throwError()s.
+        This patch removes V8Proxy::throwError(const char*, v8::Isolate* = 0).
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::extractTransferables):
+        (WebCore::getMessagePortArray):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore::constructWebGLArrayWithArrayBufferArgument):
+        (WebCore::constructWebGLArray):
+        * bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp:
+        (WebCore::V8AudioBufferSourceNode::bufferAccessorSetter):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::V8Clipboard::setDragImageCallback):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::openCallback):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::V8HTMLInputElement::selectionStartAccessorGetter):
+        (WebCore::V8HTMLInputElement::selectionStartAccessorSetter):
+        (WebCore::V8HTMLInputElement::selectionEndAccessorGetter):
+        (WebCore::V8HTMLInputElement::selectionEndAccessorSetter):
+        (WebCore::V8HTMLInputElement::selectionDirectionAccessorGetter):
+        (WebCore::V8HTMLInputElement::selectionDirectionAccessorSetter):
+        (WebCore::V8HTMLInputElement::setSelectionRangeCallback):
+        * bindings/v8/custom/V8HTMLMediaElementCustom.cpp:
+        (WebCore::V8HTMLMediaElement::controllerAccessorSetter):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectedObjectCallback):
+
+2012-05-17  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Scale all compositor output by the defaultDeviceScaleFactor
+        https://bugs.webkit.org/show_bug.cgi?id=86051
+
+        Reviewed by James Robinson.
+
+        On initialization, give the defaultDeviceScaleFactor to the compositor
+        to have it scale all output from WebCore's layout size to physical
+        pixels. This allows us to scale up to high-dpi devices without using
+        fixed-layout, so we can leave the WebCore frame size in layout pixels,
+        while drawing the frame into a larger physical pixel size.
+
+        CCLayerTreeHost becomes aware of the deviceScaleFactor and scales all
+        output by this factor by scaling the viewport and all drawing
+        transforms.
+
+        Anything that works in physical pixels (content space), uses the
+        deviceViewportSize() in place of the viewportSize(), since when
+        deviceScaleFactor != 1 in CCLayerTreeHost, the WebCore viewport
+        is no longer physical pixels.
+
+        Scroll positions are in layout pixels, and must be scaled to/from
+        content space within the compositor.
+
+        Unit tests: CCLayerTreeHostTestDeviceScaleFactorScalesViewportAndLayers
+
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromiumClient):
+        (WebCore::LayerRendererChromium::viewportSize):
+        (WebCore::LayerRendererChromium::viewportWidth):
+        (WebCore::LayerRendererChromium::viewportHeight):
+        (LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::setViewportSize):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCSettings::CCSettings):
+        (CCSettings):
+        (CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::deviceViewportSize):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::setViewportSize):
+        (WebCore::CCLayerTreeHostImpl::updateMaxScrollPosition):
+        (WebCore::CCLayerTreeHostImpl::scrollBegin):
+        (WebCore::CCLayerTreeHostImpl::computePinchZoomDeltas):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore::CCLayerTreeHostImpl::viewportSize):
+        (CCLayerTreeHostImpl):
+
+2012-05-17  Hayato Ito  <hayato@chromium.org>
+
+        [Shadow DOM] Add an assertion to make sure a visited node is not an active insertion point.
+        https://bugs.webkit.org/show_bug.cgi?id=86708
+
+        Reviewed by Eric Seidel.
+
+        Since InsertionPoint now has isActive() member function,
+        we can add an assertion to ComposedShadowTreeWalker::assertPrecondition()
+        using that function.
+
+        No new tests, no change in behavior.
+
+        * dom/ComposedShadowTreeWalker.h:
+        (WebCore::ComposedShadowTreeWalker::assertPrecondition):
+
+2012-05-17  Ami Fischman  <fischman@chromium.org>
+
+        [Chromium] Store HTTP version in WebURLResponse
+        https://bugs.webkit.org/show_bug.cgi?id=86522
+
+        Reviewed by Adam Barth.
+
+        No new tests; this isn't exposed to the web platform.
+
+        * platform/chromium/support/WebURLResponse.cpp:
+        (WebKit::WebURLResponse::httpVersion):
+        (WebKit):
+        (WebKit::WebURLResponse::setHTTPVersion):
+        * platform/network/chromium/ResourceResponse.h:
+        (ResourceResponse):
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::httpVersion):
+        (WebCore::ResourceResponse::setHTTPVersion):
+
+2012-05-17  Levi Weintraub  <leviw@chromium.org>
+
+        Floor y coordinate in Chromium's GraphicsContext::drawLineForText to avoid anti-aliasing
+        https://bugs.webkit.org/show_bug.cgi?id=86775
+
+        Reviewed by Eric Seidel.
+
+        Despite operating in floats, we always want to draw lines for text aligned to pixel boundaries.
+        There are similar functions to do this in other platforms, but to get proper results, we only
+        need to floor the y value, as we always draw these lines horizontally.
+
+        No tests. No change in behavior prior to sub-pixel change.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+
+2012-05-17  Michael Moss  <mmoss@chromium.org>
+
+        Linux amd64 platform reported as i686
+        https://bugs.webkit.org/show_bug.cgi?id=86778
+        http://code.google.com/p/chromium/issues/detail?id=128167
+
+        Remove the old hard-coded gyp define and allow the more recent (but
+        still quite old) code in Source/WebCore/page/NavigatorBase.cpp to take
+        precedence and detect this at runtime.
+
+        Reviewed by Tony Chang.
+
+        No new tests because it's hardware dependent.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-05-17  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        [chromium] Expose layer tiling size options to WebSettings.
+        https://bugs.webkit.org/show_bug.cgi?id=86425
+
+        Removing hardcoded tile size and max untiled layer size from TiledLayerChromium
+        and instead have the values passed in via the LTH CCSettings. This will allow
+        different compositor instances to adjust tiling parameters as needed and makes
+        it possible to set the values via command line arguments.
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::TiledLayerChromium):
+        (WebCore::TiledLayerChromium::updateTileSizeAndTilingOption):
+        Made some additional adjustments to the single-tile heuristic
+        to make it work better with arbitrary sizes while still avoiding
+        to create unreasonably large layers.
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCSettings::CCSettings):
+        (CCSettings):
+
+2012-05-17  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        Memory leak in NetworkInfoClient
+        https://bugs.webkit.org/show_bug.cgi?id=86603
+
+        Reviewed by Adam Barth.
+
+        Fix a memory leak in NetworkInfoClient by using OwnPtr and
+        change the class not to inherite from RefCounted.
+
+        * Modules/networkinfo/NetworkInfoClient.h:
+
+2012-05-17  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove IDBIndex.storeName
+        https://bugs.webkit.org/show_bug.cgi?id=86676
+
+        Reviewed by Tony Chang.
+
+        Older versions of the IDB spec exposed IDBIndex.storeName. While it's been removed
+        from the IDL, the additional storage/plumbing are unnecessary clutter. Nuke it!
+
+        No new tests - no functional changes.
+
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::IDBIndexBackendImpl): Remove storeName parameter, and
+        const declaration on object store param. The former was used to get a non-const pointer
+        via indirection in openCursorInternal.
+        (WebCore::IDBIndexBackendImpl::openCursorInternal): Use store pointer directly, don't
+        look it up by name in the transaction.
+        * Modules/indexeddb/IDBIndexBackendImpl.h:
+        (WebCore::IDBIndexBackendImpl::create): Remove storeName parameters.
+        (IDBIndexBackendImpl): Remove storeName() method.
+        * Modules/indexeddb/IDBIndexBackendInterface.h:
+        (IDBIndexBackendInterface): Remove storeName parameter.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::createIndex): Remove storeName parameter.
+        (WebCore::IDBObjectStoreBackendImpl::loadIndexes): Remove storeName parameter.
+
+2012-05-17  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Implement IDBObjectStore.autoIncrement
+        https://bugs.webkit.org/show_bug.cgi?id=86662
+
+        Reviewed by Dimitri Glazkov.
+
+        Simple boolean accessor defined in the IDB spec, which reflects the
+        object store's internal autoIncrement flag.
+
+        Test: storage/indexeddb/objectstore-basics.html
+
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::autoIncrement): Forward call to back end.
+        (WebCore):
+        * Modules/indexeddb/IDBObjectStore.h: Expose attribute as method.
+        (IDBObjectStore):
+        * Modules/indexeddb/IDBObjectStore.idl: Define the attribute.
+        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Expose in interface.
+        (IDBObjectStoreBackendInterface):
+
+2012-05-17  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Refactoring] Remove throwError("message", XXXError) from CodeGeneratorV8.pm
+        https://bugs.webkit.org/show_bug.cgi?id=86744
+
+        Reviewed by Adam Barth.
+
+        As commented in https://bugs.webkit.org/show_bug.cgi?id=84074#c5,
+        I am refactoring a series of confusing throwError()s.
+
+        This patch removes throwError("message", XXXError) in CodeGeneratorV8.pm
+        and replaces it with throwTypeError("message") or throwError(XXXError, "message").
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateParametersCheck):
+        (GenerateConstructorCallback):
+        (GenerateEventConstructorCallback):
+        (GenerateNamedConstructorCallback):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::constructorCallback):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::constructorCallback):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructorCallback):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::constructorCallback):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::optionsObjectCallback):
+        (WebCore::V8TestObj::constructorCallback):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::acceptTransferListCallback):
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::multiTransferListCallback):
+        (WebCore::V8TestSerializedScriptValueInterface::constructorCallback):
+
+2012-05-17  Gregg Tavares  <gman@google.com>
+
+        Add more descriptive warnings for framebuffer incomplete conditions
+        https://bugs.webkit.org/show_bug.cgi?id=86774
+
+        Reviewed by Kenneth Russell.
+
+        No new tests as there is no new functionality
+
+        * html/canvas/WebGLFramebuffer.cpp:
+        (WebCore::WebGLFramebuffer::checkStatus):
+        (WebCore::WebGLFramebuffer::onAccess):
+        (WebCore::WebGLFramebuffer::initializeRenderbuffers):
+        * html/canvas/WebGLFramebuffer.h:
+        (WebGLFramebuffer):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::checkFramebufferStatus):
+        (WebCore::WebGLRenderingContext::clear):
+        (WebCore::WebGLRenderingContext::copyTexImage2D):
+        (WebCore::WebGLRenderingContext::copyTexSubImage2D):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::readPixels):
+        (WebCore::WebGLRenderingContext::printGLWarningToConsole):
+        * html/canvas/WebGLRenderingContext.h:
+
+2012-05-17  Oliver Hunt  <oliver@apple.com>
+
+        Endeavour to make the windows test bot actually able to run tests.
+        https://bugs.webkit.org/show_bug.cgi?id=86772
+
+        Reviewed by Sam Weinig.
+
+        Use WEBKIT_EXPORT to get correct export behaviour on windows, rather than
+        relying on the .def files.
+
+        * bindings/js/JSDOMGlobalObject.h:
+        (JSDOMGlobalObject):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+
+2012-05-17  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=86266
+        r112643/r116697 break Webview form input fields
+        -and corresponding-
+        <rdar://problem/11400430>
+
+        Reviewed by Dan Bernstein.
+
+        There is a recent history of changes in this are that seem worth documenting. 
+        First was the change to switch to using NSTextFieldCell to draw text fields: 
+        http://trac.webkit.org/changeset/104240
+
+        That led to problems because of the clear background that I thought at the time 
+        were specific to MountainLion. To fix that, I made this change:
+        http://trac.webkit.org/changeset/110480
+
+        But that change resulted in styled text fields getting an un-themed border, which 
+        led to this change on the branch: http://trac.webkit.org/changeset/112643 and a 
+        change on TOT that was identical for Lion and SnowLeopard but introduced new 
+        behavior for MountainLion: http://trac.webkit.org/changeset/116697
+
+        And that brings us to this bug, where it turns out the clear background is a 
+        problem on Lion and SnowLeopard too. This patch fixes the bug by using the 
+        original WebCoreSystemInterface function to paint all text fields on Lion and 
+        SnowLeopard that are styled. This is what we used to paint all text fields before 
+        r104240, which is the first change listed above. Un-styled text fields will still 
+        use NSTextFieldCell on these platforms, but with a hardcoded white background. 
+        * rendering/RenderThemeMac.h:
+        (RenderThemeMac):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintTextField):
+        (WebCore::RenderThemeMac::textField):
+
+2012-05-15  Andreas Kling  <kling@webkit.org>
+
+        IconDatabase: Move icon retain/release off of the main thread.
+        <http://webkit.org/b/85799>
+        <rdar://problem/9507113>
+
+        Reviewed by Brady Eidson.
+
+        Batch up the retain/release operations and execute them as part of the sync thread loop.
+        The batch execution is guarded by a new mutex (m_urlsToRetainOrReleaseLock.)
+        This avoids blocking the main thread on m_urlAndIconLock for basic retain/release.
+
+        There is one exception; if there are pending retain/release operations in synchronousIconForPageURL,
+        it will acquire the lock and flush the operations.
+
+        There should be no behavior change, this is only meant to reduce lock contention.
+
+        * loader/icon/PageURLRecord.h:
+        (WebCore::PageURLRecord::retain):
+        (WebCore::PageURLRecord::release):
+
+            Added a 'count' argument to these so we can batch up the operations in IconDatabase.
+
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::performScheduleOrDeferSyncTimer):
+        (WebCore::IconDatabase::performScheduleOrDeferSyncTimerOnMainThread):
+        (WebCore::IconDatabase::scheduleOrDeferSyncTimer):
+
+            Perform the the timer scheduling on the main thread as it can be done on a different
+            thread by way of retainIconForPageURL or releaseIconForPageURL.
+
+        (WebCore::IconDatabase::synchronousIconForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::performRetainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::performReleaseIconForPageURL):
+        (WebCore::IconDatabase::retainedPageURLCount):
+        (WebCore::IconDatabase::IconDatabase):
+        (WebCore::IconDatabase::performURLImport):
+        (WebCore::IconDatabase::syncThreadMainLoop):
+        (WebCore::IconDatabase::performPendingRetainAndReleaseOperations):
+
+2012-05-17  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Kill RenderLayer::relativePositionOffset(LayoutUnit& relX, LayoutUnit& relY) and cleanup RenderInline::clippedOverflowRectForRepaint
+        https://bugs.webkit.org/show_bug.cgi?id=86551
+
+        Reviewed by Abhishek Arya.
+
+        No test since there is no expected change in behavior.
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        Changed the function to use LayoutRect arithmetics instead of calculating
+        top / left manually. While at it, improved the naming, removed some local
+        variables and removed an unneeded style() NULL-check.
+
+        * rendering/RenderLayer.h: Removed the function.
+
+2012-05-17  Rob Buis  <rwlbuis@webkit.org>
+
+        [BlackBerry] Fix linking errors
+        https://bugs.webkit.org/show_bug.cgi?id=86768
+
+        Reviewed by Antonio Gomes.
+
+        Add some missing stubs so we can link again.
+
+        * platform/blackberry/ContextMenuBlackBerry.cpp:
+        (WebCore::ContextMenu::itemCount):
+        (WebCore):
+        * platform/blackberry/PlatformScreenBlackBerry.cpp:
+        (WebCore::screenHorizontalDPI):
+        (WebCore):
+        (WebCore::screenVerticalDPI):
+
+2012-05-17  Emil A Eklund  <eae@chromium.org>
+
+        Fix rounding in paintSelection
+        https://bugs.webkit.org/show_bug.cgi?id=86693
+
+        Reviewed by Eric Seidel.
+
+        Break out rounding logic from InlineTextBox::paintSelection into separate
+        function and use it for all the EllipsisBox paintSelection implementation
+        and selection gap calculation. This ensures that selections are painted
+        without gaps and overlaps once we turn on subpixel layout.
+
+        No new tests, covered by existing tests in editing/selection and
+        editing/style.
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paintSelection):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::alignSelectionRectToDevicePixels):
+        (WebCore):
+        (WebCore::InlineTextBox::paintSelection):
+        * rendering/InlineTextBox.h:
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::logicalLeftSelectionGap):
+        (WebCore::RenderBlock::logicalRightSelectionGap):
+
+2012-05-17  Michal Mocny  <mmocny@google.com>
+
+        [chromium] Limiting render surface texture manager memory to 0 when contentsMemoryUseBytes is large.
+        https://bugs.webkit.org/show_bug.cgi?id=86764
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::beginDrawingFrame):
+
+2012-05-17  Dan Bernstein  <mitz@apple.com>
+
+        In vertical writing modes, pagination may split a line after a block shifts
+        https://bugs.webkit.org/show_bug.cgi?id=86763
+
+        Reviewed by Sam Weinig.
+
+        Test: fast/multicol/pageLogicalOffset-vertical.html
+
+        LayoutState::pageLogicalOffset() was returning bogus results in vertical writing modes,
+        because it was always using physical heights. Changed it to take a RenderBox and use its
+        writing mode to choose between heights and widths.
+
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::pageLogicalOffset):
+        (WebCore::LayoutState::addForcedColumnBreak):
+        * rendering/LayoutState.h:
+        (LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::markForPaginationRelayoutIfNeeded):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::RenderBlock::applyBeforeBreak):
+        (WebCore::RenderBlock::applyAfterBreak):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+
+2012-05-17  Abhishek Arya  <inferno@chromium.org>
+
+        Move run-in handling to addChild, instead of in layout.
+        https://bugs.webkit.org/show_bug.cgi?id=86387
+
+        Reviewed by Julien Chaffraix.
+
+        Tests: fast/runin/insert-before-run-in.html
+               fast/runin/run-in-after-run-in.html
+               fast/runin/run-in-parent-add-child.html
+               fast/runin/run-in-parent-block-child-add-and-intrude.html
+               fast/runin/run-in-parent-block-child-add.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): handle run-ins here
+        instead of layout. We do run-in handling when we see a new child with run-in display
+        or add a new block whose previous sibling is run-in.
+        (WebCore::RenderBlock::makeChildrenNonInline): if we will have block children, need
+        to move run-in back to its original position.
+        (WebCore::RenderBlock::handleSpecialChild): no longer need to handle run-ins during layout.
+        (WebCore::destroyRunIn): helper to destroy a block or inline run-in.
+        (WebCore):
+        (WebCore::RenderBlock::createReplacementRunIn): helper to create the new replacement run-in.
+        For moveRunInUnderSiblingBlockIfNeeded, it will be used to create a new inline run-in
+        that goes into the next sibling block. For moveRunInToOriginalPosition, it creates a new
+        block run-in that goes back to where it came from.
+        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded): almost same as previous
+        handleRunInChild function, but with the return type removed. Also, we don't allow
+        a run-in to intrude into a block that already has a run-in.
+        (WebCore::RenderBlock::moveRunInToOriginalPosition): moves run-in back to where it came from.
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderBoxModelObject.cpp: move all moveChild* functions from RenderBox, since
+        they can now be used to move children of inlines.
+        (WebCore::RenderBoxModelObject::moveChildTo): same.
+        (WebCore):
+        (WebCore::RenderBoxModelObject::moveChildrenTo): same.
+        * rendering/RenderBoxModelObject.h:
+        (RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::moveChildTo): same.
+        (WebCore::RenderBoxModelObject::moveAllChildrenTo): same.
+        (WebCore::RenderBoxModelObject::moveChildrenTo): same.
+
+2012-05-17  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Support Copy ... actions for the Web Inspector remote debugging mode.
+        https://bugs.webkit.org/show_bug.cgi?id=86621
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.documentCopy):
+        (.WebInspector.InspectorFrontendHostStub.prototype.copyText):
+        (.WebInspector.clipboardAccessDeniedMessage):
+        (.WebInspector.ClipboardAccessDeniedScreen):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentCopy):
+        (WebInspector.documentCopyEventFired):
+
+2012-05-02  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: table-height-algorithm-023 and -024 fail
+        https://bugs.webkit.org/show_bug.cgi?id=85405
+
+        Reviewed by Eric Seidel.
+
+        Treat vertical-align: [length] the same as vertical-align: baseline.
+
+        Tests: css2.1/20110323/table-height-algorithm-023.htm
+               css2.1/20110323/table-height-algorithm-024.htm
+               fast/table/mozilla-bug10296-vertical-align-1.html
+               fast/table/mozilla-bug10296-vertical-align-2.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        (WebCore::RenderTableSection::layoutRows):
+
+2012-05-17  Emil A Eklund  <eae@chromium.org>
+
+        Fix rounding in RenderFlowThread::paintIntoRegion
+        https://bugs.webkit.org/show_bug.cgi?id=86695
+
+        Reviewed by Eric Seidel.
+
+        Fix rounding of offset in paintIntoRegion to ensure that we paint on
+        device pixel boundaries.
+
+        Covered by existing tests in fast/regions.
+
+        * platform/graphics/FractionalLayoutPoint.h:
+        (WebCore::roundedIntPoint):
+        Add roundedIntPoint(FractionalLayoutSize) function.
+        (WebCore):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintIntoRegion):
+
+2012-05-17  Andreas Kling  <kling@webkit.org>
+
+        Parser: Avoid unnecessary ref count churn in token constructors.
+        <http://webkit.org/b/86667>
+
+        Reviewed by Antti Koivisto.
+
+        Pass AtomicString by const reference to avoid useless ref count churn
+        in AtomicHTMLToken() and AtomicXMLToken().
+
+        * html/parser/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
+        * xml/parser/MarkupTokenBase.h:
+        (WebCore::AtomicMarkupTokenBase::AtomicMarkupTokenBase):
+        * xml/parser/XMLToken.h:
+        (WebCore::AtomicXMLToken::AtomicXMLToken):
+
+2012-05-16  Andreas Kling  <kling@webkit.org>
+
+        Make PluginInfoStore properly thread-safe.
+        <http://webkit.org/b/86648>
+        <rdar://problem/11451178>
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginData.h:
+        (WebCore::MimeClassInfo::isolatedCopy):
+        (WebCore::PluginInfo::isolatedCopy):
+
+2012-05-17  Hironori Bono  <hbono@chromium.org>
+
+        [Refactoring] Move platform-specific code in Editor::respondToChangedSelection to the WebKit layer
+        https://bugs.webkit.org/show_bug.cgi?id=86591
+
+        Reviewed by Ryosuke Niwa.
+
+        This change adds a TextCheckerClient::shouldEraseMarkersAfterChangeSelection
+        function to remove platform-specific code from Editor::respondToChangedSelection
+        function.
+
+        No new tests, no change in behavior.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedSelection):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyTextCheckerClient::shouldEraseMarkersAfterChangeSelection):
+        * platform/text/TextCheckerClient.h:
+        (TextCheckerClient):
+
+2012-05-11  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Convert GraphicsLayerChromium to use WebLayer types
+        https://bugs.webkit.org/show_bug.cgi?id=86269
+
+        Reviewed by Adrienne Walker.
+
+        This converts GraphicsLayerChromium over to use WebLayer and WebContentLayer. The conversion is not completely
+        as the Web*Layer APIs are not yet quite complete enough to use everywhere, and the PlatformLayer typedef is not
+        changed in this patch. The places where we have to punch out through API layer are marked by
+        unwrap<*LayerChromium>() calls and FIXME's in the Web*Layer.h files.  There aren't many.
+
+        Refactor only, existing tests apply.
+
+        * platform/chromium/support/WebTransformationMatrix.cpp:
+        (WebKit):
+        (WebKit::WebTransformationMatrix::reset):
+        (WebKit::WebTransformationMatrix::projectPoint):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::willBeDestroyed):
+        (WebCore::GraphicsLayerChromium::setName):
+        (WebCore::GraphicsLayerChromium::updateNames):
+        (WebCore::GraphicsLayerChromium::removeFromParent):
+        (WebCore::GraphicsLayerChromium::setSize):
+        (WebCore::GraphicsLayerChromium::setTransform):
+        (WebCore::GraphicsLayerChromium::setBackgroundColor):
+        (WebCore::GraphicsLayerChromium::clearBackgroundColor):
+        (WebCore::GraphicsLayerChromium::setContentsOpaque):
+        (WebCore::GraphicsLayerChromium::setFilters):
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        (WebCore::GraphicsLayerChromium::setBackfaceVisibility):
+        (WebCore::GraphicsLayerChromium::setOpacity):
+        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
+        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerChromium::setNeedsDisplay):
+        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerChromium::setContentsToImage):
+        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
+        (WebCore::GraphicsLayerChromium::addAnimation):
+        (WebCore::GraphicsLayerChromium::pauseAnimation):
+        (WebCore::GraphicsLayerChromium::removeAnimation):
+        (WebCore::GraphicsLayerChromium::suspendAnimations):
+        (WebCore::GraphicsLayerChromium::resumeAnimations):
+        (WebCore::GraphicsLayerChromium::setContentsToMedia):
+        (WebCore::GraphicsLayerChromium::hostLayerForChildren):
+        (WebCore::GraphicsLayerChromium::layerForParent):
+        (WebCore::GraphicsLayerChromium::platformLayer):
+        (WebCore::GraphicsLayerChromium::setDebugBackgroundColor):
+        (WebCore::GraphicsLayerChromium::setDebugBorder):
+        (WebCore::GraphicsLayerChromium::updateChildList):
+        (WebCore::GraphicsLayerChromium::updateLayerPosition):
+        (WebCore::GraphicsLayerChromium::updateLayerSize):
+        (WebCore::GraphicsLayerChromium::updateAnchorPoint):
+        (WebCore::GraphicsLayerChromium::updateTransform):
+        (WebCore::GraphicsLayerChromium::updateChildrenTransform):
+        (WebCore::GraphicsLayerChromium::updateMasksToBounds):
+        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable):
+        (WebCore::GraphicsLayerChromium::updateLayerBackgroundColor):
+        (WebCore::GraphicsLayerChromium::updateContentsRect):
+        (WebCore::GraphicsLayerChromium::updateContentsScale):
+        (WebCore::GraphicsLayerChromium::setupContentsLayer):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (WebCore::GraphicsLayerChromium::hasContentsLayer):
+        (WebCore::GraphicsLayerChromium::contentsLayer):
+        (WebCore::GraphicsLayerChromium::primaryLayer):
+        (GraphicsLayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+
+2012-05-17  Tony Chang  <tony@chromium.org>
+
+        remove bit rotted comment about css properties
+        https://bugs.webkit.org/show_bug.cgi?id=86750
+
+        Reviewed by Alexis Menard.
+
+        It's not clear to me what the first block was even referring to.
+        Aural doesn't seem to exist anymore. It might be worth keeping,
+        "All the CSS properties are not supported by the renderer at the
+        moment.", but it seems obvious to me.
+
+        No new tests, just removing a comment.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2012-05-17  Adrienne Walker  <enne@google.com>
+
+        Insert source file and line number for v8 function calls into tracing
+        https://bugs.webkit.org/show_bug.cgi?id=84613
+
+        Reviewed by Kentaro Hara.
+
+        The trace for v8 function calls doesn't include any information about
+        what function is being called. Pass this information along so it can
+        be less opaque.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::resourceInfo):
+        (WebCore):
+        (WebCore::resourceString):
+        (WebCore::V8Proxy::instrumentedCallFunction):
+        * platform/chromium/TraceEvent.h:
+        (WebCore::TraceEvent::TraceStringWithCopy::TraceStringWithCopy):
+
+2012-05-17  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] REGRESSION(101967): It made editing/style/iframe-onload-crash-mac.html timeout
+        https://bugs.webkit.org/show_bug.cgi?id=73802
+
+        Reviewed by Ryosuke Niwa.
+
+        Timeout was caused by an infinite in the outer loop of
+        pushDownInlineStyleAroundNode(). The outer loop variable 'current' should point at the
+        node containing 'targetNode'. The inner loop traverse the children of 'current'
+        and discover the children that contains 'targetNode'.
+
+        However, before the inner loop, we call removeInlineStyleFromElement() that can
+        potentially remove the 'current' node from the tree, moving its children to
+        'current' former parent. For that reason 'child' and 'lastChild' are collected
+        before this call.
+
+        The tricky part is that changing the 'current' children parent, we might trigger
+        further side-effects, that can remove either 'child' or 'lastChild' from the tree
+        too. The infinite loop was due to 'child' being off the document, so it's
+        nextSibling() is 0, and we go another run of outer loop without changing
+        'current' because the 'targetNode' wasn't in the first child that inner loop
+        couldn't reach.
+
+        When testing Qt on Mac, there was also a crash in RenderTextControl when the font
+        family was empty, this patch fixes it as well.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode): Use NodeVector
+        instead of relying on first/last child being valid after
+        removeInlineStyleFromElement() is called. Skip the child if it has no parent,
+        this is an indication that it was removed from the tree.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::hasValidAvgCharWidth): Empty AtomicStrings aren't
+        supported by HashSet, so we have to early return in this case.
+
+2012-05-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: implement Go To selector for stylesheet files.
+        https://bugs.webkit.org/show_bug.cgi?id=86751
+
+        Reviewed by Yury Semikhatsky.
+
+        StyleSheetOutlineDialog is introduced.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/FilteredItemSelectionDialog.js:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._createDebugToolbar):
+        (WebInspector.ScriptsPanel.prototype._createButtonAndRegisterShortcuts):
+        (WebInspector.ScriptsPanel.prototype._showOutlineDialog):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSheetOutlineDialog):
+        (WebInspector.StyleSheetOutlineDialog.show):
+        (WebInspector.StyleSheetOutlineDialog.prototype.itemTitleAt):
+        (WebInspector.StyleSheetOutlineDialog.prototype.itemKeyAt):
+        (WebInspector.StyleSheetOutlineDialog.prototype.itemsCount):
+        (WebInspector.StyleSheetOutlineDialog.prototype.requestItems):
+        (WebInspector.StyleSheetOutlineDialog.prototype.requestItems.didGetStyleSheet):
+        (WebInspector.StyleSheetOutlineDialog.prototype.selectItem):
+        * inspector/front-end/TabbedEditorContainer.js:
+        (WebInspector.TabbedEditorContainer.prototype._generateTabId):
+        (WebInspector.TabbedEditorContainer.prototype.currentFile):
+
+2012-05-17  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r117428): WebKit API/SPI was removed
+        https://bugs.webkit.org/show_bug.cgi?id=86748
+
+        Reverted r117428.
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::setMediaPlaybackRequiresUserGesture):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-05-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: create SourceFrames with content providers.
+        https://bugs.webkit.org/show_bug.cgi?id=86742
+
+        Reviewed by Vsevolod Vlasov.
+
+        Simple refactoring.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame):
+        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceSourceFrame):
+        (WebInspector.ResourceSourceFrame.prototype.get resource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype._ensureContentLoaded):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSourceFrame):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype.contentURL):
+
+2012-05-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: error when expanding an HTMLAllCollection object in the console
+        https://bugs.webkit.org/show_bug.cgi?id=86741
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/console/inspect-html-all-collection.html
+
+        * inspector/InjectedScriptSource.js: take into account that typeof HTMLAllCollection is "undefined"
+        when checking if object resolved by id is valid.
+
+2012-05-17  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Unreviewed build fix attempt. Changing class to struct in forward declaration.
+
+        * fileapi/File.h:
+        (WebCore):
+
+2012-05-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: convert styles panel into UISourceCodeProvider in the scripts panel.
+        https://bugs.webkit.org/show_bug.cgi?id=86734
+
+        Reviewed by Vsevolod Vlasov.
+
+        This change also makes Scripts render ans Source Code under that experiment.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.get toolbarItemLabel):
+        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StylesUISourceCodeProvider):
+        (WebInspector.StylesUISourceCodeProvider.prototype.uiSourceCodes):
+        (WebInspector.StylesUISourceCodeProvider.prototype._initialize):
+        (WebInspector.StylesUISourceCodeProvider.prototype._resourceAdded):
+        (WebInspector.StylesUISourceCodeProvider.prototype._reset):
+        (WebInspector.StyleSource):
+        (WebInspector.StyleSourceFrame):
+        (WebInspector.StyleSourceFrame.prototype.canEditSource):
+        (WebInspector.StyleSourceFrame.prototype.requestContent):
+        (WebInspector.StyleSourceFrame.prototype.commitEditing):
+        (WebInspector.StyleSourceFrame.prototype.afterTextChanged):
+        (WebInspector.StyleSourceFrame.prototype._clearIncrementalUpdateTimer):
+        (WebInspector.StyleSourceFrame.prototype._contentChanged):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._createRuleOriginNode):
+        * inspector/front-end/UISourceCode.js:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2012-05-17  Antti Koivisto  <antti@apple.com>
+
+        Frame flattening should not expand tiny frames
+        https://bugs.webkit.org/show_bug.cgi?id=86736
+
+        Reviewed by Kenneth Rohde Christiansen.
+        
+        If a frame has so small fixed size that it is not usefully scrollable on desktop it is probably
+        not meant to be scrolled. Displaying any otherwise invisible content by expanding the frame
+        may end up looking like a rendering error.
+
+        The patch prevents expansion of frames that have fixed width or height less than 8px.
+
+        Test: fast/frames/flattening/iframe-tiny.html
+
+        * rendering/RenderFrameBase.cpp:
+        (WebCore::shouldExpandFrame):
+        (WebCore):
+        (WebCore::RenderFrameBase::layoutWithFlattening):
+
+2012-05-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        [Chromium] Web Inspector: assertion failure when inspecting a shared worker in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=86726
+
+        Reviewed by Pavel Feldman.
+
+        No need to keep RefPtr to WorkerThread in a task that will be executed on
+        that thread, raw pointer can be used instead.
+
+        * inspector/WorkerDebuggerAgent.cpp:
+
+2012-05-17  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Refactoring] Support an optional 'message' argument for throwTypeError()
+        https://bugs.webkit.org/show_bug.cgi?id=86576
+
+        Reviewed by Adam Barth.
+
+        As commented in https://bugs.webkit.org/show_bug.cgi?id=84074#c5,
+        I am planning to refactor a series of confusing throwError()s into
+        throwError() and throwTypeError().
+
+        This patch supports an optional 'message' argument for V8Proxy::throwTypeError().
+        Also this patch replaces throwError("message", V8Proxy::TypeError) in custom bindings
+        with V8Proxy::throwTypeError("message").
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::throwTypeError):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore::constructWebGLArray):
+        * bindings/v8/custom/V8AudioContextCustom.cpp:
+        (WebCore::V8AudioContext::constructorCallback):
+        * bindings/v8/custom/V8BlobCustom.cpp:
+        (WebCore::V8Blob::constructorCallback):
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
+        (WebCore::V8DOMFormData::constructorCallback):
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        (WebCore::V8DataView::constructorCallback):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        * bindings/v8/custom/V8IntentConstructor.cpp:
+        (WebCore::V8Intent::constructorCallback):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::V8MessageChannel::constructorCallback):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::V8NotificationCenter::requestPermissionCallback):
+        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
+        (WebCore::V8WebKitMutationObserver::constructorCallback):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::V8WebKitPoint::constructorCallback):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::constructorCallback):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::V8XMLHttpRequest::constructorCallback):
+
+2012-05-16  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [Extensions API] pages shown in sidebar are limited in height to 150px
+        https://bugs.webkit.org/show_bug.cgi?id=86659
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionView):
+        (WebInspector.ExtensionSidebarPane.prototype.setPage): set default iframe height to 150px, unless already set by user.
+        * inspector/front-end/inspector.css: set extension view and iframe elements to "fill", iframe to 100% height.
+        (iframe.extension):
+
+2012-05-17  Sam D  <dsam2912@gmail.com>
+
+        Web Inspector: Hover on a breakpoint in breakpoint-pane does not get differentiated.
+        https://bugs.webkit.org/show_bug.cgi?id=86711
+
+        Changed color values with background on hover over breakpoints.
+
+        Reviewed by Yury Semikhatsky.
+
+        UI change, No new tests.
+
+        * inspector/front-end/inspector.css:
+        (.breakpoint-list li:hover):
+
+2012-05-17  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Web Inspector: DOM Breakpoints Pane should allow to Remove All the breakpoints
+        https://bugs.webkit.org/show_bug.cgi?id=86716
+
+        Reviewed by Yury Semikhatsky.
+
+        Added a new context menu to provide Remove All DOM breakpoint option.
+
+        UI Feature. Tests not required.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DOMBreakpointsSidebarPane.js:
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._removeAllBreakpoints):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._contextMenu):
+
+2012-05-17  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: HeapSnapshot: speed-up calculateObjectToWindowDistance
+        https://bugs.webkit.org/show_bug.cgi?id=86718
+
+        The idea is to switch from nodeIndex2distance array to nodeOrdinal2distance external array.
+        Due to nature of nodeIndex values the original array was sparsed.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotNode.prototype.get distanceToWindow):
+        (WebInspector.HeapSnapshot.prototype._calculateObjectToWindowDistance):
+        (WebInspector.HeapSnapshot.prototype._bfs):
+        (WebInspector.HeapSnapshot.prototype._buildAggregates):
+
+2012-05-11  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Allow FileSystem API implementation to pass snapshot metadata at File creation time
+        https://bugs.webkit.org/show_bug.cgi?id=78879
+
+        Reviewed by Jian Li.
+
+        We query File metadata (e.g. size and modifiedTime) when File.size,
+        lastModifiedTime or webkitSlice() is accessed / called, but in some
+        platform-specific filesystems it may not be feasible since synchronous
+        metadata query could take very long time.
+
+        This patch adds new File constructor which takes metadata argument
+        to allow each FileSystem API implementation to pass snapshot metadata
+        so that File object could cache the given metadata not to make
+        synchronous query.
+
+        We only call this constructor if the filesystem type is neither
+        Temporary nor Persistent, therefore this patch should not affect
+        existing code behavior.
+
+        Test: fast/filesystem/file-read-after-write.html
+
+        * Modules/filesystem/DOMFileSystem.cpp:
+        (WebCore::DOMFileSystem::createFile):
+        * Modules/filesystem/DOMFileSystemSync.cpp:
+        * fileapi/Blob.cpp:
+        (WebCore::Blob::webkitSlice): Updated implementation.
+        * fileapi/Blob.h:
+        * fileapi/File.cpp:
+        (WebCore::File::File): Added new constructor.
+        (WebCore::File::lastModifiedDate): Updated implementation.
+        (WebCore::File::size): Updated implementation.
+        (WebCore::File::captureSnapshot): Updated implementation.
+        * fileapi/File.h:
+        (WebCore::File::createForFileSystemFile): Added.
+        * platform/AsyncFileSystem.h:
+        (AsyncFileSystem): Updated comment.
+
+2012-05-17  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Convert setDomainRelaxationForbiddenForURLScheme to use InternalSettings interface
+        https://bugs.webkit.org/show_bug.cgi?id=86704
+
+        Reviewed by Eric Seidel.
+
+        Add setDomainRelaxationForbiddenForURLScheme functions, because it is able to work in the
+        cross-port way by means of the InternalSettings interface.
+
+        No new tests, since we are improving here the infra-structure for testing
+        a specific method.
+
+        * testing/InternalSettings.cpp:
+        (WebCore):
+        (WebCore::InternalSettings::setDomainRelaxationForbiddenForURLScheme):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-05-17  Shinya Kawanaka  <shinyak@chromium.org>
+
+        ShadowRoot.selection should be ShadowRoot.getSelection()
+        https://bugs.webkit.org/show_bug.cgi?id=86598
+
+        Reviewed by Hajime Morita.
+
+        In the latest spec, ShadowRoot.selection is changed to ShadowRoot.getSelection().
+        So update the implementation.
+
+        * dom/ShadowRoot.cpp:
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowRoot.idl:
+
+2012-05-17  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Refactoring] Remove TreeScopeAdjuster
+        https://bugs.webkit.org/show_bug.cgi?id=86599
+
+        Reviewed by Hajime Morita.
+
+        It seems the right place of the method of TreeScopeAdjuster are in VisibleSelection
+        and TreeScope. So we can remove TreeScopeAdjuster.
+
+        No new tests, no change in behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::ancestorInThisScope):
+        (WebCore):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * dom/TreeScopeAdjuster.cpp: Removed.
+        * dom/TreeScopeAdjuster.h: Removed.
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::adjustPositionBefore):
+        (WebCore):
+        (WebCore::VisibleSelection::adjustPositionAfter):
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries):
+        * editing/VisibleSelection.h:
+        (VisibleSelection):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::shadowAdjustedNode):
+        (WebCore::DOMSelection::shadowAdjustedOffset):
+
+2012-05-17  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        NEON intrinsic should be used with arithmetic mode of composite filter
+        https://bugs.webkit.org/show_bug.cgi?id=86622
+
+        Reviewed by Nikolas Zimmermann.
+
+        Rewrite hand written assembly code to increase portability and readibility
+        of the code. Remove the unnecessary FECompositeArithmeticNEON.cpp from the
+        project
+
+        Existing tests cover this issue.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore):
+        (WebCore::computeArithmeticPixels):
+        (WebCore::arithmeticSoftware):
+        (WebCore::FEComposite::platformArithmeticSoftware):
+        * platform/graphics/filters/FEComposite.h:
+        * platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp: Removed.
+        * platform/graphics/filters/arm/FECompositeArithmeticNEON.h:
+        (WebCore):
+        (WebCore::FEComposite::computeArithmeticPixelsNeon):
+        (WebCore::FEComposite::platformArithmeticNeon):
+
+2012-05-17  Takashi Sakamoto  <tasak@google.com>
+
+        showNodePath will be useful for debugging purpose.
+        https://bugs.webkit.org/show_bug.cgi?id=86450
+
+        This patch implements showNodePath, which outputs node information in
+        a xpath-like format, e.g. /HTML/BODY/DIV[@id="test" and position()=0]/P[0]
+
+        Reviewed by Hajime Morita.
+
+        No new tests, just adding debugging interface.
+
+        * dom/Node.cpp:
+        (WebCore::Node::showNodePathForThis):
+        (WebCore):
+        (showNodePath):
+        * dom/Node.h:
+        (Node):
+
+2012-05-17  Pravin D  <pravind.2k4@gmail.com>
+
+        REGRESSION (r116331): RSS Headlines/links are missing (-webkit-box-flex broken?)
+        https://bugs.webkit.org/show_bug.cgi?id=85991
+
+        Fix for regression failures on deprecated flex box test cases. 
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/css/deprecated-flex-box-zero-width-intrinsic-max-width.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computePreferredLogicalWidths):
+        Fix to use intrinsic width when the fixed width:0 , for deprecated flex boxes.
+
+2012-05-17  Uday Kiran  <udaykiran@motorola.com>
+
+        CSS3 Multicolumn: Content in normal flow extending into column gaps should be clipped at middle of column-gap
+        https://bugs.webkit.org/show_bug.cgi?id=86441
+
+        Reviewed by Eric Seidel.
+
+        Content in the normal flow that extends into column gaps (e.g., long words or images)
+        is clipped in the middle of the column gap.
+        http://www.w3.org/TR/css3-multicol/#overflow-inside-multicol-elements
+
+        Test: fast/multicol/overflow-into-columngap.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnContents):
+
+2012-05-16  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r117372.
+        http://trac.webkit.org/changeset/117372
+        https://bugs.webkit.org/show_bug.cgi?id=86710
+
+        "triggerring crashes" (Requested by morrita on #webkit).
+
+        * Modules/webaudio/AudioParam.cpp:
+        (WebCore::AudioParam::calculateSampleAccurateValues):
+        (WebCore::AudioParam::calculateAudioRateSignalValues):
+        (WebCore::AudioParam::connect):
+        (WebCore::AudioParam::disconnect):
+        * Modules/webaudio/AudioParam.h:
+        (WebCore::AudioParam::context):
+        (WebCore::AudioParam::hasSampleAccurateValues):
+        (WebCore::AudioParam::AudioParam):
+        (AudioParam):
+
+2012-05-16  Hayato Ito  <hayato@chromium.org>
+
+        Implement a Shadow DOM spec's section 6 'Events'.
+        https://bugs.webkit.org/show_bug.cgi?id=78586
+
+        Reviewed by Dimitri Glazkov.
+
+        This implements a Shadow DOM spec's section 6 'Events', introducing a new
+        algorithm so that event dispatching use a composed shadow DOM tree,
+        instead of normal DOM tree, in dispatching events to each node.
+
+        The spec is here: http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#events
+
+        Summary of changes:
+        - Attaching shadow DOM does not affect an event dispatching
+        behavior of enclosing DOM tree. This applies even if some nodes
+        are distributed to insertion points. We keep a compatibility of
+        existing event dispatching mechanism so that we won't break Web.
+        - Event ancestors, which are used in dispatching events in capture (or
+        bubble) phase, are now the result of traversing ancestors in composed
+        shadow DOM tree order, instead of normal DOM tree order.
+        - Event's target and related-target are correctly adjusted so that
+        we don't leak any node which is inaccessible from the event's
+        current-target node. We enforce both upper and lower boundary
+        encapsulation of Shadow DOM in event dispatching
+
+        Here is an example of event dispatching. Suppose we have the following DOM tree, which
+        includes some nested shadow hosts and insertion points
+        A
+        `--B-----[SR-B]
+           |-C     `--G--------------[SR-G]
+           | `-D      |-<H select=C>    |--J---------------[SR-J]
+           `-E        `-<I select=E>    |  `-<K select=H>    `-<N select=K>
+             `-F                        |
+                                        `--L---------------[SR-L]
+                                           `-<M select=I>    `-<O select=M>
+
+          Notation: [SR-X]: Shadow Root
+                    <X select=Y>: Insertion Point, called X, which selects Y.
+
+        If a mouse moves from node '#F' to node '#D', the following
+        'mouseover' events are dispatched in each ancestor node:
+
+        [currentTarget] [target] [related-target]
+          #D             #D       #F
+          #C             #D       #F
+          #H             #H       #I
+          #K             #K       #M
+          #N             #N       #M
+          #SR-J          #N       #M
+          #J             #K       #M
+          #SR-G          #K       #M
+          #G             #H       #I
+          #SR-B          #H       #I
+          #B             #D       #F
+          #A             #D       #F
+
+        Details are:
+        - Insertion points, such as <content> or <shadow>, are resolved correctly
+        in calculating event ancestors. That means if a node is distributed to
+        an insertion point, the insertion point is now an ancestor of the node in
+        bubbling (or capturing) events.
+        - Both insertion points and shadow roots now can receive events. We can add
+        event listeners to insertion points and shadow roots.
+        - Dispatched event's target is now adjusted correctly using the re-targeting
+        algorithm. The algorithm is now fully aware of insertion points.
+        - Dispatched event's related-target can now differ in each tree scope of
+        event ancestors. We choose the most appropriate related-target using the
+        related target resolution algorithm for each node.
+
+        Performance consideration:
+        This patch can achieve the competitive performance. The results of
+        ./Tools/Scripts/run-perf-tests PerformanceTests/DOM/Events.html for
+        before/after this patch are:
+
+        Before applying this patch:
+            Running DOM/Events.html (1 of 1)
+            RESULT DOM: Events= 270.310714286 ms
+            median= 269.75 ms, stdev= 2.0042397663 ms, min= 267.357142857 ms, max= 276.5 ms
+
+        After applying this patch:
+            Running DOM/Events.html (1 of 1)
+            RESULT DOM: Events= 268.108333333 ms
+            median= 267.5 ms, stdev= 2.41883157195 ms, min= 263.625 ms, max= 273.142857143 ms
+
+        I've also conducted a micro benchmark using both
+        Shadow-Free-DOM-Tree and DOM-Tree-With-Shadow-Host.
+        See https://bugs.webkit.org/show_bug.cgi?id=78586#c40 for the results.
+        It seems that the new implementation has more capabilities, but
+        doesn't sacrifice a performance of event dispatching in either cases.
+
+        Test: fast/dom/shadow/shadow-dom-event-dispatching.html
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::parentIncludingInsertionPointAndShadowRoot):
+        (WebCore):
+        (WebCore::ComposedShadowTreeWalker::traverseParentIncludingInsertionPointAndShadowRoot):
+        * dom/ComposedShadowTreeWalker.h:
+        (ComposedShadowTreeWalker):
+        * dom/EventContext.cpp:
+        (WebCore::EventContext::EventContext):
+        (WebCore::EventContext::handleLocalEvents):
+        * dom/EventContext.h:
+        (EventContext):
+        (WebCore::EventContext::relatedTarget):
+        (WebCore):
+        (WebCore::EventContext::setRelatedTarget):
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventRelatedTargetAdjuster::EventRelatedTargetAdjuster):
+        (WebCore):
+        (WebCore::EventRelatedTargetAdjuster::adjust):
+        (WebCore::EventRelatedTargetAdjuster::findRelatedTarget):
+        (WebCore::EventDispatcher::adjustRelatedTarget):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+        (WebCore::EventDispatcher::dispatchEvent):
+        (WebCore::EventDispatcher::determineDispatchBehavior):
+        * dom/EventDispatcher.h:
+        (WebCore):
+        (EventRelatedTargetAdjuster):
+        (EventDispatcher):
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEventDispatchMediator::dispatchEvent):
+        * dom/MouseEvent.h:
+        (WebCore::toMouseEvent):
+        (WebCore):
+
+2012-05-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Moving caret up or down skips lines when there's a non-editable line
+        https://bugs.webkit.org/show_bug.cgi?id=81490
+
+        Reviewed by Eric Seidel.
+
+        The bug was caused by previousRootInlineBoxCandidatePosition and nextRootInlineBoxCandidatePosition
+        skipping leaf nodes that constitute a new line and belong to the same editable region because block elements
+        that separate lines are not editable so it looked as if all editable lines belong to a single line as far as
+        those two functions are concerned.
+
+        Fixed the bug by using the first leaf node that belongs to the same editable region but does not belong in
+        the same as the start node.
+
+        This patch is based on a patch authored by Yi Shen (Nokia).
+
+        Test: editing/selection/move-between-lines-of-different-editabilities.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousRootInlineBoxCandidatePosition):
+        (WebCore::nextRootInlineBoxCandidatePosition):
+
+2012-05-16  MORITA Hajime <morrita@google.com>
+
+        Unreviewed attempt to fix Mac SL build.
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+
+2012-05-16  Levi Weintraub  <leviw@chromium.org>
+
+        Use pixelSnappedLogicalHeight for TableSection layout
+        https://bugs.webkit.org/show_bug.cgi?id=86665
+
+        Reviewed by Eric Seidel.
+
+        We do table layout using integers to ensure we follow the spec (see
+        https://trac.webkit.org/wiki/LayoutUnit for details), but were previously
+        flooring the logical height used in layoutRows. This caused us to mis-
+        calculate the intrinsic padding and grow cells beyond their proper height.
+
+        No new tests. Fully covered by existing tests with sub-pixel enabled.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::pixelSnappedLogicalHeight): Added these convenience
+        methods.
+        (WebCore::RenderBox::pixelSnappedLogicalWidth):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+
+2012-05-16  Tony Chang  <tony@chromium.org>
+
+        rename display:-webkit-flexbox to display:-webkit-flex
+        https://bugs.webkit.org/show_bug.cgi?id=86529
+
+        Reviewed by Eric Seidel.
+
+        Also renames -webkit-inline-flexbox to -webkit-inline-flex.
+
+        No new tests. Covered by existing tests.
+
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSValueKeywords.in: Update keyword values.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/style/RenderStyleConstants.h: Rename const values.
+
+2012-05-16  Greg Billock  <gbillock@google.com>
+
+        IDL and implementation for Web Intents delivery
+        https://bugs.webkit.org/show_bug.cgi?id=83634
+
+        Reviewed by Adam Barth.
+
+        The delivered intent has some extra fields and methods (extras,
+        postResult, postFailure) from the invocation intent. It is implemented
+        as a subclass. Responses from the service JS are passed to an embedder
+        client object provided when the intent is delivered.
+        See http://dvcs.w3.org/hg/web-intents/raw-file/tip/spec/Overview.html
+        Test: webintents/web-intents-delivery.html
+
+        * Modules/intents/DOMWindowIntents.cpp: Copied from Source/WebCore/Modules/intents/DOMWindowIntents.idl.
+        (WebCore):
+        (WebCore::DOMWindowIntents::DOMWindowIntents):
+        (WebCore::DOMWindowIntents::~DOMWindowIntents):
+        (WebCore::DOMWindowIntents::from):
+        (WebCore::DOMWindowIntents::webkitIntent):
+        (WebCore::DOMWindowIntents::deliver):
+        * Modules/intents/DOMWindowIntents.h: Copied from Source/WebCore/Modules/intents/DOMWindowIntents.idl.
+        (WebCore):
+        (DOMWindowIntents):
+        * Modules/intents/DOMWindowIntents.idl:
+        * Modules/intents/DeliveredIntent.cpp: Copied from Source/WebCore/Modules/intents/Intent.h.
+        (WebCore):
+        (WebCore::DeliveredIntent::create):
+        (WebCore::DeliveredIntent::DeliveredIntent):
+        (WebCore::DeliveredIntent::ports):
+        (WebCore::DeliveredIntent::getExtra):
+        (WebCore::DeliveredIntent::postResult):
+        (WebCore::DeliveredIntent::postFailure):
+        * Modules/intents/DeliveredIntent.h: Copied from Source/WebCore/Modules/intents/Intent.h.
+        (WebCore):
+        (DeliveredIntent):
+        (WebCore::DeliveredIntent::~DeliveredIntent):
+        * Modules/intents/DeliveredIntent.idl: Copied from Source/WebCore/Modules/intents/Intent.h.
+        * Modules/intents/Intent.h:
+        (WebCore::Intent::~Intent):
+        (Intent):
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/v8/custom/V8DeliveredIntentCustom.cpp: Copied from Source/WebCore/Modules/intents/Intent.h.
+        (WebCore):
+        (WebCore::V8DeliveredIntent::portsAccessorGetter):
+
+2012-05-16  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Refactoring] Replace throwError("message", XXXError)
+        with throwError(XXXError, "message")
+        https://bugs.webkit.org/show_bug.cgi?id=86579
+
+        Reviewed by Adam Barth.
+
+        This is one of a series of refactoring commented in
+        https://bugs.webkit.org/show_bug.cgi?id=84074#c5
+
+        Currently there are two equivalent throwError()s; i.e. throwError("message", XXXError)
+        and throwError(XXXError, "message"). In this bug we replace
+        throwError("message", XXXError) with throwError(XXXError, "message")
+        (except for the case where XXXError == TypeError. This is because
+        throwError("message", TypeError) will be replaced with throwTypeError("message")
+        in a follow-up patch).
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8NPObject.cpp:
+        (WebCore::npObjectInvokeImpl):
+        (WebCore::npObjectGetProperty):
+        (WebCore::npObjectSetProperty):
+        (WebCore::npObjectPropertyEnumerator):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleMaxRecursionDepthExceeded):
+        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
+        (WebCore::V8ArrayBuffer::constructorCallback):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore::constructWebGLArrayWithArrayBufferArgument):
+        (WebCore::constructWebGLArray):
+        * bindings/v8/custom/V8AudioContextCustom.cpp:
+        (WebCore::V8AudioContext::constructorCallback):
+        * bindings/v8/custom/V8BlobCustom.cpp:
+        (WebCore::V8Blob::constructorCallback):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::V8Clipboard::clearDataCallback):
+        (WebCore::V8Clipboard::setDragImageCallback):
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
+        (WebCore::V8DOMFormData::appendCallback):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
+        (WebCore::V8WebKitMutationObserver::constructorCallback):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::constructorCallback):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::V8XMLHttpRequest::constructorCallback):
+
+2012-05-16  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Pass Isolate to remaining toV8()
+        https://bugs.webkit.org/show_bug.cgi?id=86570
+
+        Reviewed by Nate Chapin.
+
+        The objective is to pass Isolate around in V8 bindings.
+        This patch passes Isolate to toV8(). I've landed a bunch of
+        patches to pass Isolate to toV8(), and this would be the last
+        patch for passing Isolate to toV8().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/v8/custom/V8IDBAnyCustom.cpp:
+        (WebCore::toV8):
+
+2012-05-16  James Robinson  <jamesr@chromium.org>
+
+        GraphicsContext3D interface should not be aware of CanvasRenderingContext
+        https://bugs.webkit.org/show_bug.cgi?id=86550
+
+        Reviewed by Darin Adler.
+
+        GraphicsContext3D is a WebCore/platform API construct. CanvasRenderingContext is a WebCore/html concept. Thus,
+        the former shouldn't depend on the latter.  In turns out that all everyone ever wants from a
+        CanvasRenderingContext in GraphicsContext3D is its underlying ImageBuffer, which is a WebCore/platform concept,
+        so this just updates the APIs and implementations to use that instead.
+
+        Refactor only, no new tests.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::paintRenderingResultsToCanvas):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/cairo/DrawingBufferCairo.cpp:
+        (WebCore::DrawingBuffer::paintCompositedResultsToCanvas):
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::paintCompositedResultsToCanvas):
+        * platform/graphics/clutter/DrawingBufferClutter.cpp:
+        (WebCore::DrawingBuffer::paintCompositedResultsToCanvas):
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3D::paintCompositedResultsToCanvas):
+        * platform/graphics/gpu/DrawingBuffer.h:
+        * platform/graphics/gpu/qt/DrawingBufferQt.cpp:
+        (WebCore::DrawingBuffer::paintCompositedResultsToCanvas):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3D::paintCompositedResultsToCanvas):
+
+2012-05-16  Joshua Bell  <jsbell@chromium.org>
+
+        SerializedScriptValue: lazy initialization of static nullValue not threadsafe
+        https://bugs.webkit.org/show_bug.cgi?id=70833
+
+        Reviewed by Kentaro Hara.
+
+        Remove unsafe lazy initialization of static |null| SSV. None of the callers
+        appeared to be in performance-critical areas - most were preparing an event to
+        be dispatched to script - so no per-call-site caching was added.
+
+        No new tests - no functional changes.
+
+        * bindings/js/SerializedScriptValue.cpp: Mint a new one each time.
+        (WebCore::SerializedScriptValue::nullValue):
+        * bindings/js/SerializedScriptValue.h: Return via PassRefPtr.
+        * bindings/v8/SerializedScriptValue.cpp: Mint a new one each time.
+        (WebCore::SerializedScriptValue::nullValue):
+        * bindings/v8/SerializedScriptValue.h: Return via PassRefPtr.
+        (SerializedScriptValue):
+        * dom/Document.cpp:
+        (WebCore::Document::statePopped): Change to PassRefPtr to maintain refcount.
+        * dom/Document.h:
+        (Document):
+
+2012-05-16  James Robinson  <jamesr@chromium.org>
+
+        CachedImage does not clear the ImageObserver pointer when dropping its Image ref
+        https://bugs.webkit.org/show_bug.cgi?id=86689
+
+        Reviewed by Eric Seidel.
+
+        Image instances keep a weak pointer to their ImageObserver, which may be null. CachedImage is an ImageObserver
+        and holds a RefPtr<Image> m_image. When CachedImage initializes its m_image to either an SVGImage or BitmapImage,
+        it sets itself as that Image's ImageObserver. However, CachedImage never clears the ImageObserver pointer, even
+        when dropping its reference to the Image. This means if other code holds a RefPtr<Image> there is no promise
+        that calls on that Image will be valid. This patch clears the CachedImage::m_image's ImageObserver pointer
+        whenever the CachedImage drops its reference. Image already has null checks for its m_imageObserver so this is
+        always a safe operation.
+
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::~CachedImage):
+        (WebCore::CachedImage::clear):
+
+2012-05-16  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Fix a broken copyright of V8SVGElementCustom.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=86569
+
+        Reviewed by Nate Chapin.
+
+        This patch just fixes a broken copyright of V8SVGElementCustom.cpp.
+
+        Blame changeset: r54153
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8SVGElementCustom.cpp:
+
+2012-05-16  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Pass Isolate to convertEventTargetToV8Object()
+        https://bugs.webkit.org/show_bug.cgi?id=86566
+
+        Reviewed by Nate Chapin.
+
+        The objective is to pass Isolate around in V8 bindings.
+        This patch passes Isolate to convertEventTargetToV8Object().
+        I made the 'isolate' argument optional, since
+        convertEventTargetToV8Object() can be called from the WebCore context.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (NativeToJSValue):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (V8DOMWrapper):
+
+2012-05-16  Peter Kasting  <pkasting@google.com>
+
+        Correctly display malformed GIFs which specify bogus extension block
+        sizes.
+        https://bugs.webkit.org/show_bug.cgi?id=86531
+
+        Reviewed by James Robinson.
+        
+        This was broken by r117333, which was an attempt to avoid memory errors
+        on GIFs that were malformed in a similar way.  It turns out some GIFs
+        in the wild (i.e. "our LayoutTests directory") relied on some of the
+        effects of the old code.  This refixes in a way that doesn't break
+        these.
+
+        No new tests, covered by existing tests.
+
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::read):
+
+2012-05-16  Chris Rogers  <crogers@google.com>
+
+        AudioParam must support fan-in (multiple audio connections)
+        https://bugs.webkit.org/show_bug.cgi?id=83610
+
+        Reviewed by Kenneth Russell.
+
+        Test: webaudio/audioparam-summingjunction.html
+
+        * Modules/webaudio/AudioParam.cpp:
+        * Modules/webaudio/AudioParam.h:
+        (WebCore::AudioParam::calculateSampleAccurateValues):
+        (WebCore::AudioParam::calculateAudioRateSignalValues):
+        Sums intrinsic parameter value with all audio-rate connections.
+
+        (WebCore::AudioParam::connect):
+        (WebCore::AudioParam::disconnect):
+        Support multiple connections.
+
+        (WebCore::AudioParam::hasSampleAccurateValues):
+        If we have one or more audio-rate connections.
+
+        (WebCore::AudioParam::AudioParam):
+        AudioParam now sub-classes AudioSummingJunction.
+
+2012-05-16  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Pass Isolate to createV8HTMLWrapper() and createV8SVGWrapper()
+        https://bugs.webkit.org/show_bug.cgi?id=86558
+
+        Reviewed by Nate Chapin.
+
+        The objective is to pass Isolate around in V8 bindings.
+        This patch passes Isolate to createV8HTMLWrapper() and createV8SVGWrapper().
+
+        Basically 'isolate' has been implemented as the last argument
+        but before 'forceNewObject' argument, because 'forceNewObject' is an optional
+        argument and omitted in most cases. Due to the convention,
+        this patch puts 'isolate' before 'forceNewObject'.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8HTMLElementCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8SVGElementCustom.cpp:
+        (WebCore::toV8):
+        * dom/make_names.pl:
+        (printWrapperFunctions):
+        (printWrapperFactoryCppFile):
+        (printWrapperFactoryHeaderFile):
+
+2012-05-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Move showStyle from CSSStyleDeclaration to StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=86675
+
+        Reviewed by Andreas Kling.
+
+        Moved the function. Also deleted CSSStyleDeclaration.cpp since it's no longer needed.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSAllInOne.cpp:
+        * css/CSSStyleDeclaration.cpp:
+        (WebCore):
+        * css/CSSStyleDeclaration.h:
+        (CSSStyleDeclaration):
+        * css/StylePropertySet.cpp:
+        (WebCore):
+        (WebCore::StylePropertySet::showStyle):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+
+2012-05-16  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the indexed database build for GTK+.
+
+        * GNUmakefile.list.am: Add missing files to the build.
+        * bindings/gobject/GNUmakefile.am: Be smarter about filtering out deactivating indexed database.
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (SkipAttribute): Always skip attributes that return indexed database types.
+
+2012-05-16  Jon Lee  <jonlee@apple.com>
+
+        Animated GIFs in page cache get updated
+        https://bugs.webkit.org/show_bug.cgi?id=86668
+        <rdar://problem/11395549>
+
+        Reviewed by Brady Eidson.
+
+        Test: fast/loader/image-in-page-cache.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged): When we are notified by the CachedImage that the image has
+        changed, we check to see if the document is in the page cache. If so, we should not be updating,
+        so we bail out early.
+
+2012-05-16  Tim Horton  <timothy_horton@apple.com>
+
+        Crash if SVG gradient stop has display: none set
+        https://bugs.webkit.org/show_bug.cgi?id=86686
+        <rdar://problem/10751905>
+
+        Reviewed by Dean Jackson.
+
+        Create a renderer for SVGStopElement regardless of the "display" property.
+        This matches the behavior of Opera and the SVG specification.
+
+        Test: svg/custom/gradient-stop-display-none-crash.svg
+
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::rendererIsNeeded):
+        (WebCore):
+        * svg/SVGStopElement.h:
+        (SVGStopElement):
+
+2012-05-16  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Clear the m_private pointer when destroying WebFilterOperations to avoid assert in WebPrivateOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=86654
+
+        Reviewed by James Robinson.
+
+        * platform/chromium/support/WebFilterOperations.cpp:
+        (WebKit::WebFilterOperations::reset):
+        (WebKit::WebFilterOperations::destroy):
+        (WebKit):
+
+2012-05-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r92823): WebKit strips font-weight: normal from b element when copying
+        https://bugs.webkit.org/show_bug.cgi?id=86663
+
+        Reviewed by Tony Chang.
+
+        The bug was caused by removeStyleFromRulesAndContext incorrectly stripping font-weight property
+        even when the context had no font-weight property because of a property name mismatch in getPropertiesNotIn.
+
+        Fixed the mismatch.
+
+        Test: editing/pasteboard/paste-text-with-style-5.html
+
+        * editing/EditingStyle.cpp:
+        (WebCore::getPropertiesNotIn):
+
+2012-05-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Merge nextRootInlineBox with nextLinePosition
+        https://bugs.webkit.org/show_bug.cgi?id=81593
+
+        Reviewed by Enrica Casucci.
+
+        Call previousRootInlineBox and nextRootInlineBox in previousLinePosition and nextLinePosition respectively
+        to share the code. Moved out the nullity check of startBox and extracted the renderer's node from the former
+        two, and added editableType to their argument lists to match the interface in both use cases.
+
+        Also moved out the code to extract root inline box using RenderedPosition from those two functions and
+        expanded in call sites since previousLinePosition and nextLinePosition need to return the candidate position
+        even when the root inline box doesn't exist. To this end, renamed previousRootInlineBox and nextRootInlineBox
+        to previousRootInlineBoxCandidatePosition and nextRootInlineBoxCandidatePosition respectively.
+
+        In addition, got rid of one version of nextLeafWithSameEditability that adjusted node with respect to offset
+        This variant did:
+
+        Node* child = node->childNode(offset);
+        node = child ? child->nextLeafNode() : node->lastDescendant()->nextLeafNode();
+
+        instead of:
+
+        node = node->nextLeafNode();
+
+        at the beginning of the function. Observe that the former code is logically equivalent to:
+
+        Node* child = node->childNode(offset);
+        node = child ? child : node->lastDescendant();
+        node = node->nextLeafNode();
+
+        Thus, the first two lines of this logically equivalent code is added in nextLinePosition wherein we used to
+        call the removed variant.
+
+        This refactoring with no behavioral change would help us resolving the bug 81490.
+
+        * editing/visible_units.cpp:
+        (WebCore::previousRootInlineBoxCandidatePosition): Renamed from previousRootInlineBox.
+        (WebCore::nextRootInlineBoxCandidatePosition): Renamed from nextRootInlineBox.
+        (WebCore::logicallyPreviousBox): Checks the nullity of startBox's renderer and node. Also extracts the root
+        inline box out of the position per the interface change.
+        (WebCore::logicallyNextBox): Ditto.
+        (WebCore::previousLinePosition): Calls previousRootInlineBoxCandidatePosition.
+        (WebCore::nextLinePosition): Calls nextRootInlineBoxCandidatePosition.
+
+2012-05-16  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Remove ImageDecoderCG.cpp from platform/image-decoders
+        https://bugs.webkit.org/show_bug.cgi?id=86346
+
+        Reviewed by Adam Barth.
+
+        ImageDecoderCG.cpp was added for use in the Chromium port in r70846. Remove the
+        implementation now that Chromium uses Skia on Mac OSX by default.
+
+        No new tests. No change in behavior.
+        
+        * WebCore.gypi: Remove ImageDecoderCG.cpp from the gyp project.
+        * platform/graphics/ImageSource.h: Revert the r70846 changes.
+        * platform/image-decoders/ImageDecoder.cpp: Remove copyReferenceToBitmapData().
+        (WebCore::ImageFrame::operator=): Return to using copyBitmapData() (as it was)
+        given the removal of copyReferenceToBitmapData() above.
+        * platform/image-decoders/ImageDecoder.h:
+        (ImageFrame): Remove copyReferenceToBitmapData() declaration.
+        * platform/image-decoders/cg/ImageDecoderCG.cpp: Removed, and it was the only
+        decoder with a port-specific implementation of copyReferenceToBitmapData().
+
+2012-05-16  Raymond Toy  <rtoy@google.com>
+
+        Simplify AudioNode ref-counting by removing RefTypeDisabled
+        https://bugs.webkit.org/show_bug.cgi?id=85681
+
+        Reviewed by Chris Rogers.
+
+        Existing tests should cover these changes.
+
+        * Modules/webaudio/AudioNode.cpp: Remove RefTypeDiabled and m_disabledRefCount.
+        (WebCore::AudioNode::AudioNode):
+        (WebCore::AudioNode::~AudioNode):
+        (WebCore::AudioNode::enableOutputsIfNecessary): New
+        (WebCore::AudioNode::ref): 
+        (WebCore::AudioNode::disableOutputsIfNecessary): New
+        (WebCore::AudioNode::finishDeref):
+        * Modules/webaudio/AudioNode.h: Remove RefTypeDisabled and m_disabledRefCount.
+        * Modules/webaudio/AudioNodeInput.cpp: Removed uses of RefTypeDisbled.
+        (WebCore::AudioNodeInput::disconnect):
+        (WebCore::AudioNodeInput::disable):
+        (WebCore::AudioNodeInput::enable):
+
+2012-05-16  Ojan Vafai  <ojan@chromium.org>
+
+        Fix perf regression from r116487
+        https://bugs.webkit.org/show_bug.cgi?id=86680
+
+        Reviewed by Ryosuke Niwa.
+
+        http://trac.webkit.org/changeset/116487 caused a 6% regression on
+        Dromaeo's dom-attr test. The issue is that we invalidated NodeList
+        caches whenever an id/checked/type attribute changed.
+
+        First, we don't need to invalidate on checked/type since that only
+        affects the values return by NodeList items, not the list of items.
+        Second, we only need to invalidate NodeList caches when an id attribute
+        changes on a FormControlElement.
+
+        Incidentally, we also don't need to invalidate caches for changes
+        to attributes that don't have an ownerElement.
+
+        No new tests. This is strictly a performance improvement.
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::setValue):
+        (WebCore::Attr::childrenChanged):
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        * dom/Node.cpp:
+        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
+        * dom/Node.h:
+        (Node):
+
+2012-04-22  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: inline-table-001 fails
+        https://bugs.webkit.org/show_bug.cgi?id=84167
+
+        Reviewed by Julien Chaffraix.
+
+        Override lastLineBoxBaseline() in RenderTable so that it picks up the baseline
+        of the text in the first row of the table. This allows inline tables to find the
+        correct baseline to align to.
+
+        Tests:
+                css2.1/20110323/inline-table-001.htm
+                css2.1/20110323/inline-table-002a.htm
+                css2.1/20110323/inline-table-003.htm
+                fast/css/empty-cell-baseline.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::getLineBoxBaseline):
+        (WebCore):
+        (WebCore::RenderTable::lastLineBoxBaseline):
+        (WebCore::RenderTable::firstLineBoxBaseline):
+        * rendering/RenderTable.h:
+        (RenderTable):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::firstLineBoxBaseline): if a cell is empty it cannot provide a 
+          baseline. Tested by fast/css/empty-cell-baseline.html
+
+2012-05-16  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Rename valid/finished methods to isValid/isFinished to match coding standard
+        https://bugs.webkit.org/show_bug.cgi?id=86655
+
+        Reviewed by Tony Chang.
+
+        No new tests - no functional changes.
+
+        * Modules/indexeddb/IDBKey.h:
+        (WebCore::IDBKey::isValid): valid() => isValid()
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::deleteFunction):
+        (WebCore::IDBObjectStore::index):
+        (WebCore::IDBObjectStore::transactionFinished):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        * Modules/indexeddb/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::isFinished): finished() => isFinished()
+        * Modules/indexeddb/IDBTransaction.h:
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+
+2012-05-16  Jeffrey Pfau  <jpfau@apple.com>
+
+        ImageLoader can still dispatch beforeload events for ImageDocuments
+        https://bugs.webkit.org/show_bug.cgi?id=86658
+        <rdar://problem/11465863>
+
+        Reviewed by Brady Eidson.
+
+        Prevent flags regarding sending beforeload events from being set on ImageDocuments.
+
+        No new tests; testing framework doesn't allow for testing ImageDocuments with injected JavaScript.
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateFromElement):
+
+2012-05-16  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        layerX/layerY warning should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=86264
+
+        Reviewed by James Robinson.
+
+        Covered by: fast/dom/Window/window-xy-properties.html
+                    fast/events/init-events.html
+                    fast/events/mouse-relative-position.html
+                    fast/events/mouseclick-target-and-positioning.html
+                    fast/events/simulated-click-coords.html
+                    jquery/event.html
+
+        This change just removes the warning pending proper investigation.
+
+        Longer explanation: The layerX/layerY warning was added prematurely
+        as we didn't assess the web-compatibility potential breakage vs the
+        maintenance cost. There is also not readily available replacement.
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::layerX):
+        (WebCore::MouseRelatedEvent::layerY):
+        * dom/UIEvent.cpp:
+        (WebCore::UIEvent::layerX):
+        (WebCore::UIEvent::layerY):
+        * dom/UIEvent.h:
+        Removed warnDeprecatedLayerXYUsage and all the associated calls.
+
+2012-05-16  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Use accessors for backing store / database id in store/index backends
+        https://bugs.webkit.org/show_bug.cgi?id=86652
+
+        Reviewed by Tony Chang.
+
+        Hide the private members m_backingStore and m_databaseId of IDBObjectStoreBackendImpl
+        and IDBIndexBackendImpl behind accessors. This is preparation for removing these
+        members and only holding references to the IDBDatabaseBackendImpl: webkit.org/b/83074
+
+        No new tests - no functional changes.
+
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::openCursorInternal):
+        (WebCore::IDBIndexBackendImpl::countInternal):
+        (WebCore::IDBIndexBackendImpl::getInternal):
+        (WebCore::IDBIndexBackendImpl::getByRangeInternal):
+        (WebCore::IDBIndexBackendImpl::getKeyInternal):
+        (WebCore::IDBIndexBackendImpl::getKeyByRangeInternal):
+        (WebCore::IDBIndexBackendImpl::addingKeyAllowed):
+        * Modules/indexeddb/IDBIndexBackendImpl.h:
+        (WebCore::IDBIndexBackendImpl::backingStore): Added.
+        (WebCore::IDBIndexBackendImpl::databaseId): Added.
+        (IDBIndexBackendImpl):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::getByRangeInternal):
+        (WebCore::IDBObjectStoreBackendImpl::getInternal):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        (WebCore::IDBObjectStoreBackendImpl::clearInternal):
+        (WebCore):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::createIndexInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteIndexInternal):
+        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
+        (WebCore::IDBObjectStoreBackendImpl::countInternal):
+        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
+        (WebCore::IDBObjectStoreBackendImpl::genAutoIncrementKey):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
+        (WebCore::IDBObjectStoreBackendImpl::backingStore): Added.
+        (WebCore::IDBObjectStoreBackendImpl::databaseId): Added.
+        (IDBObjectStoreBackendImpl):
+
+2012-05-15  Peter Kasting  <pkasting@google.com>
+
+        Malformed GIF can cause decoder to read off end of heap buffer
+        https://bugs.webkit.org/show_bug.cgi?id=86531
+
+        Reviewed by Adam Barth.
+
+        Test: fast/images/read-past-end-of-buffer.html
+        This test is only expected to catch problems if run under Address
+        Sanitizer or a similar memory-checking utility.
+
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::read):
+
+2012-05-16  Varun Jain  <varunjain@google.com>
+
+        [chromium] No modifier flags (shift/ctrl/alt) in drag&drop events on chromium linux
+        https://bugs.webkit.org/show_bug.cgi?id=86236
+
+        Reviewed by Tony Chang.
+
+        ManualTests: ManualTests/chromium/modifiers-during-drag-and-drop.html
+
+        * page/DragController.cpp:
+        (WebCore::createMouseEvent):
+        * platform/DragData.cpp:
+        (WebCore):
+        (WebCore::DragData::modifierKeyState):
+        * platform/DragData.h:
+        (DragData):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::modifierKeyState):
+        (WebCore::ChromiumDataObject::setModifierKeyState):
+        (ChromiumDataObject):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::modifierKeyState):
+        (WebCore):
+
+2012-05-16  Jer Noble  <jer.noble@apple.com>
+
+        <video> elements with no video tracks report false for webkitSupportsFullscreen.
+        https://bugs.webkit.org/show_bug.cgi?id=86650
+
+        Reviewed by Eric Carlson.
+
+        No new tests; updated media/media-fullscreen-inline.html.
+
+        With the new Full Screen API, the restriction that only video elements with
+        video tracks can enter full screen seems arbitrary. Some media types will
+        occasionally determine they have video tracks long after loadedmetadata, which
+        breaks websites who check for webkitSupportsFullscreen(). Relax the restriction
+        on webkitSupportsFullscreen() for ports where the Full Screen API is enabled and
+        supported so as to no longer require hasVideo().
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen):
+
+2012-05-16  Andreas Kling  <kling@webkit.org>
+
+        Avoid reparsing the style attribute when cloning elements.
+        <http://webkit.org/b/86574>
+
+        Reviewed by Antti Koivisto.
+
+        Refactor cloning of attributes a bit to dodge the styleAttr reparse previously
+        caused by ElementAttributeData::setAttributes().
+
+        Introduced Element::cloneDataFromElement() which takes care of cloning the
+        ElementAttributeData as well as "non-attribute properties" (which is currently
+        specific to HTMLInputElement.)
+
+        Also includes some additional dodging of attribute vector traversal to find
+        old/new 'id' and 'name' attributes.
+
+        I'm seeing a ~10% improvement on PerformanceTests/DOM/CloneNodes locally.
+
+        * dom/Document.cpp:
+        (WebCore::Document::importNode):
+        * dom/Element.cpp:
+        (WebCore::Element::cloneElementWithoutChildren):
+        (WebCore::Element::cloneAttributesFromElement):
+        (WebCore::Element::cloneDataFromElement):
+        * dom/Element.h:
+        (WebCore::Element::copyNonAttributePropertiesFromElement):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::cloneDataFrom):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/Node.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::styleAttributeChanged):
+        (WebCore::StyledElement::parseAttribute):
+        * dom/StyledElement.h:
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+        * html/HTMLElement.cpp:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::copyNonAttributePropertiesFromElement):
+        * html/HTMLInputElement.h:
+        * inspector/DOMPatchSupport.cpp:
+        (WebCore::DOMPatchSupport::innerPatchNode):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setNodeName):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree):
+        (WebCore::SVGUseElement::transferUseAttributesToReplacedElement):
+
+2012-05-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Unreviewed build change after r115385.  Several Cairo
+        image routines were modified to use new wrapper classes, but the
+        relevant WinCairo sources were not updated to match.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::create):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+        * platform/win/DragImageCairoWin.cpp:
+        (WebCore::createDragImageFromImage):
+
+2012-05-16  Tim Horton  <timothy_horton@apple.com>
+
+        Scrollbar layers should respect accelerated drawing setting
+        https://bugs.webkit.org/show_bug.cgi?id=86644
+        <rdar://problem/11462038>
+
+        Reviewed by Simon Fraser.
+
+        When creating scrollbar layers, pass through the accelerated drawing setting.
+
+        No new tests.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
+
+2012-05-16  Tim Horton  <timothy_horton@apple.com>
+
+        FrameView::scrollContentsFastPath should use painted area to determine whether to drop out of the fast path
+        https://bugs.webkit.org/show_bug.cgi?id=86651
+        <rdar://problem/11459243>
+
+        Reviewed by Simon Fraser.
+
+        Previously, we decided to fall out of the fast scrolling path by the number of fixed-position elements
+        on the page. This was less than ideal if a single fixed position element took up a significant portion
+        of the page, or if there were many small, cheap-to-paint fixed elements.
+
+        Instead, we should use the fast path if less than 50% of the page will be repainted by fixed-position
+        elements, and otherwise fall back to the slow path.
+
+        I've tested a few different thresholds with an internal test; 50% seems to work relatively well,
+        but the ideal value is hard to determine and likely depends on hardware.
+
+        No new tests, performance improvement with few large fixed-position objects or many small ones.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+
+2012-05-16  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Use ThrottledTextureUploader with threaded compositing.
+        https://bugs.webkit.org/show_bug.cgi?id=85848
+
+        Reviewed by Adrienne Walker.
+
+        Switch to ThrottledUploader in CCThreadProxy.
+
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+
+2012-05-15  Emil A Eklund  <eae@chromium.org>
+
+        Change ascents and descent back to ints for now
+        https://bugs.webkit.org/show_bug.cgi?id=86518
+
+        Reviewed by Eric Seidel.
+
+        Change ascents and descent calculation back to integers for now as it
+        looks like we'll need to support both the 1/60 and 1/1 implementations of
+        FractionalLayoutUnit for the immediate future to ensure that text is
+        rendered at the same offset and with the height regardless of the
+        ENABLE_SUBPIXEL_LAYOUT flag.
+
+        This ensures that most websites will look the same at 100% zoom
+        regardless of the flag and also allows us to the same test expectations
+        for the vast majority of layout tests.
+
+        Eventually we want to move those back to FractionalLayoutUnits as that
+        will result in more correct rendering.
+
+        No new tests, no change in functionality.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::setAscentAndDescent):
+        (WebCore::RootInlineBox::ascentAndDescentForBox):
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
+
+2012-05-16  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash due to first-letter not getting computed on RenderTableCell
+        https://bugs.webkit.org/show_bug.cgi?id=86133
+
+        Reviewed by Abhishek Arya.
+
+        RenderTableCell overrides RenderBlock::layout() but doesn't call
+        updateFirstLetter() in it. This is normally not a problem because
+        updateFirstLetter() gets called during preferred logical width
+        computation, but there exist rare occasions when layout of the table
+        cell happens without preferred logical widths being dirty, in which
+        case the first-letter update can be skipped.
+
+        This patch adds a call to updateFirstLetter() to
+        RenderTableCell::layout(). This ensures that the first-letter is up
+        to date before commencing block layout.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::layout)
+
+2012-05-16  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Avoid jumpscroll when entering new text in a multi-line editor.
+        https://bugs.webkit.org/show_bug.cgi?id=82875
+
+        Reviewed by Ryosuke Niwa.
+
+        Scroll caret to the edge of the viewport in case if a line break or a paragraph
+        separator is inserted at the end of a multi-line editor.  This avoids
+        undesirable jumpscroll in cases when there is content under the editor.
+
+        Tests: editing/input/scroll-to-edge-if-line-break-at-end-of-document-contenteditable.html
+               editing/input/scroll-to-edge-if-line-break-at-end-of-document-textarea.html
+               editing/input/scroll-to-edge-if-paragraph-separator-at-end-of-document-contenteditable.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insertLineBreak):
+        (WebCore::Editor::insertParagraphSeparator):
+        (WebCore::Editor::revealSelectionAfterEditingOperation):
+        * editing/Editor.h:
+        (Editor):
+
+2012-05-16  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Pressing esc after requesting snippet creation should remove snippet.
+        https://bugs.webkit.org/show_bug.cgi?id=86639
+
+        Reviewed by Pavel Feldman.
+
+        Added committed parameter to NavigatorView.rename() callback.
+
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorView.prototype.rename.commitHandler):
+        (WebInspector.NavigatorView.prototype.rename.cancelHandler):
+        (WebInspector.NavigatorView.prototype.rename.afterEditing):
+        * inspector/front-end/ScriptsNavigator.js:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested.callback):
+        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested):
+
+2012-05-16  Abhishek Arya  <inferno@chromium.org>
+
+        Missing RenderApplet cast check in HTMLAppletElement::renderWidgetForJSBindings.
+        https://bugs.webkit.org/show_bug.cgi?id=86627
+
+        Reviewed by Andreas Kling.
+
+        Test: java/inline-applet-crash.html
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+
+2012-05-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: extract CompositeUISourceCodeProvider from DebuggerScriptMapping.
+        https://bugs.webkit.org/show_bug.cgi?id=86634
+
+        Reviewed by Vsevolod Vlasov.
+
+        Extract refactoring.
+
+        * inspector/front-end/DebuggerScriptMapping.js:
+        (WebInspector.DebuggerScriptMapping):
+        (WebInspector.DebuggerScriptMapping.prototype.uiSourceCodeProviders):
+        (WebInspector.DebuggerScriptMapping.prototype._parsedScriptSource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._loadUISourceCodes):
+        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
+        (WebInspector.CompositeUISourceCodeProvider):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._registerUISourceCodeProvider):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeAdded):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeReplaced):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeRemoved):
+        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodes):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCodeProvider.prototype.uiSourceCodes):
+        (WebInspector.UISourceCodeProvider.prototype.addEventListener):
+        (WebInspector.UISourceCodeProvider.prototype.removeEventListener):
+
+2012-05-16  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Double Clicking on "No watch expressions" should add an expression
+        https://bugs.webkit.org/show_bug.cgi?id=86631
+
+        Reviewed by Vsevolod Vlasov.
+
+        A double-click listener for the section element adds a new watch expression if the correct element
+        has been clicked.
+        Drive-by: do not persist deleted (null) watch expressions.
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype._sectionDoubleClick):
+        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
+
+2012-05-16  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Support script snippets saving.
+        https://bugs.webkit.org/show_bug.cgi?id=86632
+
+        Reviewed by Pavel Feldman.
+
+        Added SnippetJavaScriptSource extending JavaScriptSource and overriding isEditable() and commitWorkingCopy() methods.
+        ScriptSnippetModel now creates instances of this new class for snippets.
+        Also maps in ScriptSnippetModel simplified.
+
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource.prototype.commitWorkingCopy):
+        (WebInspector):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel):
+        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype.deleteScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype.renameScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype.setScriptSnippetContent):
+        (WebInspector.ScriptSnippetModel.prototype._uiSourceCodeList):
+        (WebInspector.ScriptSnippetModel.prototype._releasedUISourceCodes):
+        (WebInspector.SnippetJavaScriptSource):
+        (WebInspector.SnippetJavaScriptSource.prototype.isEditable):
+        (WebInspector.SnippetJavaScriptSource.prototype.commitWorkingCopy):
+        (WebInspector.SnippetJavaScriptSource.prototype.get snippetId):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.set _fileRenamed):
+        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested.callback):
+        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested):
+
+2012-05-16  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [EFL] Memory leak in RenderThemeEfl
+        https://bugs.webkit.org/show_bug.cgi?id=86609
+
+        Reviewed by Martin Robinson.
+
+        Fix a memory leak by freeing the cairo surface with
+        cairo_surface_destroy.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::cacheThemePartFlush):
+
+2012-05-16  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Speedup heap snapshot postprocessing
+        https://bugs.webkit.org/show_bug.cgi?id=86635
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):
+
+2012-05-16  Alexander Pavlov  <apavlov@chromium.org>
+
+        Unreviewed, followup for r117273 that fixes the Web Inspector's Computed Style pane layout.
+
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section.computed-style.expanded .properties > li):
+        (.styles-section.computed-style.expanded .properties > li .webkit-css-property):
+
+2012-05-16  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [Extensions API] expose evaluateOptions in audit formatters
+        https://bugs.webkit.org/show_bug.cgi?id=86617
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/extensions/extensions-audits-content-script.html
+
+        - apply extension-specific audit formatters earlier (in ExtensionAduitCategory, not along with the rest in AuditFormatters);
+        - use ExtensionServer.evaluate() to handle evaluateOptions instead of PageAgent.evaluate();
+
+        * inspector/front-end/AuditFormatters.js: Move node and object formatters to ExtensionAuditCategory.
+        (WebInspector.partiallyApplyFormatters): Added a method to traverse formatters tree and apply formatters that are passed as input.
+        * inspector/front-end/ExtensionAuditCategory.js:
+        (WebInspector.ExtensionAuditCategory): Pass extensionOrigin.
+        (WebInspector.ExtensionAuditCategoryResults.prototype._addNode): Apply extensions formatters before adding the result.
+        (WebInspector.ExtensionAuditCategoryResults.prototype._addResult):
+        (WebInspector.ExtensionAuditCategoryResults.prototype.evaluate): moved from AuditFormatters.
+        (WebInspector.ExtensionAuditFormatters.object.onEvaluate):
+        (WebInspector.ExtensionAuditFormatters.object):
+        (WebInspector.ExtensionAuditFormatters.node.onNodeAvailable):
+        (WebInspector.ExtensionAuditFormatters.node.onEvaluate):
+        (WebInspector.ExtensionAuditFormatters.node):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onAddAuditCategory): Plumb extensionOrigin through to audit category.
+
+2012-05-16  Donald Carr  <donald.carr@nokia.com>
+
+        Fixes the build with Qt 5 HEAD
+
+        Reviewed by Csaba Osztrogonác.
+
+        * WebCore.pri:
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+
+2012-05-16  Rob Buis  <rbuis@rim.com>
+
+        SVGSVGElement checkIntersection and checkEnclosure Mem corruption
+        https://bugs.webkit.org/show_bug.cgi?id=67923
+
+        Reviewed by Nikolas Zimmermann.
+
+        Only call checkIntersection/checkEnclosure when we have a valid renderer.
+
+        Test: svg/custom/intersection-list-null.svg
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::checkIntersection):
+        (WebCore::SVGSVGElement::checkEnclosure):
+
+2012-05-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed, rolling out r110699.
+        http://trac.webkit.org/changeset/110699
+        https://bugs.webkit.org/show_bug.cgi?id=80982
+
+        Not needed anymore and broke modal event loops
+
+        * platform/qt/RunLoopQt.cpp:
+        (WebCore::RunLoop::TimerObject::TimerObject):
+        (WebCore::RunLoop::TimerObject::performWork):
+        (RunLoop::TimerObject):
+
+2012-05-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: split ScriptMapping into UISourceCodeProvider and SourceMapping.
+        https://bugs.webkit.org/show_bug.cgi?id=86616
+
+        Reviewed by Vsevolod Vlasov.
+
+        This change simply splits the interface.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/CompilerScriptMapping.js:
+        (WebInspector.CompilerScriptMapping.prototype.get uiSourceCodes):
+        (WebInspector.CompilerScriptMapping.prototype.reset):
+        * inspector/front-end/DebuggerModel.js:
+        * inspector/front-end/DebuggerResourceBinding.js:
+        (WebInspector.DebuggerResourceBinding):
+        (WebInspector.DebuggerResourceBinding.prototype._uiSourceCodeForResource):
+        * inspector/front-end/DebuggerScriptMapping.js:
+        (WebInspector.DebuggerScriptMapping):
+        (WebInspector.DebuggerScriptMapping.prototype.uiSourceCodes):
+        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeAdded):
+        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeReplaced):
+        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeRemoved):
+        * inspector/front-end/FilteredItemSelectionDialog.js:
+        (WebInspector.OpenScriptDialog):
+        (WebInspector.OpenScriptDialog.install):
+        (WebInspector.OpenScriptDialog._show):
+        * inspector/front-end/PresentationConsoleMessageHelper.js:
+        (WebInspector.PresentationConsoleMessageHelper):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._consoleCleared):
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype.uiSourceCodes):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAdded):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeReplaced):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
+        * inspector/front-end/Script.js:
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype._uiSourceCodes):
+        (WebInspector.SnippetScriptMapping.prototype.uiSourceCodes):
+        (WebInspector.SnippetScriptMapping.prototype._fireUISourceCodeAdded):
+        (WebInspector.SnippetScriptMapping.prototype._fireUISourceCodeRemoved):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchScope):
+        (WebInspector.ScriptsSearchScope.prototype._sortedUISourceCodes):
+        * inspector/front-end/SourceMapping.js: Renamed from Source/WebCore/inspector/front-end/ScriptMapping.js.
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCodeProvider):
+        (WebInspector.UISourceCodeProvider.prototype.uiSourceCodes):
+        (WebInspector.UILocation):
+        (WebInspector.UILocation.prototype.uiLocationToRawLocation):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-05-16  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Implement snippet creation/renaming in ScriptsNavigator.
+        https://bugs.webkit.org/show_bug.cgi?id=82622
+
+        Reviewed by Pavel Feldman.
+
+        Implemented snippet creation and renaming.
+        Added TitleChanged event to UISourceCode.
+
+        * inspector/front-end/NavigatorOverlayController.js:
+        (WebInspector.NavigatorOverlayController.prototype._containingElementFocused):
+        (WebInspector.NavigatorOverlayController.prototype.isNavigatorPinned):
+        (WebInspector.NavigatorOverlayController.prototype.isNavigatorHidden):
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorView.prototype._uiSourceCodeTitleChanged):
+        (WebInspector.NavigatorView.prototype._updateScriptTitle):
+        (WebInspector.NavigatorView.prototype._addUISourceCodeListeners):
+        (WebInspector.NavigatorView.prototype._removeUISourceCodeListeners):
+        (WebInspector.NavigatorView.prototype._fileRenamed):
+        (WebInspector.NavigatorScriptTreeElement.prototype.onattach):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator):
+        (WebInspector.ScriptsNavigator.prototype._snippetsNavigatorViewForUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype.addUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype.isScriptSourceAdded):
+        (WebInspector.ScriptsNavigator.prototype.revealUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype.replaceUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype.rename):
+        (WebInspector.ScriptsNavigator.prototype._fileRenamed):
+        (WebInspector.ScriptsNavigator.prototype._snippetCreationRequested):
+        (WebInspector.SnippetsNavigatorView.prototype._handleCreateSnippet):
+        (WebInspector.SnippetsNavigatorView.prototype._snippetCreationRequested):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.set _hideDebuggerSidebar):
+        (WebInspector.ScriptsPanel.prototype.set _fileRenamed):
+        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested.callback):
+        (WebInspector.ScriptsPanel.prototype._snippetCreationRequested):
+        * inspector/front-end/TabbedEditorContainer.js:
+        (WebInspector.TabbedEditorContainer.prototype._appendFileTab):
+        (WebInspector.TabbedEditorContainer.prototype._tabClosed):
+        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeTitleChanged):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype.urlChanged):
+
+2012-05-16  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: gradient properties are painful to inspect / author.
+        https://bugs.webkit.org/show_bug.cgi?id=86379
+
+        Reviewed by Pavel Feldman.
+
+        The CSS styles layout has been changed to allow property values to wrap onto subsequent lines
+        to let the users see the entire value text.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.): Avoid line breaks between the color swatch and value.
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section .properties li.not-parsed-ok img.exclamation-mark):
+        (.styles-section .properties li):
+        (.styles-section .properties li .webkit-css-property):
+        (.styles-section.expanded .properties > li):
+        (.styles-section .properties > li .webkit-css-property):
+        (.styles-section .properties > li.child-editing):
+        (.styles-section .properties > li.child-editing .webkit-css-property):
+        (.styles-section .properties .enabled-button):
+
+2012-05-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: rename ProfileView.js to CPUProfileView.js
+        https://bugs.webkit.org/show_bug.cgi?id=86612
+
+        Reviewed by Pavel Feldman.
+
+        Renamed ProfileView.js to CPUProfileView.js to match the file content.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/CPUProfileView.js: Renamed from Source/WebCore/inspector/front-end/ProfileView.js.
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView.prototype.get statusBarItems):
+        (WebInspector.CPUProfileView.prototype.get profile):
+        (WebInspector.CPUProfileView.prototype.set profile):
+        (WebInspector.CPUProfileView.prototype.get bottomUpProfileDataGridTree):
+        (WebInspector.CPUProfileView.prototype.get topDownProfileDataGridTree):
+        (WebInspector.CPUProfileView.prototype.get currentTree):
+        (WebInspector.CPUProfileView.prototype.set currentTree):
+        (WebInspector.CPUProfileView.prototype.willHide):
+        (WebInspector.CPUProfileView.prototype.refresh):
+        (WebInspector.CPUProfileView.prototype.refreshVisibleData):
+        (WebInspector.CPUProfileView.prototype.refreshShowAsPercents):
+        (WebInspector.CPUProfileView.prototype.searchCanceled):
+        (WebInspector.CPUProfileView.prototype.performSearch.matchesQuery):
+        (WebInspector.CPUProfileView.prototype.performSearch):
+        (WebInspector.CPUProfileView.prototype.jumpToFirstSearchResult):
+        (WebInspector.CPUProfileView.prototype.jumpToLastSearchResult):
+        (WebInspector.CPUProfileView.prototype.jumpToNextSearchResult):
+        (WebInspector.CPUProfileView.prototype.jumpToPreviousSearchResult):
+        (WebInspector.CPUProfileView.prototype.showingFirstSearchResult):
+        (WebInspector.CPUProfileView.prototype.showingLastSearchResult):
+        (WebInspector.CPUProfileView.prototype._jumpToSearchResult):
+        (WebInspector.CPUProfileView.prototype._changeView.set else):
+        (WebInspector.CPUProfileView.prototype._focusClicked):
+        (WebInspector.CPUProfileView.prototype._excludeClicked):
+        (WebInspector.CPUProfileView.prototype._resetClicked):
+        (WebInspector.CPUProfileView.prototype._dataGridNodeSelected):
+        (WebInspector.CPUProfileView.prototype._dataGridNodeDeselected):
+        (WebInspector.CPUProfileView.prototype._sortProfile):
+        (WebInspector.CPUProfileView.prototype._assignParentsInProfile):
+        (WebInspector.CPUProfileType):
+        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        (WebInspector.CPUProfileType.prototype.get treeItemTitle):
+        (WebInspector.CPUProfileType.prototype.get description):
+        (WebInspector.CPUProfileType.prototype.isRecordingProfile):
+        (WebInspector.CPUProfileType.prototype.startRecordingProfile):
+        (WebInspector.CPUProfileType.prototype.stopRecordingProfile):
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.CPUProfileType.prototype.createView):
+        (WebInspector.CPUProfileType.prototype.createTemporaryProfile):
+        (WebInspector.CPUProfileType.prototype.createProfile):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype.performSearch.matchesByName):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-05-16  Arpita Bahuguna  <arpitabahuguna@gmail.com>
+
+        "border: collapse" + "display: none" rows in the tbody while having thead or tfoot doesn't render the opposite border
+        https://bugs.webkit.org/show_bug.cgi?id=67877
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/css/table-collapsed-borders.html
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::computeCollapsedBeforeBorder):
+        When getting the previous row group's after border, pass SkipEmptySections as the second param
+        to the RenderTable::sectionAbove() call. Thus if the currSection is the top most section of the
+        table passing SkipEmptySections to sectionAbove() would return null which should be the expected
+        behavior.
+
+        (WebCore::RenderTableCell::computeCollapsedAfterBorder):
+        When getting the following row group's before border, pass SkipEmptySections as the second param
+        to the RenderTable::sectionBelow() call. Thus if the currSection is the bottom most section of the
+        table passing SkipEmptySections to sectionBelow() would return null which should be the expected
+        behavior.
+
+2012-05-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: follow up to r117267 - fixing typo and removing unnecessary dispatch.
+        https://bugs.webkit.org/show_bug.cgi?id=86613
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAdded):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeReplaced):
+
+2012-05-16  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Move edit/save script source logic to JavaScriptSource.
+        https://bugs.webkit.org/show_bug.cgi?id=86604
+
+        Reviewed by Pavel Feldman.
+
+        Added working copy notion to UISourceCode.
+        Moved DebuggerResourceBinding content edit calls to JavaScriptSource.
+        Added WorkingCopyChanged event to UISourceCode.
+
+        * inspector/front-end/CompilerScriptMapping.js:
+        * inspector/front-end/DebuggerResourceBinding.js:
+        (WebInspector.DebuggerResourceBinding.prototype.canSetContent):
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource):
+        (WebInspector.JavaScriptSource.prototype.breakpointStorageId):
+        (WebInspector.JavaScriptSource.prototype.isEditable):
+        (WebInspector.JavaScriptSource.prototype.commitWorkingCopy):
+        (WebInspector):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.wasShown):
+        (WebInspector.JavaScriptSourceFrame.prototype.canEditSource):
+        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
+        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorView.prototype._uiSourceCodeWorkingCopyChanged):
+        (WebInspector.NavigatorView.prototype._uiSourceCodeContentChanged):
+        (WebInspector.NavigatorView.prototype._updateScriptTitle):
+        (WebInspector.NavigatorView.prototype._removeUISourceCode):
+        (WebInspector.NavigatorView.prototype._addUISourceCodeListeners):
+        (WebInspector.NavigatorView.prototype._removeUISourceCodeListeners):
+        (WebInspector.NavigatorView.prototype.reset):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype._createUISourceCode):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/TabbedEditorContainer.js:
+        (WebInspector.TabbedEditorContainer):
+        (WebInspector.TabbedEditorContainer.prototype._titleForFile):
+        (WebInspector.TabbedEditorContainer.prototype._appendFileTab):
+        (WebInspector.TabbedEditorContainer.prototype._tabClosed):
+        (WebInspector.TabbedEditorContainer.prototype._updateFileTitle.get if):
+        (WebInspector.TabbedEditorContainer.prototype._updateFileTitle):
+        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeWorkingCopyChanged):
+        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeContentChanged):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode):
+        (WebInspector.UISourceCode.prototype.contentChanged):
+        (WebInspector.UISourceCode.prototype.isEditable):
+        (WebInspector.UISourceCode.prototype.workingCopy):
+        (WebInspector.UISourceCode.prototype.setWorkingCopy):
+        (WebInspector.UISourceCode.prototype.isDirty):
+        (WebInspector.UISourceCode.prototype.commitWorkingCopy):
+
+2012-05-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: get rid of UISourceCodeListChanged event.
+        https://bugs.webkit.org/show_bug.cgi?id=86601
+
+        Reviewed by Vsevolod Vlasov.
+
+        There was unnecessary conversion between this event and UISourceCodeAdded/Removed/Replaced.
+
+        * inspector/front-end/CompilerScriptMapping.js:
+        (WebInspector.CompilerScriptMapping.prototype.reset):
+        * inspector/front-end/DebuggerScriptMapping.js:
+        (WebInspector.DebuggerScriptMapping):
+        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeAdded):
+        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeReplaced):
+        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeRemoved):
+        * inspector/front-end/NavigatorView.js:
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype.addScript):
+        (WebInspector.ResourceScriptMapping.prototype._handleUISourceCodeChanged):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAdded):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeReplaced):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
+        (WebInspector.ResourceScriptMapping.prototype.reset):
+        * inspector/front-end/ScriptMapping.js:
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
+        (WebInspector.ScriptSnippetModel.prototype._reset):
+        (WebInspector.SnippetScriptMapping.prototype._fireUISourceCodeAdded):
+        (WebInspector.SnippetScriptMapping.prototype._fireUISourceCodeRemoved):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator.prototype.replaceUISourceCode):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeReplaced):
+        * inspector/front-end/TabbedEditorContainer.js:
+
+2012-05-16  Keishi Hattori  <keishi@webkit.org>
+
+        [chromium] Add WebKit API to access inner text value of input element
+        https://bugs.webkit.org/show_bug.cgi?id=85353
+
+        Reviewed by Kent Tamura.
+
+        Test: fast/forms/editing-value.html
+
+        We need this to implement the datalist UI for  <input type=email multiple>.
+        HTMLInputElement.value gives you the sanitized value so the whitespace between values are trimmed.
+        We need to append the selected suggestion to the end without modifying the rest of the text.
+
+        * WebCore.exp.in: Added HTMLInputElement::setEditingValue
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setEditingValue):
+        (WebCore):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setEditingValue):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-05-16  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry] Cookies should be checked during parsing to improve performance.
+        https://bugs.webkit.org/show_bug.cgi?id=85028
+
+        Reviewed by George Staikos.
+
+        We shouldn't waste time and memery on invalid cookies. It is better to drop them during parsing.
+        We shouldn't check the default domain since it is set with host. So we only check domains which are parsed
+        from response headers.
+
+        No new tests. No functionality change.
+
+        * platform/blackberry/CookieManager.cpp:
+        (WebCore::CookieManager::setCookies):
+        * platform/blackberry/CookieManager.h:
+        * platform/blackberry/CookieParser.cpp:
+        (WebCore::CookieParser::parseOneCookie):
+
+2012-05-15  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Enable SVG Fonts by default
+        https://bugs.webkit.org/show_bug.cgi?id=86463
+
+        Reviewed by Nikolas Zimmermann.
+
+        Another feature we can get for free after switching to using
+        the font fast path with QRawFont.
+        It will get disabled in features.prf if either SVG support is
+        disabled or if we are not using QRawFont (e.g. for Qt 4).
+
+        Covered by a series of tests that were skipped for the
+        Qt port up until now.
+
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformDataPrivate::FontPlatformDataPrivate):
+        Initialize the platform data used as fallback in conjunction with SVG
+        fonts so it will honor size, weight and oblique-ness.
+        * rendering/svg/SVGTextMetricsBuilder.cpp: Avoid forcing the complex path.
+        (WebCore::SVGTextMetricsBuilder::advance):
+        (WebCore::SVGTextMetricsBuilder::advanceSimpleText):
+        (WebCore::SVGTextMetricsBuilder::initializeMeasurementWithTextRenderer):
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::ensureGlyphCache): avoid ambiguity with String(const QString&)
+
+2012-05-16  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] WebTransformationMatrixTest.verifyDefaultConstructorCreatesIdentityMatrix is failing
+        https://bugs.webkit.org/show_bug.cgi?id=86589
+
+        Reviewed by Kent Tamura.
+
+        Need to call m_private.reset(0) before destructing WebTransformationMatrix objects.
+
+        No new tests. WebTransformationMatrixTest should pass on debug build.
+
+        * platform/chromium/support/WebTransformationMatrix.cpp:
+        (WebKit::WebTransformationMatrix::~WebTransformationMatrix):
+        (WebKit):
+
+2012-05-16  Shinya Kawanaka  <shinyak@chromium.org>
+
+        ShadowRoot.selection should return the seleciton whose range is in a shadow tree.
+        https://bugs.webkit.org/show_bug.cgi?id=82698
+
+        Reviewed by Ryosuke Niwa.
+
+        The selection object returned from shadowRoot.selection should be able to see
+        the inner object of the shadowRoot.
+
+        In the previous code, the node out of the shadow subtree was returned for
+        anchorNode, focusNode, baseNode, and extentNode. This patch enables us to get
+        the corresponding shadow ancestor in the specified TreeScope (m_treeScope).
+
+        Tests: editing/shadow/selection-of-orphan-shadowroot.html
+               editing/shadow/selection-of-shadowroot.html
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::selection):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::getSelection): When shadow DOM feature is not enabled, we want to use the same
+        instance of DOMSelection among Document and ShadowRoot.
+        * dom/TreeScopeAdjuster.cpp:
+        (WebCore::TreeScopeAdjuster::TreeScopeAdjuster):
+        (WebCore::TreeScopeAdjuster::ancestorInThisScope): Since node could be null, I've added a node check code.
+        * dom/TreeScopeAdjuster.h:
+        (TreeScopeAdjuster):
+        (WebCore::TreeScopeAdjuster::treeScope):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::anchorNode):
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusNode):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::baseNode):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::extentNode):
+        (WebCore::DOMSelection::extentOffset):
+        (WebCore::DOMSelection::shadowAdjustedNode): Gets the corresponding node in the m_treeScope from the Position.
+        (WebCore):
+        (WebCore::DOMSelection::shadowAdjustedOffset): Gets the corresponding node offset in the m_treeScope from the Position.
+        * page/DOMSelection.h:
+        (WebCore):
+        (DOMSelection):
+
+2012-05-16  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry] xhr request to non existent file response is 0 and not 404.
+        https://bugs.webkit.org/show_bug.cgi?id=86344
+
+        Reviewed by George Staikos.
+
+        NetworkJob receives 404 for a XMLHttpRequest which calls open("HEAD", "notExist.html", true).
+        There are no data received because its method is HEAD.
+        This case should not be treated as a failure.
+
+        Add shouldNotifyClientFailed() to treat XMLHttpRequest as a special case.
+        XMLHttpRequest will fail when status code is smaller than zero.
+
+        If we use "GET" and receive 404 without body, NetworkJob won't go through failing code path, too.
+        So add http/tests/xmlhttprequest/xmlhttprequest-check-get-readystate-for-404-without-body.html
+        to check this case.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-check-head-readystate-for-404.html
+              http/tests/xmlhttprequest/xmlhttprequest-check-get-readystate-for-404-without-body.html
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::sendResponseIfNeeded):
+
+2012-05-16  MORITA Hajime  <morrita@google.com>
+
+        HasCustomWillOrDidRecalcStyleFlag and family should live in a bit.
+        https://bugs.webkit.org/show_bug.cgi?id=86175
+
+        Reviewed by Ryosuke Niwa.
+
+        This change unifies following flags into one HasCustomCallbacksFlag.
+        - HasCustomWillOrDidRecalcStyleFlag
+        - HasCustomStyleForRendererFlag
+        - IsFrameOwnerElementFlag
+
+        By this change, some callbacks can be called even if there are no override.
+        So all custom callbacks should just pass these invocations.
+
+        No new tests. No behavior change.
+
+        * dom/ContainerNodeAlgorithms.h:
+        (WebCore::ChildFrameDisconnector::collectDescendant):
+        * dom/Element.cpp:
+        (WebCore::Element::styleForRenderer):
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::willRecalcStyle):
+        (WebCore):
+        (WebCore::Element::didRecalcStyle):
+        (WebCore::Element::customStyleForRenderer):
+        * dom/Element.h:
+        (Element):
+        * dom/Node.h:
+        (WebCore::Node::isFrameOwnerElement):
+        (WebCore::Node::hasCustomCallbacks):
+        (WebCore::Node::setHasCustomCallbacks):
+        * dom/Text.cpp:
+        (WebCore::Text::recalcTextStyle):
+        (WebCore::Text::willRecalcTextStyle):
+        (WebCore):
+        * dom/Text.h:
+        (Text):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::disconnectContentFrame):
+        * html/HTMLFrameOwnerElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::HTMLFrameSetElement):
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::HTMLIFrameElement):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
+        (WebCore::HTMLPlugInImageElement::documentWillSuspendForPageCache):
+        (WebCore::HTMLPlugInImageElement::documentDidResumeFromPageCache):
+        (WebCore::HTMLPlugInImageElement::customStyleForRenderer):
+        * html/HTMLPlugInImageElement.h:
+        (HTMLPlugInImageElement):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::TextControlInnerElement):
+        (WebCore::TextControlInnerElement::customStyleForRenderer):
+        (WebCore::TextControlInnerTextElement::TextControlInnerTextElement):
+        (WebCore::TextControlInnerTextElement::customStyleForRenderer):
+        * html/shadow/TextControlInnerElements.h:
+        (TextControlInnerElement):
+        (TextControlInnerTextElement):
+        * html/shadow/TextFieldDecorationElement.cpp:
+        (WebCore::TextFieldDecorationElement::TextFieldDecorationElement):
+        (WebCore::TextFieldDecorationElement::customStyleForRenderer):
+        * html/shadow/TextFieldDecorationElement.h:
+        (TextFieldDecorationElement):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::SVGElement):
+        (WebCore::SVGElement::customStyleForRenderer):
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGShadowText::SVGShadowText):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+
+2012-05-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: exception when switching to heap profiler comparison view
+        https://bugs.webkit.org/show_bug.cgi?id=86224
+
+        Reviewed by Pavel Feldman.
+
+        Make sure the messages are dispatched in the same order as they are sent in
+        case a fake worker is used for heap snapshot processing.
+
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.AsyncTaskQueue):
+        (WebInspector.AsyncTaskQueue.prototype.addTask):
+        (WebInspector.AsyncTaskQueue.prototype._onTimeout):
+        (WebInspector.AsyncTaskQueue.prototype._scheduleTimer):
+        (WebInspector.HeapSnapshotFakeWorker):
+        (WebInspector.HeapSnapshotFakeWorker.prototype.postMessage):
+        (WebInspector.HeapSnapshotFakeWorker.prototype._postMessageFromWorker):
+
+2012-05-16  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL] PlatformKeyboardEvent: figures, letters and printscreen key handling
+        https://bugs.webkit.org/show_bug.cgi?id=85503
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * platform/efl/EflKeyboardUtilities.cpp:
+        (WebCore::addCharactersToKeyMap): aux function
+        (WebCore):
+        (WebCore::createKeyMap): Figures and letters keys are added to the keyMap
+        (WebCore::addCharactersToWinKeyMap): aux function
+        (WebCore::createWindowsKeyMap): Capital letters keys are added to the windowsKeyMap. Corrected value for printscreen key.
+        (WebCore::singleCharacterString): Return empty text for printscreen key.
+
+2012-05-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: rename DebuggerPresentationModel to DebuggerScriptMapping, make it private to ScriptsPanel.
+        https://bugs.webkit.org/show_bug.cgi?id=86594
+
+        Reviewed by Vsevolod Vlasov.
+
+        This change completes the elimination of the presentation model.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/AuditFormatters.js:
+        (WebInspector.AuditFormatters.resourceLink):
+        * inspector/front-end/DebuggerResourceBinding.js:
+        (WebInspector.DebuggerResourceBinding):
+        (WebInspector.DebuggerResourceBinding.prototype._uiSourceCodeForResource):
+        * inspector/front-end/DebuggerScriptMapping.js: Renamed from Source/WebCore/inspector/front-end/DebuggerPresentationModel.js.
+        (WebInspector.DebuggerScriptMapping):
+        (WebInspector.DebuggerScriptMapping.prototype._handleUISourceCodeListChanged):
+        * inspector/front-end/FilteredItemSelectionDialog.js:
+        (WebInspector.OpenScriptDialog):
+        (WebInspector.OpenScriptDialog.install):
+        (WebInspector.OpenScriptDialog._show):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame):
+        * inspector/front-end/PresentationConsoleMessageHelper.js:
+        (WebInspector.PresentationConsoleMessageHelper):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._consoleCleared):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._loadUISourceCodes):
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchScope):
+        (WebInspector.ScriptsSearchScope.prototype._sortedUISourceCodes):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCodeProject):
+        (WebInspector.UISourceCodeProject.prototype.uiSourceCodes):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2012-05-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: use separate fields for storing HeapSnapshotLoaderProxy and HeapSnapshotProxy
+        https://bugs.webkit.org/show_bug.cgi?id=86488
+
+        Reviewed by Pavel Feldman.
+
+        Simplified heap profiler snapshot loading code. Introduced dedicated fields for
+        snapshot loader proxy and for snapshot proxy.
+
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.HeapSnapshotWorker):
+        (WebInspector.HeapSnapshotLoaderProxy):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading.updateStaticData):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading.callLoadCallbacks):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.get loaded):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.startLoading):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.pushJSONChunk):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.profileCallback):
+        (WebInspector.HeapSnapshotView):
+        (WebInspector.HeapSnapshotView.prototype.dispose):
+        (WebInspector.HeapSnapshotView.prototype.get baseProfileWrapper):
+        (WebInspector.HeapSnapshotView.prototype.wasShown.profileCallback1):
+        (WebInspector.HeapSnapshotView.prototype._changeView):
+        (WebInspector.HeapProfileHeader): split _proxy field into _loaderProxy and _snapshotProxy
+        (WebInspector.HeapProfileHeader.prototype.snapshotProxy):
+        (WebInspector.HeapProfileHeader.prototype.load):
+        (WebInspector.HeapProfileHeader.prototype._setupWorker):
+        (WebInspector.HeapProfileHeader.prototype.dispose):
+        (WebInspector.HeapProfileHeader.prototype._saveStatusUpdate):
+        (WebInspector.HeapProfileHeader.prototype.pushJSONChunk):
+        (WebInspector.HeapProfileHeader.prototype.finishHeapSnapshot):
+        (WebInspector.HeapProfileHeader.prototype.canSaveToFile):
+        (WebInspector.HeapProfileHeader.prototype.loadFromFile.onLoad):
+        (WebInspector.HeapProfileHeader.prototype.loadFromFile):
+
+2012-05-16  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Use CSS columns feature for HelpScreen contents.
+        https://bugs.webkit.org/show_bug.cgi?id=86367
+
+        Reviewed by Yury Semikhatsky.
+
+        Right-docked inspector should show shortcuts/settings in one column.
+        Bottom-docked inspector should use horizontal space more effectively
+        (more than 2 columns in shortcuts/settings).
+
+        Please see attached screenshots.
+
+        UI adjustments, no new tests.
+
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen): Turned table to div.
+        (WebInspector.SettingsScreen.prototype._appendSection): Removed.
+        * inspector/front-end/ShortcutsScreen.js:
+        (WebInspector.ShortcutsScreen.prototype._buildTable): Removed "balancing" algorithm.
+        (WebInspector.ShortcutsSection.prototype.renderSection): Turned table to div.
+        (WebInspector.ShortcutsSection.prototype._renderHeader): Ditto.
+        * inspector/front-end/helpScreen.css: Use CSS columns feature.
+        (.help-container): Added columns container.
+        (.help-block): Added "section".
+        (.help-line): Added key shortcut line.
+        (.help-key-cell): Added key shortcut cell.
+        (.help-cell): Ditto
+        (.help-section-title): Combined title classes
+        (.help-content p): Adjusted spacing.
+
+2012-05-16  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r117050.
+        http://trac.webkit.org/changeset/117050
+        https://bugs.webkit.org/show_bug.cgi?id=86587
+
+        "Some heap profiler tests started timing out" (Requested by
+        yurys on #webkit).
+
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.HeapSnapshotFakeWorker):
+        (WebInspector.HeapSnapshotFakeWorker.prototype.postMessage):
+        (WebInspector.HeapSnapshotFakeWorker.prototype._postMessageFromWorker):
+
+2012-05-16  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r117206.
+        http://trac.webkit.org/changeset/117206
+        https://bugs.webkit.org/show_bug.cgi?id=86583
+
+        breaks chromium browser_tests (Requested by bashi1 on
+        #webkit).
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * loader/archive/mhtml/MHTMLArchive.cpp:
+        (WebCore::MHTMLArchive::create):
+
+2012-05-16  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        REGRESSION(r105057): Infinite loop inside SVGTextLayoutEngine::currentLogicalCharacterMetrics
+        https://bugs.webkit.org/show_bug.cgi?id=83405
+
+        Reviewed by Darin Adler.
+
+        Dynamically adding tspans carrying position information in the x/y/dx/dy/rotate lists is broken.
+        To avoid mistakes like this in future, simplify the calling code in RenderSVGInlineText and centralize
+        the management of all caches (text positioning element cache / metrics map / layout attributes) in
+        RenderSVGText. This avoids the hack in SVGRootInlineBox::computePerCharacterLayoutInformation() which
+        called textRoot->rebuildLayoutAttributes(), which was used to fix previous security issues with this code.
+        Instead correctly handle destruction of RenderSVGInlineText in RenderSVGText, keeping the m_layoutAttributes
+        synchronized with the current state of the render tree. Fixes highcharts problems.
+
+        Tests: svg/text/add-tspan-position-bug.html
+               svg/text/highcharts-assertion.html
+               svg/text/modify-tspan-position-bug.html
+
+        * rendering/svg/RenderSVGBlock.h:
+        (RenderSVGBlock):
+        * rendering/svg/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::addChild):
+        (WebCore::RenderSVGInline::removeChild):
+        * rendering/svg/RenderSVGInline.h:
+        (RenderSVGInline):
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::setTextInternal):
+        (WebCore::RenderSVGInlineText::styleDidChange):
+        * rendering/svg/RenderSVGInlineText.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::RenderSVGText):
+        (WebCore::RenderSVGText::~RenderSVGText):
+        (WebCore::collectLayoutAttributes):
+        (WebCore::RenderSVGText::subtreeChildWasAdded):
+        (WebCore::findPreviousAndNextAttributes):
+        (WebCore::checkLayoutAttributesConsistency):
+        (WebCore::RenderSVGText::willBeDestroyed):
+        (WebCore::RenderSVGText::subtreeChildWillBeRemoved):
+        (WebCore::RenderSVGText::subtreeChildWasRemoved):
+        (WebCore::RenderSVGText::subtreeStyleDidChange):
+        (WebCore::RenderSVGText::subtreeTextDidChange):
+        (WebCore::updateFontInAllDescendants):
+        (WebCore::RenderSVGText::layout):
+        (WebCore::RenderSVGText::addChild):
+        (WebCore::RenderSVGText::removeChild):
+        * rendering/svg/RenderSVGText.h:
+        (RenderSVGText):
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::layoutChildren):
+        * rendering/svg/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
+        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextRenderer):
+        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForWholeTree):
+        (WebCore::SVGTextLayoutAttributesBuilder::rebuildMetricsForTextRenderer):
+        (WebCore::SVGTextLayoutAttributesBuilder::buildCharacterDataMap):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.h:
+        (SVGTextLayoutAttributesBuilder):
+        (WebCore::SVGTextLayoutAttributesBuilder::numberOfTextPositioningElements):
+        * svg/SVGAElement.cpp:
+        * svg/SVGAElement.h:
+        (SVGAElement):
+        * svg/SVGTextContentElement.cpp:
+        * svg/SVGTextContentElement.h:
+        (SVGTextContentElement):
+
+2012-05-15  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in Document::nodeChildrenWillBeRemoved.
+        https://bugs.webkit.org/show_bug.cgi?id=85247
+
+        Reviewed by Hajime Morita.
+
+        Reverse ordering of commands to ref ptr the children set
+        first before calling nodeChildrenWillBeRemoved, since it
+        can fire mutation events.
+
+        Test: fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml
+
+        * dom/ContainerNode.cpp:
+        (WebCore::willRemoveChildren):
+
+2012-05-15  Igor Oliveira  <igor.o@sisa.samsung.com>
+
+        regression(111639): Issue with simultaneous CSS animations
+        https://bugs.webkit.org/show_bug.cgi?id=85929
+
+        Currently, previousTimeToNextService is just saving the previous CompositeAnimation::timeToNextService
+        for AnimationControllerPrivate::updateAnimationTimerForRenderer, however CompositeAnimation::timeToNextService
+        is also called and used by updateAnimationTimer. Make sure we save the existing timeToNextService from
+        both places, updateAnimationTimerForRenderer and updateAnimationTimer.
+
+        Reviewed by Dean Jackson.
+
+        Test: animations/fill-mode-forwards.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimerForRenderer):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        * page/animation/AnimationControllerPrivate.h:
+        (AnimationControllerPrivate):
+
+2012-05-15  Tien-Ren Chen  <trchen@chromium.org>
+
+        [Chromium] CCTimer::isActive() is incorrect inside tick callback
+        https://bugs.webkit.org/show_bug.cgi?id=86513
+
+        This patch implements CCTimer::isActive() by clearing the task pointer
+        when the timer fires.
+
+        Reviewed by James Robinson.
+
+        No new tests. Existing tests updated accordingly.
+
+        * platform/graphics/chromium/cc/CCTimer.cpp:
+        (WebCore::CCTimerTask::performTask):
+        * rendering/RenderLayerBacking.cpp:
+
+2012-05-15  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/JS/JSFloat64Array.cpp:
+        (WebCore::JSFloat64Array::getOwnPropertySlot):
+        (WebCore::JSFloat64Array::getOwnPropertyDescriptor):
+        (WebCore::JSFloat64Array::put):
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::JSTestEventTarget::getOwnPropertySlot):
+        (WebCore::JSTestEventTarget::getOwnPropertyDescriptor):
+
+2012-05-15  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Rename Node::shadowTreeRootNode() to Node::shadowRoot()
+        https://bugs.webkit.org/show_bug.cgi?id=86449
+
+        Reviewed by Darin Adler.
+
+        Since Node::shadowTreeRootNode() returns always a ShadowRoot now, shadowRoot() is
+        mure suitable than shadowTreeRootNode().
+
+        This patch changes the method name.
+
+        No new tests, no change in behavior.
+
+        * WebCore.order:
+        * dom/Node.cpp:
+        (WebCore::Node::rendererIsEditable):
+        (WebCore::Node::shadowAncestorNode):
+        (WebCore::Node::shadowRoot):
+        * dom/Node.h:
+        (Node):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        * dom/Range.cpp:
+        (WebCore::Range::shadowRoot):
+        * dom/Range.h:
+        (Range):
+        * editing/Editor.cpp:
+        (WebCore::Editor::nextVisibleRange):
+        (WebCore::Editor::countMatchesForText):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleReplacedElement):
+        * editing/htmlediting.cpp:
+        (WebCore::indexForVisiblePosition):
+        * html/shadow/ContentSelectorQuery.cpp:
+        (WebCore::ContentSelectorQuery::matches):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::parseAttribute):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::detach):
+        * page/EventHandler.cpp:
+        (WebCore::instanceAssociatedWithShadowTreeElement):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::correspondingElement):
+        (WebCore::collectInstancesForSVGElement):
+
+2012-05-15  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Remove some unused gyp lines
+        https://bugs.webkit.org/show_bug.cgi?id=86545
+
+        Reviewed by Dirk Pranke.
+
+        mac_framework_dirs adds directories to search for frameworks
+        (similar to -I for includes), it doesn't add any frameworks.
+        Having something that ends in .framewok in mac_framework_dirs
+        doesn't make sense.
+
+        No intended functionality change.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-05-13  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] build a static list of mime-types
+        https://bugs.webkit.org/show_bug.cgi?id=86331
+
+        Reviewed by Martin Robinson.
+
+        Don't bother parsing the gstreamer typefind factories and doing
+        ugly hacks around this. Instead build a static list and let our
+        ::supportsType() method return MediaPlayer::MayBeSupported or
+        MediaPlayer::IsSupported for them. Playback will still fail if a
+        demuxer or decoder is missing for one of these mime-types but we
+        will handle that case more properly soon by fixing bug 34085 and
+        bug 34318.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+
+2012-05-15  Greg Spencer  <gspencer@chromium.org>
+
+        MHTML files should be loadable from all schemes considered local,
+        not just file:
+
+        https://bugs.webkit.org/show_bug.cgi?id=86540
+
+        Reviewed by Adam Barth.
+
+        Current tests should assure that loading is still allowed locally.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * loader/archive/mhtml/MHTMLArchive.cpp:
+        (WebCore::MHTMLArchive::create):
+
+2012-05-15  Fady Samuel  <fsamuel@chromium.org>
+
+        [Chromium] Reset ScriptInstance in HTMLPlugInElement on WebPluginContainerImpl::setPlugin
+        https://bugs.webkit.org/show_bug.cgi?id=86535
+
+        Reviewed by Darin Fisher.
+        
+        When we swap out WebPluginImpls for the Browser Plugin, the HTMLPlugInElement continues
+        to use a now invalid ScriptInstance, so we reset the ScriptInstance on WebPluginContainerImpl::setPlugin
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::resetInstance):
+        (WebCore):
+        * html/HTMLPlugInElement.h:
+        (HTMLPlugInElement):
+
+2012-05-15  Robert Hogan  <robert@webkit.org>
+
+        Heap-use-after-free in WebCore::RenderBlock::layoutRunsAndFloats
+        https://bugs.webkit.org/show_bug.cgi?id=86206
+
+        Reviewed by Abhishek Arya.
+
+        Revert https://trac.webkit.org/changeset/116438/. It caused three different regressions on 
+        ClusterFuzz.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+
+2012-05-15  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=86549
+        Page Scale + Tiled Drawing: Twitter sign in page content disappears 
+        after typing into name and enabling password field
+        -and corresponding-
+        <rdar://problem/11415352>
+
+        Reviewed by Oliver Hunt.
+
+        The enormous rect we used to use would overflow in CA and do nothing 
+        when there was any scale > 1 on the context. Instead, just call 
+        setNeedsDisplay on each tile.
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setNeedsDisplay):
+
+2012-05-15  Andreas Kling  <kling@webkit.org>
+
+        Pass Attribute by const reference as much as possible.
+        <http://webkit.org/b/86487>
+
+        Reviewed by Darin Adler.
+
+        Switch to passing around "const Attribute&" instead of "Attribute*" wherever possible.
+        This helps enforce the constness and non-nullity of these arguments at compile time.
+
+        Also renamed 'attr' to 'attribute' in the touched code. Attr and Attribute are two
+        different classes, so having "Attribute attr" just looks wrong.
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/ScriptEventListener.h:
+        * dom/Attr.cpp:
+        (WebCore::Attr::setPrefix):
+        (WebCore::Attr::setValue):
+        (WebCore::Attr::childrenChanged):
+        (WebCore::Attr::style):
+        (WebCore::Attr::elementAttribute):
+        * dom/Attr.h:
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeInternal):
+        (WebCore::Element::attributeChanged):
+        (WebCore::Element::parserSetAttributes):
+        (WebCore::Element::didAddAttribute):
+        (WebCore::Element::didModifyAttribute):
+        (WebCore::Element::didRemoveAttribute):
+        * dom/Element.h:
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::addAttribute):
+        (WebCore::ElementAttributeData::setAttributes):
+        (WebCore::ElementAttributeData::replaceAttribute):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+        (WebCore::StyledElement::parseAttribute):
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::collectStyleForAttribute):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseAttribute):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::parseAttribute):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::parseAttribute):
+        * html/HTMLAreaElement.h:
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::collectStyleForAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::parseAttribute):
+        * html/HTMLBaseElement.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::collectStyleForAttribute):
+        (WebCore::HTMLBodyElement::parseAttribute):
+        * html/HTMLBodyElement.h:
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseAttribute):
+        * html/HTMLButtonElement.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::parseAttribute):
+        * html/HTMLCanvasElement.h:
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::parseAttribute):
+        * html/HTMLDetailsElement.h:
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::collectStyleForAttribute):
+        * html/HTMLDivElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::parseBorderWidthAttribute):
+        (WebCore::HTMLElement::applyBorderAttributeToStyle):
+        (WebCore::HTMLElement::mapLanguageAttributeToLocale):
+        (WebCore::HTMLElement::collectStyleForAttribute):
+        (WebCore::HTMLElement::parseAttribute):
+        (WebCore::HTMLElement::applyAlignmentAttributeToStyle):
+        (WebCore::HTMLElement::dirAttributeChanged):
+        * html/HTMLElement.h:
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::collectStyleForAttribute):
+        (WebCore::HTMLEmbedElement::parseAttribute):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::collectStyleForAttribute):
+        * html/HTMLFontElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::parseAttribute):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::parseAttribute):
+        * html/HTMLFormElement.h:
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::parseAttribute):
+        * html/HTMLFrameElement.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseAttribute):
+        * html/HTMLFrameElementBase.h:
+        (HTMLFrameElementBase):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::collectStyleForAttribute):
+        (WebCore::HTMLFrameSetElement::parseAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        * html/HTMLHRElement.h:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::collectStyleForAttribute):
+        (WebCore::HTMLIFrameElement::parseAttribute):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::collectStyleForAttribute):
+        (WebCore::HTMLImageElement::parseAttribute):
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::updateType):
+        (WebCore::HTMLInputElement::collectStyleForAttribute):
+        (WebCore::HTMLInputElement::parseAttribute):
+        (WebCore::HTMLInputElement::parseMaxLengthAttribute):
+        * html/HTMLInputElement.h:
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::parseAttribute):
+        * html/HTMLKeygenElement.h:
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::collectStyleForAttribute):
+        (WebCore::HTMLLIElement::parseAttribute):
+        * html/HTMLLIElement.h:
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseAttribute):
+        * html/HTMLLinkElement.h:
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::parseAttribute):
+        * html/HTMLMapElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::collectStyleForAttribute):
+        * html/HTMLMarqueeElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseAttribute):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMetaElement.cpp:
+        (WebCore::HTMLMetaElement::parseAttribute):
+        * html/HTMLMetaElement.h:
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::parseAttribute):
+        * html/HTMLMeterElement.h:
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::collectStyleForAttribute):
+        (WebCore::HTMLOListElement::parseAttribute):
+        * html/HTMLOListElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::collectStyleForAttribute):
+        (WebCore::HTMLObjectElement::parseAttribute):
+        * html/HTMLObjectElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::parseAttribute):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::parseAttribute):
+        * html/HTMLOptionElement.h:
+        * html/HTMLOutputElement.cpp:
+        (WebCore::HTMLOutputElement::parseAttribute):
+        * html/HTMLOutputElement.h:
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::collectStyleForAttribute):
+        * html/HTMLParagraphElement.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::collectStyleForAttribute):
+        * html/HTMLPlugInElement.h:
+        * html/HTMLPreElement.cpp:
+        (WebCore::HTMLPreElement::collectStyleForAttribute):
+        * html/HTMLPreElement.h:
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::parseAttribute):
+        * html/HTMLProgressElement.h:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseAttribute):
+        * html/HTMLScriptElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseAttribute):
+        (WebCore::HTMLSelectElement::parseMultipleAttribute):
+        * html/HTMLSelectElement.h:
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::parseAttribute):
+        * html/HTMLStyleElement.h:
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::collectStyleForAttribute):
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::collectStyleForAttribute):
+        (WebCore::HTMLTableCellElement::parseAttribute):
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::collectStyleForAttribute):
+        (WebCore::HTMLTableColElement::parseAttribute):
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::collectStyleForAttribute):
+        (WebCore::HTMLTableElement::parseAttribute):
+        * html/HTMLTableElement.h:
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::collectStyleForAttribute):
+        (WebCore::HTMLTextAreaElement::parseAttribute):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::parseAttribute):
+        * html/HTMLTextFormControlElement.h:
+        * html/HTMLTrackElement.cpp:
+        (WebCore::HTMLTrackElement::parseAttribute):
+        * html/HTMLTrackElement.h:
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::collectStyleForAttribute):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::collectStyleForAttribute):
+        (WebCore::HTMLVideoElement::parseAttribute):
+        * html/HTMLVideoElement.h:
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::parseAttribute):
+        * html/shadow/HTMLContentElement.h:
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::collectStyleForAttribute):
+        * mathml/MathMLElement.h:
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::parseAttribute):
+        * svg/SVGAElement.h:
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::parseAttribute):
+        * svg/SVGAnimateMotionElement.h:
+        * svg/SVGAnimateTransformElement.cpp:
+        (WebCore::SVGAnimateTransformElement::parseAttribute):
+        * svg/SVGAnimateTransformElement.h:
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::parseAttribute):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::parseAttribute):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::parseAttribute):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        (WebCore::SVGComponentTransferFunctionElement::parseAttribute):
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::parseAttribute):
+        * svg/SVGCursorElement.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::reportAttributeParsingError):
+        (WebCore::SVGElement::parseAttribute):
+        (WebCore::SVGElement::attributeChanged):
+        * svg/SVGElement.h:
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::parseAttribute):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        (WebCore::SVGExternalResourcesRequired::parseAttribute):
+        * svg/SVGExternalResourcesRequired.h:
+        (SVGExternalResourcesRequired):
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::parseAttribute):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::parseAttribute):
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::parseAttribute):
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::parseAttribute):
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEConvolveMatrixElement.cpp:
+        (WebCore::SVGFEConvolveMatrixElement::parseAttribute):
+        * svg/SVGFEConvolveMatrixElement.h:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::parseAttribute):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::parseAttribute):
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEDropShadowElement.cpp:
+        (WebCore::SVGFEDropShadowElement::parseAttribute):
+        * svg/SVGFEDropShadowElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::parseAttribute):
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::parseAttribute):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFELightElement.cpp:
+        (WebCore::SVGFELightElement::parseAttribute):
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        (WebCore::SVGFEMergeNodeElement::parseAttribute):
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::parseAttribute):
+        * svg/SVGFEMorphologyElement.h:
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::parseAttribute):
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::parseAttribute):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::parseAttribute):
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::parseAttribute):
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::parseAttribute):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::parseAttribute):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        (SVGFilterPrimitiveStandardAttributes):
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::parseAttribute):
+        * svg/SVGFitToViewBox.h:
+        (SVGFitToViewBox):
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::parseAttribute):
+        * svg/SVGFontFaceElement.h:
+        * svg/SVGFontFaceUriElement.cpp:
+        (WebCore::SVGFontFaceUriElement::parseAttribute):
+        * svg/SVGFontFaceUriElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::parseAttribute):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::parseAttribute):
+        * svg/SVGGElement.h:
+        * svg/SVGGlyphElement.cpp:
+        (WebCore::SVGGlyphElement::parseAttribute):
+        * svg/SVGGlyphElement.h:
+        * svg/SVGGlyphRefElement.cpp:
+        (WebCore::SVGGlyphRefElement::parseAttribute):
+        * svg/SVGGlyphRefElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::parseAttribute):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::collectStyleForAttribute):
+        (WebCore::SVGImageElement::parseAttribute):
+        * svg/SVGImageElement.h:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::sourceURI):
+        * svg/SVGLangSpace.cpp:
+        (WebCore::SVGLangSpace::parseAttribute):
+        * svg/SVGLangSpace.h:
+        (SVGLangSpace):
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::parseAttribute):
+        * svg/SVGLineElement.h:
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::parseAttribute):
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::parseAttribute):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::parseAttribute):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::parseAttribute):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::parseAttribute):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseAttribute):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::parseAttribute):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::parseAttribute):
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::parseAttribute):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseAttribute):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::parseAttribute):
+        * svg/SVGScriptElement.h:
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::parseAttribute):
+        * svg/SVGStopElement.h:
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::parseAttribute):
+        * svg/SVGStyleElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::collectStyleForAttribute):
+        (WebCore::SVGStyledElement::parseAttribute):
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::parseAttribute):
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::parseAttribute):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::parseAttribute):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTests.cpp:
+        (WebCore::SVGTests::parseAttribute):
+        * svg/SVGTests.h:
+        (SVGTests):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::collectStyleForAttribute):
+        (WebCore::SVGTextContentElement::parseAttribute):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::parseAttribute):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::parseAttribute):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::parseAttribute):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::parseAttribute):
+        * svg/SVGURIReference.h:
+        (SVGURIReference):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::parseAttribute):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::parseAttribute):
+        * svg/SVGViewElement.h:
+        * svg/SVGZoomAndPan.cpp:
+        (WebCore::SVGZoomAndPan::parseAttribute):
+        * svg/SVGZoomAndPan.h:
+        (SVGZoomAndPan):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::parseAttribute):
+        * svg/animation/SVGSMILElement.h:
+
+2012-05-15  Kenneth Russell  <kbr@google.com>
+
+        Assertion failure running Mozilla's WebGL performance regression tests
+        https://bugs.webkit.org/show_bug.cgi?id=85942
+
+        Reviewed by Stephen White.
+
+        Fixed incorrect assumptions about source formats and buffer sizes
+        when uploading to floating-point textures. Added code paths
+        supporting the necessary conversions.
+
+        Tests have been added to the WebGL conformance suite which cover
+        these new code paths; they verify uploads of HTMLCanvasElement,
+        HTMLImageElement, HTMLVideoElement, and ImageData to
+        floating-point textures. However, because floating-point texture
+        support is optional, and generally only supported on bots which
+        run with real GPUs and not in virtual machines, it isn't feasible
+        to incorporate these tests as layout tests.
+
+        Ran the new WebGL conformance tests in Chromium on Linux; all
+        pass.
+
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::extractImageData):
+        Properly compute size of destination buffer.
+
+        (WebCore):
+        Add pack/unpack routines for converting RGBA8/BGRA8 to floating point.
+
+        (WebCore::doFloatingPointPacking):
+        Support RGBA8 and BGRA8 source formats.
+
+        (WebCore::isFloatingPointSource):
+        Factored out logic for assertions.
+
+        (WebCore::GraphicsContext3D::packPixels):
+        Generalized assertions and logic.
+
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+        Properly compute size of destination buffer.
+
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+        Properly compute size of destination buffer.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+        Properly compute size of destination buffer.
+
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+        Properly compute size of destination buffer.
+
+2012-05-15  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Chromium port never sets USE(CG) so code behind it is dead
+        https://bugs.webkit.org/show_bug.cgi?id=86537
+
+        Reviewed by Adrienne Walker.
+
+        Deletes code behind USE(CG) in chromium-specific code and removes unneeded USE(SKIA) guards.
+
+        * platform/chromium/DragImageRef.h:
+        (WebCore):
+        * platform/chromium/MIMETypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+        * platform/chromium/ThemeChromiumMac.mm:
+        (WebCore::paintStepper):
+        * platform/graphics/chromium/PlatformImage.cpp:
+        (WebCore::PlatformImage::updateFromImage):
+
+2012-05-15  Keyar Hood  <keyar@chromium.org>
+
+        Skia does not respect a specified InterpolationQuality
+        https://bugs.webkit.org/show_bug.cgi?id=86249
+
+        Reviewed by Stephen White.
+
+        The added functionality is not exposed to higher layers of webkit.
+        Tests will be added that will exercise these changes when bug 82804 is 
+        fixed.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImage):
+        (WebCore::GraphicsContext::drawImageBuffer):
+        Code to have the useLowQualityScale cause the InterpolationQuality be
+        be set to low for Chromium but remain as none for other platforms.
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::limitResamplingMode): Added
+        (WebCore):
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        We now limit the resampling choice based on what InterpolationQuality
+        is set as. InterpolationNone restricts resampling to RESAMPLE_NONE,
+        InterpolationLow and InterpolationMedium restricts resampling to
+        RESAMPLE_LINEAR. InterpolationHigh and InterpolationDefault do not
+        change the resampling.
+        
+        Furthermore, the choice on how to set the filter bitmap flag in
+        paintSkBitmap was made to be consistent with that in
+        Image::drawPattern.
+
+
+2012-05-15  Jeffrey Pfau  <jpfau@apple.com>
+
+        ImageDocuments erroneously trigger beforeload events for the main resource
+        https://bugs.webkit.org/show_bug.cgi?id=86543
+        <rdar://problem/11309013>
+
+        Reviewed by Brady Eidson.
+
+        No new tests; testing framework doesn't allow for testing ImageDocuments with injected JavaScript.
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateFromElement):
+
+2012-05-15  Dirk Pranke  <dpranke@chromium.org>
+
+        [chromium] ScrollElasticityController.mm doesn't compile with the 10.6 SDK on mac
+        https://bugs.webkit.org/show_bug.cgi?id=86544
+
+        Reviewed by Anders Carlsson.
+
+        This is a build fix for now until we can figure out what a
+        better way to approach this is.
+
+        * platform/mac/ScrollElasticityController.mm:
+        (WebCore):
+
+2012-05-15  Nate Chapin  <japhet@chromium.org>
+
+        MainResourceLoader::load() always returns true, so make it return
+        void and delete the related dead code.
+        https://bugs.webkit.org/show_bug.cgi?id=86413
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests, cleanup only.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::startLoadingMainResource):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::load):
+        * loader/MainResourceLoader.h:
+        (MainResourceLoader):
+
+2012-05-15  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure animations get ticked at least once when added.
+        https://bugs.webkit.org/show_bug.cgi?id=86013
+
+        Reviewed by James Robinson.
+
+        Tested in
+          CCLayerTreeHostTestTickAnimationWhileBackgrounded.runSingleThreaded
+          CCLayerTreeHostTestAddAnimationWithTimingFunction.runSingleThreaded
+          CCLayerTreeHostTestSynchronizeAnimationStartTimes.runSingleThreaded
+          CCLayerTreeHostTestAnimationFinishedEvents.runSingleThreaded
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::addAnimation):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::didAddAnimation):
+        (WebCore):
+        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (CCSingleThreadProxyAnimationTimer):
+        (WebCore::CCSingleThreadProxyAnimationTimer::create):
+        (WebCore::CCSingleThreadProxyAnimationTimer::CCSingleThreadProxyAnimationTimer):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
+        (WebCore::CCSingleThreadProxy::didAddAnimation):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2012-05-15  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Fix unsafe viewport tag dispatch
+        https://bugs.webkit.org/show_bug.cgi?id=80554
+
+        Reviewed by Adam Barth.
+
+        In some uncommon situations (such as window.open() new tab on
+        Android), dispatchViewportPropertiesDidChange may early-return without
+        setting the page scale because the window size is not yet
+        available from the embedder.  At that point, the previous behavior was
+        to call it again in layoutUpdated(), but this is unsafe since it
+        leaves a pending needsLayout.
+
+        I moved the dispatch call into WebViewImpl::didChangeContentsSize and
+        WebViewImpl::resize() instead -- these represent more explicitly the
+        situations where the inputs to the viewport tag calculation change.  I
+        removed the other dispatch call from setFrameRect as it's now
+        redundant.
+
+        Covered by FixedLayoutInitializeAtMinimumPageScale test introduced
+        in http://webk.it/82949 (an assertion will fire there without
+        this fix).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setFrameRect):
+
+2012-05-15  Jer Noble  <jer.noble@apple.com>
+
+        r117147 causes a null-deref crash in DOMImplementation::createDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=86532
+
+        Reviewed by James Robinson.
+
+        No new tests, but fixes many crashing tests.
+
+        Protect against the possibility of being passed a NULL frame in
+        DOMImplementation::createDocument().
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+
+2012-05-15  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Use posZOrderList() / negZOrderList() everywhere to avoid querying dirtied lists
+        https://bugs.webkit.org/show_bug.cgi?id=86416
+
+        Reviewed by Simon Fraser.
+
+        Covered by existing tests that are not ASSERTing after this change.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::update3DTransformedDescendantStatus):
+        Added a call to updateZOrderLists() to the previous sites as nothing guarantees
+        that we have recomputed our z-order lists.
+
+        (WebCore::RenderLayer::paintLayerContents):
+        (WebCore::RenderLayer::hitTestLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::needsContentsCompositingLayer):
+        Converted those functions to use the safe getters.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasNegativeZOrderList):
+        Newly added funtion to return if we have a negative z-order list.
+
+2012-05-15  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due shadow tree parent confusion in SVG.
+        https://bugs.webkit.org/show_bug.cgi?id=84248
+
+        Reviewed by Nikolas Zimmermann.
+
+        Test: svg/foreignObject/viewport-foreignobject-crash.html
+
+        When we try to make a decision on whether we need an outer
+        SVGRoot container, we detect if we are in shadow tree or not.
+        We also need to make sure that our parentOrHostElement is also
+        an svg element. 
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::isOutermostSVGSVGElement):
+
+2012-05-15  Lauro Neto  <lauro.neto@openbossa.org>
+
+        [File API] URL methods handling null arguments
+        https://bugs.webkit.org/show_bug.cgi?id=69693
+
+        Reviewed by Adam Barth.
+
+        Per the latest editor's draft of the File API:
+        http://dev.w3.org/2006/webapi/FileAPI/#dfn-createObjectURL
+
+        Use null instead of undefined as return value when a
+        null blob is given to URL.createObjectURL.
+
+        Test: fast/files/url-null.html
+
+        * html/DOMURL.idl:
+
+2012-05-15  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed build fix [Qt].
+
+        Protect the definition of DOMImplementationSupportsTypeClient class with
+        #if ENABLE(VIDEO) so as not to cause compilation errors on ports with
+        VIDEO disabled.
+
+        * dom/DOMImplementation.cpp:
+
+2012-05-14  Jer Noble  <jer.noble@apple.com>
+
+        Site-specific hack: Disclaim WebM as a supported type on Mac for YouTube.
+        https://bugs.webkit.org/show_bug.cgi?id=86409
+
+        Reviewed by Darin Adler.
+
+        No new tests; site specific hack.
+
+        Add a Mac-only site-specific hack which disclaims both video/webm and video/x-flv
+        as supported types when the media element's document has a host of youtube.com.
+
+        Add a new, pure-virtual prototype class for use by MediaPlayer::supportsType:
+        * platform/graphics/MediaPlayer.h:
+        (MediaPlayerSupportsTypeClient):
+        (WebCore::MediaPlayerSupportsTypeClient::~MediaPlayerSupportsTypeClient):
+        (WebCore::MediaPlayerSupportsTypeClient::mediaPlayerNeedsSiteSpecificHacks):
+        (WebCore::MediaPlayerSupportsTypeClient::mediaPlayerDocumentHost):
+
+        Use these new client calls to determine whether to apply the site-specific
+        hack:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::supportsType):
+
+        Add this prototype class as a superclass of HTMLMediaElement.  Pass in the
+        HTMLMediaElement's this pointer when calling MediaPlayer::supportsType():
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType):
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+        (WebCore::HTMLMediaElement::mediaPlayerNeedsSiteSpecificHacks):
+        (WebCore::HTMLMediaElement::mediaPlayerDocumentHost):
+        * html/HTMLMediaElement.h:
+
+        As is HTMLMediaElement, a MediaPlayerSupportsTypeClient class is needed. Add a
+        new class DOMImplementationSupportsTypeClient, an instance of which will be 
+        passed to MediaPlayer::supportsType():
+        * dom/DOMImplementation.cpp:
+        (DOMImplementationSupportsTypeClient):
+        (WebCore::DOMImplementationSupportsTypeClient::DOMImplementationSupportsTypeClient):
+        (WebCore::DOMImplementation::createDocument):
+        (WebCore::DOMImplementation::mediaPlayerNeedsSiteSpecificHacks):
+        (WebCore::DOMImplementation::mediaPlayerDocumentHost):
+        * dom/DOMImplementation.h:
+
+2012-05-15  Anders Carlsson  <andersca@apple.com>
+
+        Use unaccelerated scrolling deltas when rubber-banding
+        https://bugs.webkit.org/show_bug.cgi?id=86503
+        <rdar://problem/11378742>
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.exp.in:
+        * platform/PlatformWheelEvent.h:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        (PlatformWheelEvent):
+        (WebCore::PlatformWheelEvent::scrollCount):
+        (WebCore::PlatformWheelEvent::unacceleratedScrollingDeltaX):
+        (WebCore::PlatformWheelEvent::unacceleratedScrollingDeltaY):
+        Add scroll count and unaccelerated scrolling deltas.
+
+        * platform/mac/ScrollElasticityController.mm:
+        (WebCore::elasticDeltaForTimeDelta):
+        (WebCore::elasticDeltaForReboundDelta):
+        (WebCore::reboundDeltaForElasticDelta):
+        Call the new WKSI functions.
+
+        (WebCore::ScrollElasticityController::handleWheelEvent):
+        Use the unaccelerated scrolling deltas when needed.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        Add new WKSI functions.
+
+2012-05-15  Terry Anderson  <tdanderson@chromium.org>
+
+        [chromium] Compute the best target node on a GestureTap event
+        https://bugs.webkit.org/show_bug.cgi?id=85101
+
+        Reviewed by Adam Barth.
+
+        Using the tests in the touchadjustment/ directory.
+
+        * WebCore.gypi:
+        Include TouchAdjustment.* files.
+        * page/TouchAdjustment.cpp:
+        (WebCore::TouchAdjustment::zoomableIntersectionQuotient):
+        (WebCore::TouchAdjustment::findNodeWithLowestDistanceMetric):
+        No longer using the INFINITY constant due to problems with compiling
+        on chromium win.
+
+2012-05-15  Chris Rogers  <crogers@google.com>
+
+        Add AudioSummingJunction class to handle fan-in (abstracted from AudioNodeInput)
+        https://bugs.webkit.org/show_bug.cgi?id=86396
+
+        Reviewed by Kenneth Russell.
+
+        No new tests.  Existing layout tests already extensively test summing.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        Add AudioSummingJunction files to makefiles.
+
+        * Modules/webaudio/AudioContext.cpp:
+        * Modules/webaudio/AudioContext.h:
+        (WebCore::AudioContext::handlePreRenderTasks):
+        (WebCore::AudioContext::handlePostRenderTasks):
+        (WebCore::AudioContext::deleteMarkedNodes):
+        (WebCore::AudioContext::markSummingJunctionDirty):
+        (WebCore::AudioContext::removeMarkedSummingJunction):
+        (WebCore::AudioContext::handleDirtyAudioSummingJunctions):
+        Simple munge from AudioNodeInput -> AudioSummingJunction
+
+        * Modules/webaudio/AudioNodeInput.cpp:
+        * Modules/webaudio/AudioNodeInput.h:
+        (WebCore::AudioNodeInput::AudioNodeInput):
+        (WebCore::AudioNodeInput::didUpdate):
+        Remove logic from AudioNodeInput which now is being moved to AudioSummingJunction.
+
+        * Modules/webaudio/AudioSummingJunction.cpp: Added.
+        * Modules/webaudio/AudioSummingJunction.h: Added.
+        (WebCore::AudioSummingJunction::AudioSummingJunction):
+        (WebCore::AudioSummingJunction::~AudioSummingJunction):
+        (WebCore::AudioSummingJunction::changedOutputs):
+        (WebCore::AudioSummingJunction::updateRenderingState):
+        (WebCore::AudioSummingJunction::context):
+        (WebCore::AudioSummingJunction::numberOfRenderingConnections):
+        (WebCore::AudioSummingJunction::renderingOutput):
+        (WebCore::AudioSummingJunction::isConnected):
+        (WebCore::AudioSummingJunction::numberOfConnections):
+        Add AudioSummingJunction which is an abstraction to manage/track the connections from AudioNodeOutputs
+        representing the fan-in points for unity gain summing junctions.
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add AudioSummingJunction files to makefiles.
+
+2012-05-15  Dan Bernstein  <mitz@apple.com>
+
+        Ruby annotation is incorrectly identified as a paragraph boundary
+        https://bugs.webkit.org/show_bug.cgi?id=86507
+
+        Reviewed by Darin Adler.
+
+        Test: editing/selection/paragraph-with-ruby.html
+
+        * editing/htmlediting.cpp:
+        (WebCore::isBlock): Changed to return false for ruby text.
+
+2012-05-15  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] Un-used GStreamer linker options
+        https://bugs.webkit.org/show_bug.cgi?id=86407
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: Remove no-longer used webcore_libadd variable.
+
+2012-05-15  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=86506
+        REGRESSION (tiled drawing): No scrollbar while page is loading
+        -and corresponding
+        <rdar://problem/11444589>
+
+        Reviewed by Anders Carlsson.
+
+        We have always had a mechanism in place to suppress painting overlay 
+        scrollbars while the page is loading. However, that mechaism is 
+        overriden if the page has been scrolled. It should be, anyway. It was 
+        not being overriden when the scrolling was handled as a wheel event by 
+        the scrolling tree. This patch takes advantage of the fact that 
+        ScrollingTree::handleWheelEvent() already calls back to the main 
+        thread for handleWheelEventPhase() and just patches 
+        handleWheelEventPhase to mark m_haveScrolledSincePageLoad as true.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::handleWheelEventPhase):
+
+2012-05-15  Jessie Berlin  <jberlin@apple.com>
+
+        WKContextSetCacheModel(contextref, kWKCacheModelDocumentViewer) doesn't prevent pages from
+        going into the PageCache.
+        https://bugs.webkit.org/show_bug.cgi?id=85891
+
+        Reviewed by Brady Eidson.
+
+        Do not claim that it is possible to cache a page when the page cache has a capacity of 0.
+
+        Covered by the modified DOMWindowExtensionNoCache WK2 API test.
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::canCache):
+        Check m_capacity.
+        * history/PageCache.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        canCache is no longer static on PageCache.
+
+2012-05-15  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed, rolling out r116811.
+        http://trac.webkit.org/changeset/116811
+        https://bugs.webkit.org/show_bug.cgi?id=86257
+
+        Introduced layering violation
+
+        * WebCore.gypi:
+
+2012-05-15  Darin Adler  <darin@apple.com>
+
+        Font copy constructor unnecessarily recalculates transcoding
+        https://bugs.webkit.org/show_bug.cgi?id=86490
+
+        Reviewed by Dan Bernstein.
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::Font): Copy m_needsTranscoding instead of recomputing it.
+
+2012-05-15  Andreas Kling  <kling@webkit.org>
+
+        Deep copy PluginModuleInfo before passing across thread boundary.
+        <http://webkit.org/b/86491>
+        <rdar://problem/11451178>
+
+        Reviewed by Anders Carlsson.
+
+        * plugins/PluginData.h:
+        (MimeClassInfo):
+        (WebCore::MimeClassInfo::isolatedCopy):
+        (PluginInfo):
+        (WebCore::PluginInfo::isolatedCopy):
+
+2012-05-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r116712.
+        http://trac.webkit.org/changeset/116712
+        https://bugs.webkit.org/show_bug.cgi?id=86484
+
+        This patch is causing crashes in Chromium Canary builds
+        (Requested by pilgrim_google__ on #webkit).
+
+        * storage/StorageArea.h:
+        (StorageArea):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::disabledByPrivateBrowsingInFrame):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        (StorageAreaImpl):
+
+2012-05-15  Darin Adler  <darin@apple.com>
+
+        Optimize save/restore with no drawing operations between them (shows up on some canvas benchmarks)
+        https://bugs.webkit.org/show_bug.cgi?id=86448
+
+        Reviewed by Simon Fraser.
+
+        Since canvas programmers sometimes end up doing extra save/restore pairs with no actual drawing
+        in between, optimize that case by not realizing saves until we have to. This is doubly important
+        because saves are costly.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D): Initialize m_unrealizedSaveCount.
+        (WebCore::CanvasRenderingContext2D::isAccelerated): Improve performance by calling the
+        drawingContext function only once.
+        (WebCore::CanvasRenderingContext2D::reset): Set m_unrealizedSaveCount to 0.
+        (WebCore::CanvasRenderingContext2D::realizeSavesLoop): Added. Replaces the save function as the
+        function that actually pushes context onto the state stack.
+        (WebCore::CanvasRenderingContext2D::restore): Added code to do an early return if we can do the
+        restore just by decrementing the unrealized save count.
+        (WebCore::CanvasRenderingContext2D::setStrokeStyle): Added calls to realizeSaves and replaced
+        calls to state with calls to modifiableState.
+        (WebCore::CanvasRenderingContext2D::setFillStyle): Ditto.
+        (WebCore::CanvasRenderingContext2D::setLineWidth): Ditto. Also added an early out for cases where
+        the line width is not changing.
+        (WebCore::CanvasRenderingContext2D::setLineCap): Ditto.
+        (WebCore::CanvasRenderingContext2D::setLineJoin): Ditto.
+        (WebCore::CanvasRenderingContext2D::setMiterLimit): Ditto.
+        (WebCore::CanvasRenderingContext2D::setShadowOffsetX): Ditto.
+        (WebCore::CanvasRenderingContext2D::setShadowOffsetY): Ditto.
+        (WebCore::CanvasRenderingContext2D::setShadowBlur): Ditto.
+        (WebCore::CanvasRenderingContext2D::setShadowColor): Ditto.
+        (WebCore::CanvasRenderingContext2D::setWebkitLineDash): Ditto.
+        (WebCore::CanvasRenderingContext2D::setWebkitLineDashOffset): Ditto.
+        (WebCore::CanvasRenderingContext2D::setGlobalAlpha): Ditto.
+        (WebCore::CanvasRenderingContext2D::setGlobalCompositeOperation): Ditto.
+        (WebCore::CanvasRenderingContext2D::scale): Ditto.
+        (WebCore::CanvasRenderingContext2D::rotate): Ditto.
+        (WebCore::CanvasRenderingContext2D::translate): Ditto.
+        (WebCore::CanvasRenderingContext2D::transform): Ditto.
+        (WebCore::CanvasRenderingContext2D::setTransform): Ditto.
+        (WebCore::CanvasRenderingContext2D::setStrokeColor): Ditto.
+        (WebCore::CanvasRenderingContext2D::setFillColor): Ditto.
+        (WebCore::CanvasRenderingContext2D::clip): Ditto.
+        (WebCore::CanvasRenderingContext2D::clearRect): Changed implementation so it does not save
+        the graphics context in the common case where shadows, global alpha, and global compositing
+        operators do not interfer with the function's operation. This allowed us to get rid of the
+        setAllAttributesToDefault function, which was used nowhere else.
+        (WebCore::CanvasRenderingContext2D::setShadow): Added a new common bottleneck and made all
+        the setShadow functions call it.
+        (WebCore::CanvasRenderingContext2D::clearShadow): Changed to call the new setShadow.
+        (WebCore::CanvasRenderingContext2D::setFont): Renamed tempDecl to the more friendly
+        parsedStyle. Changed code structure so the CSS parser is deleted right after parsing is
+        done. Used string concatenation instead of more expensive string append. Added calls to
+        realizeSaves and modifiableState.
+        (WebCore::CanvasRenderingContext2D::setTextAlign): Added calls to realizeSaves and replaced
+        calls to state with calls to modifiableState. Also added an early out for cases where the
+        alignment is not changing.
+        (WebCore::CanvasRenderingContext2D::setTextBaseline): Ditto.
+
+        * html/canvas/CanvasRenderingContext2D.h: Made save an inline function that bumps
+        m_unrealizedSaveCount. Removed setAllAttributesToDefault. Added OVERRIDE for all the
+        virtual function overrides, and made them all private. Moved m_path down with the other data
+        members. Renamed the non-const state function to modifiableState. Added a realizeSaves
+        function and the realizeSavesLoop for the unusual case where there is work to do.
+        Added m_unrealizedSaveCount.
+
+2012-05-15  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Setting onended on a LocalMediaStream triggers an assertion in V8
+        https://bugs.webkit.org/show_bug.cgi?id=86459
+
+        Reviewed by Adam Barth.
+
+        LocalMediaStream inherits from MediaStream, but only MediaStream have the
+        EventTarget idl attribute. Adding the attribute to LocalMediaStream as well fixes the issue.
+
+        Test: fast/mediastream/LocalMediaStream-onended.html
+
+        * Modules/mediastream/LocalMediaStream.idl:
+
+2012-05-15  Terry Anderson  <tdanderson@chromium.org>
+
+        [chromium] Remove unused code for tap target fuzzing
+        https://bugs.webkit.org/show_bug.cgi?id=86252
+
+        Reviewed by Adam Barth.
+
+        No tests required since this is a cleanup of unused code.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureTap):
+        * page/EventHandler.h:
+        (EventHandler):
+        The touch adjustment code will be used to determine the best target
+        for a GestureTap event instead of passing in a pre-targeted node.
+        * platform/PlatformGestureEvent.h:
+        (WebCore::PlatformGestureEvent::PlatformGestureEvent):
+        (PlatformGestureEvent):
+        A rectangular touch region is defined by the touch center and the
+        delta values only, so gammaX and gammaY are not needed.
+
+2012-05-15  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] WebKit with Qt5 hangs on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=79785
+
+        Reviewed by Tor Arne Vestbø.
+
+        Delay the initialization of our QNetworkConfigurationManager used in
+        NetworkStateNotifierPrivate. On Mac it was causing a race condition because it
+        spawns a thread that triggers a static initializer in Qt, while in the main
+        thread NetworkStateNotifier is being static initialized. On Mac the lock for
+        static initializers is shared between all of them, causing a deadlock.
+
+        The issue was also reported in http://openradar.appspot.com/11217150.
+
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
+        (NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifierPrivate::effectivelyOnline):
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
+        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifierPrivate::setNetworkAccessAllowed):
+        (WebCore::NetworkStateNotifierPrivate::setOnlineState):
+        (WebCore::NetworkStateNotifierPrivate::initialize):
+        (WebCore):
+        (WebCore::NetworkStateNotifierPrivate::~NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+        (WebCore::NetworkStateNotifier::setNetworkAccessAllowed):
+
+2012-05-15  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Factor HitTestPoint out of HitTestResult.
+        https://bugs.webkit.org/show_bug.cgi?id=85965
+
+        Reviewed by Simon Fraser.
+
+        In preparation for handling transformations on area-based hit-testing, 
+        we need to factor test-point and test-area out of HitTestResult so that
+        it can be transformed independently.
+
+        To maintain the current API as closely as possible HitTestResult now
+        inherit from HitTestPoint, representing the original untransformed
+        hitTestPoint.
+
+        No change in functionality. No new tests. 
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestPoint::HitTestPoint):
+        (WebCore::HitTestPoint::~HitTestPoint):
+        (WebCore::HitTestPoint::operator=):
+        (WebCore::HitTestPoint::rectForPoint):
+        (WebCore::HitTestResult::HitTestResult):
+        (WebCore::HitTestResult::operator=):
+        (WebCore::HitTestResult::isSelected):
+        (WebCore::HitTestResult::spellingToolTip):
+        (WebCore::HitTestResult::replacedString):
+        * rendering/HitTestResult.h:
+        (HitTestPoint):
+        (WebCore::HitTestPoint::point):
+        (WebCore::HitTestPoint::roundedPoint):
+        (WebCore::HitTestPoint::setPoint):
+        (WebCore::HitTestPoint::isRectBasedTest):
+        (WebCore::HitTestPoint::topPadding):
+        (WebCore::HitTestPoint::rightPadding):
+        (WebCore::HitTestPoint::bottomPadding):
+        (WebCore::HitTestPoint::leftPadding):
+        (HitTestResult):
+        (WebCore::HitTestResult::hitTestPoint):
+        (WebCore::HitTestPoint::rectForPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::hitTestList):
+
+2012-05-15  Rob Buis  <rbuis@rim.com>
+
+        Refactor SVG parts of Node::addEventListener/removeEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=86426
+
+        Reviewed by Nikolas Zimmermann.
+
+        Move SVG parts of Node::addEventListener/removeEventListener into svg/. Now we do not
+        have to check in Node::addEventListener/removeEventListener if we are dealing with an SVG
+        element. Make tryAddEventListener/tryRemoveEventListener protected methods on Node to be able to use
+        it in SVGElement.
+
+        No new tests, since no change in behavior, just refactoring.
+
+        * dom/Node.cpp:
+        (WebCore::tryAddEventListener):
+        (WebCore::Node::addEventListener):
+        (WebCore::tryRemoveEventListener):
+        (WebCore::Node::removeEventListener):
+        * svg/SVGElement.cpp:
+        (WebCore::collectInstancesForSVGElement):
+        (WebCore):
+        (WebCore::SVGElement::addEventListener):
+        (WebCore::SVGElement::removeEventListener):
+        * svg/SVGElement.h:
+        (SVGElement):
+
+2012-05-15  Andreas Kling  <kling@webkit.org>
+
+        RuleSet::addToRuleSet wastes a bit of Vector capacity.
+        <http://webkit.org/b/86434>
+
+        Reviewed by Antti Koivisto.
+
+        Have makeRuleSet call shrinkToFit() on the vectors before returning them.
+        This avoids wasting space for the rulesets constructed in collectFeatures().
+
+        * css/StyleResolver.cpp:
+        (WebCore::makeRuleSet):
+
+2012-05-15  Darin Adler  <darin@apple.com>
+
+        [CG] CGImageCreateWithImageInRect is too slow, but for now we still need to use it
+        https://bugs.webkit.org/show_bug.cgi?id=86340
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds a subimage cache to defray the cost of CGImageCreateWithImageInRect.
+        Later, we will restructure the code so it doesn't use that function, but at the
+        moment there are CG issues blocking that change.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (SubimageCacheEntry): Added. An entry in the cache.
+        (SubimageCacheEntryTraits): Added. Traits for the cache.
+        (SubimageCacheHash): Added. Hash function for the cache.
+        (SubimageCacheTimer): Added. Timer that clears the cache after a second
+        of inactivity.
+        (SubimageCacheWithTimer): Added. Cache and its timer.
+        (WebCore::subimageCache): Added. Function returning the single global timer.
+        (WebCore::SubimageCacheTimer::restart): Added. Start the timer.
+        (WebCore::SubimageCacheTimer::fired): Added. Clear the cache when the timer fires.
+        (SubimageRequest): Added. A key to look up in the cache.
+        (SubimageCacheAdder): Added. Translator to add to the cache.
+        (WebCore::subimage): Added. Puts an entry in the cache.
+        (WebCore::GraphicsContext::drawNativeImage): Changed to call the subimage function.
+
+2012-05-15  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: AdvancedSearchController is not stopped then view is hidden.
+        https://bugs.webkit.org/show_bug.cgi?id=86466
+
+        Reviewed by Vsevolod Vlasov.
+
+        AdvancedSearchController overrides "wasHidden" method instead of "willHide".
+
+        UI event-flow, not tested.
+
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchView.prototype.willHide): Renamed function.
+
+2012-05-15  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] http/tests/xmlhttprequest/xmlhttprequest-check-head-readystate-for-404.html times out
+        https://bugs.webkit.org/show_bug.cgi?id=84016
+
+        Reviewed by Simon Hausmann.
+
+        Calling didFail abort the connection and doesn't activate the HEADERS_RECEIVED state.
+        Since the goal of HEAD is to test then the request should be marked as finished
+        also in cases of HTTP errors.
+        This matches other ports behavior.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::shouldIgnoreHttpError):
+
+2012-05-15  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt][WK2] Fix scrolling in touch mode
+        https://bugs.webkit.org/show_bug.cgi?id=75006
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setFixedVisibleContentRect):
+            On changes to fixedVisibleContentRect update scroll-animators position, and
+            recalculate page-step sizes in scrollbars.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollTo):
+            Forward scrolling-request to the host window.
+        (WebCore::ScrollView::updateScrollbars):
+            Allow ScrollViews to have invisible scrollbars when scrolling is delegated.
+        * platform/ScrollView.h:
+        (ScrollView):
+
+2012-05-15  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Refactor SnippetsModel: extract SnippetStorage, make SnippetScriptMapping delegate calls to ScriptSnippetModel and provide public interface on ScriptSnippetModel in terms of uiSourceCodes
+        https://bugs.webkit.org/show_bug.cgi?id=86477
+
+        Reviewed by Pavel Feldman.
+
+        Extracted SnippetStorage to be reused for other snippet types.
+        Made SnippetScriptMapping delegate all calls to ScriptSnippetModel and injected it in DebuggerPresentationModel.
+        ScriptSnippetModel now provides public interface for ScriptsPanel in terms of uiSourceCodes.
+
+        Tests: inspector/debugger/script-snippet-model.html
+               inspector/snippet-storage.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        * inspector/front-end/ScriptSnippetModel.js: Added.
+        (WebInspector.ScriptSnippetModel):
+        (WebInspector.ScriptSnippetModel.prototype.get scriptMapping):
+        (WebInspector.ScriptSnippetModel.prototype.createScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._rawLocationToUILocation):
+        (WebInspector.ScriptSnippetModel.prototype._uiLocationToRawLocation.get if):
+        (WebInspector.ScriptSnippetModel.prototype._uiLocationToRawLocation):
+        (WebInspector.ScriptSnippetModel.prototype._uiSourceCodeList):
+        (WebInspector.ScriptSnippetModel.prototype._releasedUISourceCodes):
+        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
+        (WebInspector.ScriptSnippetModel.prototype._sourceURLForSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._snippetIdForSourceURL):
+        (WebInspector.ScriptSnippetModel.prototype._snippetForSourceURL):
+        (WebInspector.ScriptSnippetModel.prototype._reset):
+        (WebInspector.SnippetScriptMapping):
+        (WebInspector.SnippetScriptMapping.prototype.rawLocationToUILocation):
+        (WebInspector.SnippetScriptMapping.prototype.uiLocationToRawLocation):
+        (WebInspector.SnippetScriptMapping.prototype.uiSourceCodeList):
+        (WebInspector.SnippetScriptMapping.prototype.snippetIdForSourceURL):
+        (WebInspector.SnippetScriptMapping.prototype.addScript):
+        (WebInspector.SnippetScriptMapping.prototype._uiSourceCodesAdded):
+        (WebInspector.SnippetScriptMapping.prototype._uiSourceCodesRemoved):
+        (WebInspector.SnippetScriptMapping.prototype.reset):
+        (WebInspector.SnippetContentProvider):
+        * inspector/front-end/SnippetStorage.js: Added.
+        (WebInspector.SnippetStorage):
+        (WebInspector.SnippetStorage.prototype.get namePrefix):
+        (WebInspector.SnippetStorage.prototype._saveSettings):
+        (WebInspector.SnippetStorage.prototype.set snippets):
+        (WebInspector.SnippetStorage.prototype.snippetForId):
+        (WebInspector.SnippetStorage.prototype.deleteSnippet):
+        (WebInspector.SnippetStorage.prototype._snippetAdded):
+        (WebInspector.SnippetStorage.prototype.reset.set this):
+        (WebInspector.Snippet):
+        (WebInspector.Snippet.fromObject):
+        (WebInspector.Snippet.prototype.get id):
+        (WebInspector.Snippet.prototype.get name):
+        (WebInspector.Snippet.prototype.set name):
+        (WebInspector.Snippet.prototype.get content):
+        (WebInspector.Snippet.prototype.set content):
+        (WebInspector.Snippet.prototype.serializeToObject):
+        * inspector/front-end/SnippetsModel.js: Removed.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2012-05-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add show/hide debugger sidebar button.
+        https://bugs.webkit.org/show_bug.cgi?id=86478
+
+        Reviewed by Vsevolod Vlasov.
+
+        As with the navigator, but with no overlay. See the screenshot.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/NavigatorOverlayController.js:
+        (WebInspector.NavigatorOverlayController.prototype.set _pinNavigator):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._debuggerResumed):
+        (WebInspector.ScriptsPanel.prototype._showJavaScriptOutlineDialog):
+        (WebInspector.ScriptsPanel.prototype._installDebuggerSidebarController.clickHandler):
+        (WebInspector.ScriptsPanel.prototype._showDebuggerSidebar):
+        (WebInspector.ScriptsPanel.prototype.set _hideDebuggerSidebar):
+        * inspector/front-end/scriptsPanel.css:
+        (#scripts-editor-container-tabbed-pane .tabbed-pane-header-contents):
+        (button.status-bar-item.scripts-debugger-show-hide-button):
+        (.status-bar-item.scripts-debugger-show-hide-button > .glyph):
+        (.status-bar-item.scripts-debugger-show-hide-button.toggled-shown > .glyph):
+        (.status-bar-item.scripts-debugger-show-hide-button.toggled-hidden > .glyph):
+
+2012-05-15  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        NEONizing forceValidPreMultipliedPixels
+        https://bugs.webkit.org/show_bug.cgi?id=86468
+
+        Reviewed by Nikolas Zimmermann.
+
+        Optimize forceValidPreMultipliedPixels with ARM-NEON intrinsics.
+
+        Existing tests cover this feature.
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::forceValidPreMultipliedPixels):
+
+2012-05-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: remove unnecessary setTimeout in HeapSnapshotGridNodes.js
+        https://bugs.webkit.org/show_bug.cgi?id=86464
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/HeapSnapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.childrenRetrieved): Posting
+        a message to worker is already asynchronous, no need to postpone the call via setTimeout.
+        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren):
+
+2012-05-15  Florin Malita  <fmalita@chromium.org>
+
+        Mask deformations when masked content is rotated
+        https://bugs.webkit.org/show_bug.cgi?id=76527
+
+        Reviewed by Nikolas Zimmermann.
+
+        Test: svg/repaint/mask-clip-target-transform.svg
+
+        RenderSVGResource::markForLayoutAndParentResourceInvalidation() needs to also
+        invalidate parent mask and clip resources, not just filters.
+
+        * rendering/svg/RenderSVGResource.cpp:
+        (WebCore::removeFromCacheAndInvalidateDependencies):
+        (WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation):
+
+2012-05-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: merge show navigator with pin navigator buttons.
+        https://bugs.webkit.org/show_bug.cgi?id=86469
+
+        Reviewed by Vsevolod Vlasov.
+
+        See screenshots attached to the bug.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/Images/navigatorPinButton.png: Removed.
+        * inspector/front-end/Images/navigatorShowHideButton.png:
+        * inspector/front-end/NavigatorOverlayController.js:
+        (WebInspector.NavigatorOverlayController.prototype._toggleNavigator):
+        (WebInspector.NavigatorOverlayController.prototype.set _pinNavigator):
+        (WebInspector.NavigatorOverlayController.prototype.set showNavigatorOverlay):
+        (WebInspector.NavigatorOverlayController.prototype.hideNavigatorOverlay):
+        (WebInspector.NavigatorOverlayController.prototype._containingElementFocused):
+        * inspector/front-end/SidebarOverlay.js:
+        (WebInspector.SidebarOverlay):
+        (WebInspector.SidebarOverlay.prototype.show):
+        (WebInspector.SidebarOverlay.prototype.hide):
+        * inspector/front-end/navigatorView.css:
+        (.navigator-tabbed-pane .tabbed-pane-header-contents):
+        * inspector/front-end/scriptsPanel.css:
+        (.status-bar-item.scripts-navigator-show-hide-button > .glyph):
+        (.status-bar-item.scripts-navigator-show-hide-button.toggled-shown > .glyph):
+        (.status-bar-item.scripts-navigator-show-hide-button.toggled-overlay > .glyph):
+        (button.status-bar-item.scripts-navigator-show-hide-button):
+        (button.status-bar-item.scripts-navigator-show-hide-button.toggled-overlay):
+
+2012-05-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: implement "Reveal in Dominators view" context menu action
+        https://bugs.webkit.org/show_bug.cgi?id=86455
+
+        Reviewed by Pavel Feldman.
+
+        Implemented "Reveal in Dominators view" context menu action for objects
+        in the console.
+
+        Test: inspector/profiler/heap-snapshot-reveal-in-dominators-view.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshot.prototype._nodeForSnapshotObjectId):
+        (WebInspector.HeapSnapshot.prototype.nodeClassName):
+        (WebInspector.HeapSnapshot.prototype.dominatorIdsForNode):
+        * inspector/front-end/HeapSnapshotDataGrids.js:
+        (WebInspector.HeapSnapshotDominatorsDataGrid):
+        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.setDataSource):
+        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.sortingChanged):
+        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.highlightObjectByHeapSnapshotId.didGetDominators):
+        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.highlightObjectByHeapSnapshotId.expandNextDominator):
+        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.highlightObjectByHeapSnapshotId):
+        * inspector/front-end/HeapSnapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype.childForPosition):
+        (WebInspector.HeapSnapshotGridNode.prototype.expandWithoutPopulate):
+        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.childrenRetrieved):
+        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort):
+        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.retrieveChildBySnapshotObjectId):
+        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.retrieveChildBySnapshotObjectId.didGetNodePosition):
+        (WebInspector.HeapSnapshotDominatorObjectNode.prototype.retrieveChildBySnapshotObjectId.didPopulateChildren):
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.HeapSnapshotProxy.prototype.dominatorIdsForNode):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.revealInSummaryView):
+        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.didReceiveHeapObjectId):
+        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu):
+
+2012-05-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: exception when switching to heap profiler comparison view
+        https://bugs.webkit.org/show_bug.cgi?id=86224
+
+        Reviewed by Pavel Feldman.
+
+        Make sure the messages are dispatched in the same order as they are sent in
+        case a fake worker is used for heap snapshot processing.
+
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.TimerQueue):
+        (WebInspector.TimerQueue.prototype.addTask):
+        (WebInspector.TimerQueue.prototype._onTimeout):
+        (WebInspector.TimerQueue.prototype._scheduleTimer):
+        (WebInspector.HeapSnapshotFakeWorker):
+        (WebInspector.HeapSnapshotFakeWorker.prototype.postMessage):
+        (WebInspector.HeapSnapshotFakeWorker.prototype._postMessageFromWorker):
+
+2012-05-15  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        The ARM NEON optimized filters does not compile on THUMB2
+        https://bugs.webkit.org/show_bug.cgi?id=86457
+
+        Reviewed by Csaba Osztrogonác.
+
+        We should disable the compilation on Thumb2 until we fix the code.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::platformArithmeticSoftware):
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::platformApplyWorker):
+        (WebCore::FEGaussianBlur::platformApply):
+        * platform/graphics/filters/FELighting.cpp:
+        (WebCore::FELighting::platformApply):
+        * platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp:
+        * platform/graphics/filters/arm/FECompositeArithmeticNEON.h:
+        * platform/graphics/filters/arm/FEGaussianBlurNEON.cpp:
+        * platform/graphics/filters/arm/FEGaussianBlurNEON.h:
+        * platform/graphics/filters/arm/FELightingNEON.cpp:
+        * platform/graphics/filters/arm/FELightingNEON.h:
+
+2012-05-15  MORITA Hajime  <morrita@google.com>
+
+        Kill unnecessary RuntimeEnabledFeatures.h inclusion
+        https://bugs.webkit.org/show_bug.cgi?id=86451
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. No behavior change.
+
+        * dom/Element.cpp:
+        * dom/ElementShadow.cpp:
+        * dom/TreeScope.cpp:
+
+2012-05-14  Shinya Kawanaka  <shinyak@chromium.org> 
+
+        document.execCommand('Indent') in the direct child of ShadowRoot causes a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=86341
+
+        Reviewed by Ryosuke Niwa.
+
+        When document.execCommand('Indent') is executed in the direct child of ShadowRoot,
+        the scope variable of TextIterator becomes ShadowRoot. However, an element is assumed for it,
+        so a crash happended.
+
+        This patch enables TextIterator to have ShadowRoot as a scope variable.
+
+        Test: editing/shadow/execcommand-indent-in-shadow.html
+
+        * WebCore.exp.in:
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength):
+        * editing/TextIterator.h:
+        (TextIterator):
+        * editing/htmlediting.cpp:
+        (WebCore::indexForVisiblePosition):
+        (WebCore::visiblePositionForIndex):
+        * editing/htmlediting.h:
+        (WebCore):
+
+2012-05-14  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Node::shadowTreeRootNode() should return ShadowRoot instead of Node.
+        https://bugs.webkit.org/show_bug.cgi?id=86428
+
+        Reviewed by Hajime Morita.
+
+        Since Node::shadowTreeRootNode() returns only ShadowRoot or 0 now, its return type should be ShadowRoot.
+        This patch changes the return type and adds include directive to build.
+
+        No new tests, no change in behavior.
+
+        * dom/Node.cpp:
+        (WebCore::Node::shadowAncestorNode):
+        (WebCore::Node::shadowTreeRootNode):
+        * dom/Node.h:
+        (WebCore):
+        (Node):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        * dom/Range.cpp:
+        (WebCore::Range::shadowTreeRootNode):
+        * dom/Range.h:
+        (Range):
+        * editing/Editor.cpp:
+        * editing/TextIterator.cpp:
+        * editing/htmlediting.cpp:
+        * html/shadow/ContentSelectorQuery.cpp:
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::parseAttribute):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::detach):
+        * page/EventHandler.cpp:
+
+2012-05-14  Luke Macpherson  <macpherson@chromium.org>
+
+        Make StyleResolver::applyMatchedProperties and ::applyProperties use enum template parameter instead of bool.
+        https://bugs.webkit.org/show_bug.cgi?id=86424
+
+        Reviewed by Dimitri Glazkov.
+
+        This patch changes from using a boolean template parameter for StyleResolver::applyMatchedProperties and
+        StyleResolver::applyProperties functions. The motivation for this change is that it paves the way for
+        CSS Variables to make the value tri-state, which is a requirement because variable definitions must occur
+        before high priority CSS properties such that they can be referenced by the latter. This change affects
+        only the type signatures of those functions, and not their behavior.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleResolver.h:
+
+2012-05-14  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] Get rid of ContentDistribution::Item
+        https://bugs.webkit.org/show_bug.cgi?id=86350
+
+        This change replaces the linked list on ContentDistribution with a Vector.
+        We no longer link item class ContentDistribution::Item.
+        This simplification also allows ContentDistribution to go.
+        ContentDistribution is now just a typedef of Vector<RefPtr<Node> >.
+
+        Reviewed by Dimitri Glazkov.
+
+        No new tests. Covered by existing tests.
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseNode):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
+        * dom/ElementShadow.cpp:
+        * dom/ElementShadow.h:
+        (ElementShadow):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::nextRendererOfInsertionPoint):
+        (WebCore::previousRendererOfInsertionPoint):
+        (WebCore::firstRendererOfInsertionPoint):
+        (WebCore::lastRendererOfInsertionPoint):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::distribute):
+        (WebCore::ContentDistributor::clearDistribution):
+        (WebCore::ContentDistributor::findInsertionPointFor):
+        * html/shadow/ContentDistributor.h:
+        (WebCore):
+        (ContentDistributor):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::InsertionPoint):
+        (WebCore::InsertionPoint::attachDistributedNode):
+        (WebCore::InsertionPoint::assignShadowRoot):
+        (WebCore::InsertionPoint::nextTo):
+        (WebCore):
+        (WebCore::InsertionPoint::previousTo):
+        * html/shadow/InsertionPoint.h: Added a set of delegate method to m_distribution.
+        (WebCore::InsertionPoint::hasDistribution):
+        (WebCore::InsertionPoint::indexOf):
+        (WebCore::InsertionPoint::size):
+        (WebCore::InsertionPoint::at):
+        (WebCore::InsertionPoint::first):
+        (WebCore::InsertionPoint::last):
+        (InsertionPoint):
+
+2012-05-14  Tim Horton  <timothy_horton@apple.com>
+
+        RenderLayer::repaintRectIncludingDescendants shouldn't include repaint rects of composited descendants
+        https://bugs.webkit.org/show_bug.cgi?id=86429
+        <rdar://problem/11445132>
+
+        Reviewed by Simon Fraser.
+
+        Change repaintRectIncludingDescendants to not include repaint rects for composited child layers,
+        and rename the function to make it more clear that that's what it does now.
+
+        No new tests, scrolling performance optimization.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::repaintRectIncludingNonCompositingDescendants):
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+
+2012-05-14  Gavin Peters  <gavinp@chromium.org>
+
+        Add Prerenderer, PrerenderHandle and a chromium interface for Prerendering.
+        https://bugs.webkit.org/show_bug.cgi?id=85005
+
+        Reviewed by Adam Barth.
+
+        The prerender case isn't quite a resource load, and using resource loading to
+        retrieve them has constrained the API, and unnecessarily complicated the loader.
+
+        The new Prerenderer and PrerenderHandle let <link rel=prerender...> elements signal
+        removal and unload to their platform.
+
+        No new tests, as this interface requires a full platform to work, and doesn't affect layout.  Test
+        it with your platform when implemented for it.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore):
+        (Document):
+        (WebCore::Document::prerenderer):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::removedFrom):
+        * html/LinkRelAttribute.cpp:
+        (WebCore::LinkRelAttribute::LinkRelAttribute):
+        * html/LinkRelAttribute.h:
+        (LinkRelAttribute):
+        * loader/LinkLoader.cpp:
+        (WebCore::LinkLoader::loadLink):
+        (WebCore::LinkLoader::released):
+        * loader/LinkLoader.h:
+        (WebCore):
+        (LinkLoader):
+        * loader/Prerenderer.cpp: Added.
+        (WebCore):
+        (WebCore::Prerenderer::create):
+        (WebCore::Prerenderer::Prerenderer):
+        (WebCore::Prerenderer::~Prerenderer):
+        (WebCore::Prerenderer::render):
+        (WebCore::Prerenderer::stop):
+        (WebCore::Prerenderer::suspend):
+        (WebCore::Prerenderer::resume):
+        (WebCore::Prerenderer::document):
+        (WebCore::Prerenderer::client):
+        * loader/Prerenderer.h: Copied from Source/Platform/chromium/public/WebPrerender.h.
+        (WebCore):
+        (Prerenderer):
+        * loader/PrerendererClient.cpp: Copied from Source/WebCore/html/LinkRelAttribute.h.
+        (WebCore):
+        (WebCore::PrerendererClient::supplementName):
+        (WebCore::PrerendererClient::from):
+        (WebCore::providePrerendererClientTo):
+        * loader/PrerendererClient.h: Copied from Source/WebCore/html/LinkRelAttribute.h.
+        (WebCore):
+        (PrerendererClient):
+        (WebCore::PrerendererClient::~PrerendererClient):
+        (WebCore::PrerendererClient::PrerendererClient):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::defaultPriorityForResourceType):
+        (WebCore::cachedResourceTypeToTargetType):
+        (WebCore::CachedResource::load):
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::ignoreForRequestCount):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::createResource):
+        (WebCore::CachedResourceLoader::requestLinkResource):
+        (WebCore::CachedResourceLoader::checkInsecureContent):
+        (WebCore::CachedResourceLoader::canRequest):
+        * platform/PrerenderHandle.h: Copied from Source/Platform/chromium/public/WebPrerender.h.
+        (WebCore):
+        (PrerenderHandle):
+        * platform/chromium/Prerender.cpp: Added.
+        (WebCore):
+        (WebCore::Prerender::Prerender):
+        (WebCore::Prerender::~Prerender):
+        (WebCore::Prerender::setState):
+        (WebCore::Prerender::add):
+        (WebCore::Prerender::cancel):
+        (WebCore::Prerender::abandon):
+        (WebCore::Prerender::suspend):
+        (WebCore::Prerender::resume):
+        * platform/chromium/Prerender.h: Copied from Source/Platform/chromium/public/WebPrerender.h.
+        (WebCore):
+        (Prerender):
+        (ExtraData):
+        (WebCore::Prerender::ExtraData::~ExtraData):
+        (WebCore::Prerender::url):
+        (WebCore::Prerender::referrer):
+        (WebCore::Prerender::referrerPolicy):
+        (WebCore::Prerender::setExtraData):
+        (WebCore::Prerender::extraData):
+        * platform/chromium/PrerenderHandle.cpp: Copied from Source/Platform/chromium/public/WebPrerender.h.
+        (WebCore):
+        (WebCore::PrerenderHandle::create):
+        (WebCore::PrerenderHandle::PrerenderHandle):
+        (WebCore::PrerenderHandle::~PrerenderHandle):
+        (WebCore::PrerenderHandle::prerender):
+        (WebCore::PrerenderHandle::add):
+        (WebCore::PrerenderHandle::cancel):
+        (WebCore::PrerenderHandle::abandon):
+        (WebCore::PrerenderHandle::suspend):
+        (WebCore::PrerenderHandle::resume):
+        (WebCore::PrerenderHandle::url):
+        (WebCore::PrerenderHandle::referrer):
+        (WebCore::PrerenderHandle::referrerPolicy):
+        * platform/chromium/support/WebPrerender.cpp: Copied from Source/Platform/chromium/public/WebPrerender.h.
+        (WebKit::WebPrerender::WebPrerender):
+        (WebKit):
+        (WebKit::WebPrerender::~WebPrerender):
+        (WebKit::WebPrerender::url):
+        (WebKit::WebPrerender::referrer):
+        (WebKit::WebPrerender::referrerPolicy):
+        (WebKit::WebPrerender::setExtraData):
+        (WebKit::WebPrerender::extraData):
+        * platform/network/blackberry/ResourceRequest.h:
+        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
+        (WebCore::platformTargetTypeForRequest):
+        * platform/network/chromium/ResourceRequest.h:
+
+2012-05-14  Luke Macpherson  <macpherson@chromium.org>
+
+        Introduce ENABLE_CSS_VARIABLES compile flag.
+        https://bugs.webkit.org/show_bug.cgi?id=86338
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a configuration option for CSS Variables support, disabling it by default.
+
+        No new tests. This patch only introduces an unused build flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-05-14  Eric Seidel  <eric@webkit.org>
+
+        Styles are not recalculated when the seamless attribute is dynamically added/removed
+        https://bugs.webkit.org/show_bug.cgi?id=86315
+
+        Reviewed by Andreas Kling.
+
+        Covered by fast/frames/seamless/seamless-css-cascade.html.
+
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::isPresentationAttribute):
+         - Make seamless a presentational attribute, which means style on the <iframe> will
+           be forced to recalculate when it changes.  This is correct, but not observable
+           until the layout changes are landed (as then the iframe should correctly revert to not
+           being sized to fit its content if seamless is removed).
+        (WebCore::HTMLIFrameElement::parseAttribute):
+         - When the seamless attribute is added or remove, force the content document to recalc
+           its style resolver, which will refresh the list of inherited stylesheets from the
+           parent.  This doesn't need to happen synchronously.  When the layout changes land
+           the content document will actually cause that recalc to redirect to the parent document
+           in the seamless case anyway, but it's more correct to ask the content document directly.
+
+2012-05-14  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Prevent KeyCodeConversionAndroid from breaking on next NDK roll
+        https://bugs.webkit.org/show_bug.cgi?id=86415
+
+        Reviewed by Adam Barth.
+
+        The new enum values added in this file have been added in recent
+        versions of the NDK, so this file will fail to compile with duplicate
+        enum error when we roll NDK to r7c or higher.  A workaround is
+        to move our enum values to the WebCore namespace.  When the NDK
+        upgrade is complete, we can delete them.
+
+        No new tests. (No-op change.)
+
+        * platform/chromium/KeyCodeConversionAndroid.cpp:
+        (WebCore):
+
+2012-05-14  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=86420
+        ScrollbarPainter should support expansionTransitionProgress
+
+        Reviewed by Sam Weinig.
+
+        expansionTransitionProgress works the same as 
+        uiStateTransitionProgress. This code just echoes that code, but for 
+        expansion instead of uiState.
+        * platform/mac/NSScrollerImpDetails.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        (supportsExpansionTransitionProgress):
+        (-[WebScrollbarPartAnimation setCurrentProgress:]):
+        (-[WebScrollbarPainterDelegate cancelAnimations]):
+        (-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
+        (-[WebScrollbarPainterDelegate invalidate]):
+
+2012-05-14  Andy Estes  <aestes@apple.com>
+
+        Fix RunLoopCF.cpp's copyright string.
+
+        * platform/cf/RunLoopCF.cpp:
+
+2012-05-14  Andy Estes  <aestes@apple.com>
+
+        Move the parts of RunLoopMac.mm that aren't Mac-specific into RunLoopCF.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=86411
+
+        Reviewed by Anders Carlsson.
+
+        Most of RunLoopMac.mm was written in terms of CF API. Move these bits
+        to a new file called RunLoopCF.cpp, leaving only the bits dealing with
+        NSApplication.
+
+        * WebCore.xcodeproj/project.pbxproj: Xcode decided to give
+        VisitedLinks.* new UUIDs. I'll allow it.
+        * platform/cf/RunLoopCF.cpp: Copied from Source/WebCore/platform/mac/RunLoopMac.mm.
+        * platform/mac/RunLoopMac.mm:
+
+2012-05-14  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Add "stack" property to DOMException
+        https://bugs.webkit.org/show_bug.cgi?id=85057
+
+        Reviewed by Kentaro Hara.
+
+        When we create a DOM exception we define a V8 accessor for the stack property. This
+        accessor uses a new Error object to get the underlying stack string.
+
+        Test: fast/dom/DOMException/stack-trace.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::DOMExceptionStackGetter):
+        (WebCore):
+        (WebCore::DOMExceptionStackSetter):
+        (WebCore::V8Proxy::setDOMException):
+
+2012-05-14  Michael Saboff  <msaboff@apple.com>
+
+        Enh: Add the Ability to Disable / Enable JavaScript GC Timer
+        https://bugs.webkit.org/show_bug.cgi?id=86382
+
+        Reviewed by Darin Adler.
+
+        Plumbing to set / clear JS GC activity timer enable flag.
+
+        * WebCore.exp.in:
+        * bindings/js/GCController.cpp:
+        (WebCore::GCController::setJavaScriptGarbageCollectorTimerEnabled):
+        * bindings/js/GCController.h:
+
+2012-05-14  Nate Chapin  <japhet@chromium.org>
+
+        [V8] Crash in npObjectGetProperty() in V8NPObject.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=86131
+
+        Reviewed by Adam Barth.
+
+        Tests: plugins/npruntime/delete-plugin-within-getProperty.html
+               plugins/npruntime/delete-plugin-within-hasProperty-return-false.html
+               plugins/npruntime/delete-plugin-within-hasProperty-return-true.html
+               plugins/npruntime/delete-plugin-within-invoke.html
+               plugins/npruntime/delete-plugin-within-setProperty.html
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_EvaluateHelper):
+        * bindings/v8/V8NPObject.cpp: Check NPN_IsAlive in a bunch of places we're not currently.
+        (WebCore::npObjectInvokeImpl):
+        (WebCore::npObjectGetProperty):
+        (WebCore::npObjectSetProperty):
+
+2012-05-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Unreviewed build correction.
+
+        * platform/win/DragImageCairoWin.cpp: Add missing include for
+        new NativeImageCairo.h type.
+
+2012-05-14  Takashi Sakamoto  <tasak@google.com>
+
+        Crash in WebCore::RenderObject::repaint
+        https://bugs.webkit.org/show_bug.cgi?id=86162
+
+        Reviewed by Abhishek Arya.
+
+        As RenderScrollbarPart has no parent renderer, we crash in
+        WebCore::RenderBoxModelObject::paddingLeft when paddingLeft has
+        percent value, e.g. 5%. However if we set the scrollbar's parent
+        renderer to a renderer owning the scrollbar by using setParent method,
+        RenderScrollbarPart::styleWillChange will invoke parent renderer's
+        repaint. This causes crash in WebCore::RenderObject::repaint if the
+        owning renderer is already destroyed.
+        To fix the first crash without the second crash, modify
+        RenderObject::containingBlock() to check isRenderScrollbarPart or not,
+        if parent() is 0.
+        If so, use scrollbar's owningRenderer from RenderScrollbarPart.
+
+        Test: scrollbars/scrollbar-percent-padding-crash.html
+              scrollbars/scrollbar-scrollbarparts-repaint-crash.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        Modifying containingBlock. If parent() is 0 and isRenderScrollbarPart()
+        is true, use RenderScrollbarPart's m_scrollbar->owningRenderer()
+        instead of parent().
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRenderScrollbarPart):
+        (RenderObject):
+        Adding a new method, isRenderScrollbarPart.
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::rendererOwningScrollbar):
+        (WebCore):
+        Adding a new method, scrollbarOwningRenderer to obtain m_scrollar's
+        owningRenderer.
+        * rendering/RenderScrollbarPart.h:
+        (RenderScrollbarPart):
+        Removing "friend class RenderScrollbar".
+        (WebCore::RenderScrollbarPart::isRenderScrollbarPart):
+        (WebCore::toRenderScrollbarPart):
+        (WebCore):
+        Implementing isRenderScrollbarPart and toRenderScrollbarPart.
+
+2012-05-14  Mike West  <mike@mikewest.org>
+
+        Content Security Policy console errors include violated directive.
+        https://bugs.webkit.org/show_bug.cgi?id=86323
+
+        Reviewed by Adam Barth.
+
+        Console errors generated when resources, inline script/style, or eval
+        are blocked by Content Security Policy directives should include the
+        text of the directive that's been violated. This gives developers more
+        of the information they need to resolve the issue.
+
+        Test: http/tests/security/contentSecurityPolicy/*
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
+        (WebCore::CSPDirectiveList::checkInlineAndReportViolation):
+        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
+        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
+        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
+        (WebCore::CSPDirectiveList::allowInlineScript):
+        (WebCore::CSPDirectiveList::allowInlineStyle):
+        (WebCore::CSPDirectiveList::allowEval):
+
+2012-05-14  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Crash in FrameView::windowClipRectForFrameOwner after r116371
+        https://bugs.webkit.org/show_bug.cgi?id=86035
+
+        Reviewed by David Hyatt.
+
+        Added a NULL-check for |parentView| as nothing guarantees it to be
+        non-NULL. Unfortunately no test as this is a crasher I couldn't
+        reproduce on my machine and the user logs were not helpful.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::windowClipRect):
+
+2012-05-14  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=86403
+        ASSERTION FAILED: m_verticalScrollbarPainterDelegate on recent builds
+        -and corresponding-
+        <rdar://problem/11448841>
+
+        Reviewed by Simon Fraser.
+
+        http://trac.webkit.org/changeset/116476 accidentally started calling 
+        these functions for custom scrollbars. This change replaces that 
+        guard.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::destroyScrollbar):
+
+2012-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Remove redundant pixel snapping in calculateCompositedBounds()
+        https://bugs.webkit.org/show_bug.cgi?id=86400
+
+        Reviewed by Sam Weinig.
+
+        RenderLayer::calculateLayerBounds() returns a pixel-snapped rect,
+        so we don't need to pixel-snap it again.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+
+2012-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Avoid logging related to setting shadow-related properties on a transform-only layer
+        https://bugs.webkit.org/show_bug.cgi?id=86398
+
+        Reviewed by Dan Bernstein.
+
+        When making a CATransformLayer to support transform-style: preserve-3d, avoid trying
+        to set filters on the transform layer. We should never have this combination,
+        because filters force flattening to occur.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer):
+
+2012-05-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r116983.
+        http://trac.webkit.org/changeset/116983
+        https://bugs.webkit.org/show_bug.cgi?id=86397
+
+        Does not compile on chromium-win (Requested by abarth on
+        #webkit).
+
+        * WebCore.gypi:
+        * page/TouchAdjustment.cpp:
+
+2012-05-14  Dan Bernstein  <mitz@apple.com>
+
+        Pagination splits lines that could fit on a single page if it were not for their top leading
+        https://bugs.webkit.org/show_bug.cgi?id=86388
+
+        Reviewed by Darin Adler.
+
+        Test: fast/multicol/split-in-top-margin.html
+
+        When a line’s visible content fits on a page, but adding the top leading makes it taller than
+        a page, instead of giving up and splitting the line in an arbitrary position, add a strut
+        to push it downwards so that the split occurs in the top leading, and the visible content is
+        fully contained on a single page.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+
+2012-05-14  Terry Anderson  <tdanderson@chromium.org>
+
+        [chromium] Compute the best target node on a GestureTap event
+        https://bugs.webkit.org/show_bug.cgi?id=85101
+
+        Reviewed by Adam Barth.
+
+        Using tests in the touchadjustment/ directory.
+
+        * WebCore.gypi:
+        Include TouchAdjustment.* files.
+        * page/TouchAdjustment.cpp:
+        Included math.h because of an 'Undeclared identifier: INFINITY' when
+        this patch was landed before.
+
+2012-05-14  Adrienne Walker  <enne@google.com>
+
+        [chromium] Add compositor debug asserts for blocked main thread
+        https://bugs.webkit.org/show_bug.cgi?id=86384
+
+        Reviewed by James Robinson.
+
+        Where we depend for thread-safety that the main thread is blocked,
+        assert that this is actually the case.
+
+        * platform/graphics/chromium/cc/CCProxy.cpp:
+        (WebCore):
+        (WebCore::CCProxy::isMainThreadBlocked):
+        (WebCore::CCProxy::setMainThreadBlocked):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        (WebCore):
+        (DebugScopedSetMainThreadBlocked):
+        (WebCore::DebugScopedSetMainThreadBlocked::DebugScopedSetMainThreadBlocked):
+        (WebCore::DebugScopedSetMainThreadBlocked::~DebugScopedSetMainThreadBlocked):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::doCommit):
+        (WebCore::CCSingleThreadProxy::stop):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::stop):
+        (WebCore::CCThreadProxy::beginFrame):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+
+2012-05-14  Swapna P  <spottabathini@innominds.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug: Cannot resize frames because frameborder=0
+        https://bugs.webkit.org/show_bug.cgi?id=23750
+
+        Removed check for frameborder, in order to allow resize of frames even in case of frameborder=0.
+
+        Test: fast/frames/frames-with-frameborder-zero-can-be-resized.html
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::startResizing):
+        (WebCore::RenderFrameSet::canResizeRow):
+        (WebCore::RenderFrameSet::canResizeColumn):
+
+2012-05-14  David Barton  <dbarton@mathscribe.com>
+
+        Unify RenderMathMLSquareRoot.cpp and RenderMathMLRoot.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=86319
+
+        Reviewed by Darin Adler.
+
+        Most of RenderMathMLSquareRoot.cpp is duplicated in RenderMathMLRoot.cpp and can be
+        eliminated. We also define RenderMathMLRoot::computePreferredLogicalWidths().
+
+        Test: mathml/presentation/mroot-pref-width.html
+
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::computePreferredLogicalWidths):
+        (WebCore::RenderMathMLRoot::layout):
+        (WebCore::RenderMathMLRoot::paint):
+        * rendering/mathml/RenderMathMLRoot.h:
+        * rendering/mathml/RenderMathMLSquareRoot.cpp:
+        (WebCore::RenderMathMLSquareRoot::RenderMathMLSquareRoot):
+        (WebCore::RenderMathMLSquareRoot::addChild):
+        * rendering/mathml/RenderMathMLSquareRoot.h:
+
+2012-05-14  MORITA Hajime  <morrita@google.com>
+
+        [Shadow DOM][Refactoring] HTMLContentSelector family should have better name
+        https://bugs.webkit.org/show_bug.cgi?id=86064
+
+        Reviewed by Dimitri Glazkov.
+
+        This change renames classes around shadow content distribution.
+        - Renamed HTMLContentSelector to ContentDistributor
+        - Renamed HTMLContentSelectionList to ContentDistribution
+        - Renamed HTMLContentSelection to ContentDistribution::Item
+        - Inlined HTMLContentSelectionSet into ContentDistributor
+
+        Associated rename and inlining are also happening for method names.
+
+        No new tests. No behavior change.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseNode):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
+        (WebCore::ComposedShadowTreeWalker::traverseParent):
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::ElementShadow):
+        (WebCore::ElementShadow::attach):
+        (WebCore::ElementShadow::insertionPointFor):
+        (WebCore::ElementShadow::distributionItemFor):
+        (WebCore::ElementShadow::recalcStyle):
+        (WebCore::ElementShadow::needsRedistributing):
+        (WebCore::ElementShadow::hostChildrenChanged):
+        (WebCore::ElementShadow::setNeedsRedistributing):
+        * dom/ElementShadow.h:
+        (WebCore):
+        (ElementShadow):
+        (WebCore::ElementShadow::distributor):
+        (WebCore::ElementShadow::clearNeedsRedistributing):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::nextRendererOfInsertionPoint):
+        (WebCore::previousRendererOfInsertionPoint):
+        (WebCore::firstRendererOfInsertionPoint):
+        (WebCore::lastRendererOfInsertionPoint):
+        * dom/ShadowRoot.cpp:
+        * dom/ShadowRoot.h:
+        (WebCore):
+        * html/shadow/ContentDistributor.cpp: Renamed from Source/WebCore/html/shadow/HTMLContentSelector.cpp.
+        (WebCore):
+        (WebCore::ContentDistribution::ContentDistribution):
+        (WebCore::ContentDistribution::~ContentDistribution):
+        (WebCore::ContentDistribution::find):
+        (WebCore::ContentDistribution::clear):
+        (WebCore::ContentDistribution::append):
+        (WebCore::ContentDistributor::ContentDistributor):
+        (WebCore::ContentDistributor::~ContentDistributor):
+        (WebCore::ContentDistributor::distribute):
+        (WebCore::ContentDistributor::clearDistribution):
+        (WebCore::ContentDistributor::findFor):
+        (WebCore::ContentDistributor::findInsertionPointFor):
+        (WebCore::ContentDistributor::willDistribute):
+        (WebCore::ContentDistributor::didDistribute):
+        (WebCore::ContentDistributor::preparePoolFor):
+        * html/shadow/ContentDistributor.h: Added.
+        (WebCore):
+        (ContentDistribution):
+        (Item):
+        (WebCore::ContentDistribution::Item::insertionPoint):
+        (WebCore::ContentDistribution::Item::node):
+        (WebCore::ContentDistribution::Item::next):
+        (WebCore::ContentDistribution::Item::previous):
+        (WebCore::ContentDistribution::Item::create):
+        (WebCore::ContentDistribution::Item::Item):
+        (WebCore::ContentDistribution::first):
+        (WebCore::ContentDistribution::last):
+        (WebCore::ContentDistribution::firstNode):
+        (WebCore::ContentDistribution::lastNode):
+        (WebCore::ContentDistribution::isEmpty):
+        (ContentDistributor):
+        (Translator):
+        (WebCore::ContentDistributor::Translator::hash):
+        (WebCore::ContentDistributor::Translator::equal):
+        (WebCore::ContentDistributor::Hash::hash):
+        (WebCore::ContentDistributor::Hash::equal):
+        (Hash):
+        (WebCore::ContentDistributor::inDistribution):
+        (WebCore::ContentDistributor::poolIsReady):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::parseAttribute):
+        * html/shadow/HTMLContentSelector.h: Removed.
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::InsertionPoint):
+        (WebCore::InsertionPoint::detach):
+        (WebCore::InsertionPoint::distributeHostChildren):
+        (WebCore::InsertionPoint::clearDistribution):
+        (WebCore::InsertionPoint::attachDistributedNode):
+        (WebCore::InsertionPoint::assignShadowRoot):
+        (WebCore::InsertionPoint::clearAssignment):
+        * html/shadow/InsertionPoint.h:
+        (WebCore::InsertionPoint::distribution):
+        (WebCore::InsertionPoint::hasDistribution):
+
+2012-05-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r116969.
+        http://trac.webkit.org/changeset/116969
+        https://bugs.webkit.org/show_bug.cgi?id=86386
+
+        i accidentally the icondatabase (Requested by kling on
+        #webkit).
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::synchronousIconForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::retainedPageURLCount):
+        (WebCore::IconDatabase::performURLImport):
+        (WebCore::IconDatabase::syncThreadMainLoop):
+        * loader/icon/IconDatabase.h:
+        (IconDatabase):
+
+2012-05-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix. Fix for wxMSW windows.h load order bug.
+        
+        * platform/graphics/wx/ImageBufferDataWx.h:
+
+2012-05-14  Eric Carlson  <eric.carlson@apple.com>
+
+        <video> won't load when URL ends with .php
+        https://bugs.webkit.org/show_bug.cgi?id=86308
+
+        Reviewed by Darin Adler.
+
+        Test: http/tests/media/video-query-url.html
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_typeInferredFromExtension.
+        (WebCore::MediaPlayer::load): Set m_typeInferredFromExtension appropriately.
+        (WebCore::MediaPlayer::loadWithNextMediaEngine): If we don't find a media engine registered
+            for a MIME type, and the type was inferred from the extension, give the first registered
+            media engine a chance anwyay just as we do when there is no MIME type at all.
+        * platform/graphics/MediaPlayer.h: Add m_typeInferredFromExtension.
+
+2012-05-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: do not update $0-$4 console variables for the objects from loaded from file heap snapshot.
+        https://bugs.webkit.org/show_bug.cgi?id=86371
+
+        When the user selects an object in HeapSnapshot we are updating $0 variable in console API.
+        But if the snapshot was loaded from file then we can't map object id for the selected obect
+        from the snapshot to the live objects in the inspected page.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype._inspectedObjectChanged):
+        (WebInspector.HeapSnapshotView.prototype._updateFilterOptions):
+        (WebInspector.HeapProfileHeader):
+        (WebInspector.HeapProfileHeader.prototype.canSaveToFile):
+        (WebInspector.HeapProfileHeader.prototype.saveToFile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileHeader):
+        (WebInspector.ProfileHeader.prototype.loadFromFile):
+        (WebInspector.ProfileHeader.prototype.fromFile):
+        (WebInspector.ProfilesPanel.prototype._loadFromFile):
+
+2012-05-14  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [Extensions API] allow extensions to evaluate in the context of their content scripts
+        https://bugs.webkit.org/show_bug.cgi?id=86361
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: inspector/extensions/extensions-eval-content-script.html
+
+        * inspector/front-end/ExtensionAPI.js: 
+        (injectedExtensionAPI.ExtensionSidebarPaneImpl.prototype.setExpression): Added evaluateOptions optional parameter.
+        (injectedExtensionAPI.InspectedWindow.prototype.eval):
+        (injectedExtensionAPI.extractCallbackArgument): A helper to extract callback function from last argument.
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionSidebarPane.prototype.setExpression): Added evaluateOptions optional parameter.
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onSetSidebarContent): Use ExtensionServer.evaluate() wrapper.
+        (WebInspector.ExtensionServer.prototype._onEvaluateOnInspectedPage): Ditto.
+        (WebInspector.ExtensionServer.prototype._normalizePath):
+        (WebInspector.ExtensionServer.prototype.evaluate): A wrapper for PageAgent.evaluate() that handles evaluateOptions.
+        * inspector/front-end/JavaScriptContextManager.js:
+        (WebInspector.JavaScriptContextManager.prototype.contextByFrameAndSecurityOrigin): Expose interface to locate context id by frame and content script security origin.
+        (WebInspector.FrameEvaluationContext.prototype._addExecutionContext): Maintain contexts sorted by name.
+        (WebInspector.FrameEvaluationContext.prototype.isolatedContexts): ditto (skip sorting when returning contexts)
+        (WebInspector.FrameEvaluationContext.prototype.contextBySecurityOrigin):
+        * inspector/front-end/inspector.js: Hold/expose javaScriptContextManager.
+
+2012-05-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: preserve tab index while widening / shrinking tabbed pane area.
+        https://bugs.webkit.org/show_bug.cgi?id=86359
+
+        Reviewed by Vsevolod Vlasov.
+
+        After the drag'n'drop reorder, we should preserve tab index while widening /
+        shrinking the tabbed pane area.
+
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPane.prototype._innerCloseTab):
+        (WebInspector.TabbedPane.prototype._showTabElement):
+        (WebInspector.TabbedPane.prototype._hideTabElement):
+        (WebInspector.TabbedPane.prototype._updateTabsDropDown):
+        (WebInspector.TabbedPane.prototype.elementsToRestoreScrollPositionsFor):
+        (WebInspector.TabbedPane.prototype._insertBefore):
+        (WebInspector.TabbedPaneTab):
+        (WebInspector.TabbedPaneTab.prototype._createTabElement):
+        (WebInspector.TabbedPaneTab.prototype._tabDragging):
+
+2012-05-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Request / response headers should be stored in name-value pairs array, not a map on front-end.
+        https://bugs.webkit.org/show_bug.cgi?id=86357
+
+        Reviewed by Pavel Feldman.
+
+        Storing headers as name-value pairs array information more accurate and allows
+        to treat Set-Cookie headers (which become not parseable when joined by comma) correctly.
+
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.GzipRule.prototype._isCompressed):
+        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeader):
+        (WebInspector.AuditRules.CacheControlRule.prototype.hasResponseHeader):
+        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeaderMatch):
+        * inspector/front-end/HAREntry.js:
+        (WebInspector.HAREntry.prototype._buildRequest):
+        (WebInspector.HAREntry.prototype._buildResponse):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._headersMapToHeadersArray):
+        (WebInspector.NetworkDispatcher.prototype._updateNetworkRequestWithRequest):
+        (WebInspector.NetworkDispatcher.prototype._updateNetworkRequestWithResponse):
+        (WebInspector.NetworkDispatcher.prototype.webSocketWillSendHandshakeRequest):
+        (WebInspector.NetworkDispatcher.prototype.webSocketHandshakeResponseReceived):
+        * inspector/front-end/NetworkRequest.js:
+        (WebInspector.NetworkRequest.prototype.get transferSize):
+        (WebInspector.NetworkRequest.prototype.get requestHeaders):
+        (WebInspector.NetworkRequest.prototype.get requestHeadersText):
+        (WebInspector.NetworkRequest.prototype.get responseHeaders):
+        (WebInspector.NetworkRequest.prototype.get responseHeadersText):
+        (WebInspector.NetworkRequest.prototype._headerValue):
+        * inspector/front-end/RequestHeadersView.js:
+        (WebInspector.RequestHeadersView.prototype._refreshRequestHeaders):
+        (WebInspector.RequestHeadersView.prototype._refreshResponseHeaders):
+        (WebInspector.RequestHeadersView.prototype._refreshHeaders):
+        * platform/chromium/support/WebHTTPLoadInfo.cpp:
+        (WebKit::addHeader):
+
+2012-05-14  Sriram Neelakandan  <sriram.neelakandan@gmail.com>
+
+        [Gtk][DOM Bindings] Feature-protected interface usage in set/get property must be under condition guards
+        https://bugs.webkit.org/show_bug.cgi?id=86060
+
+        Reviewed by Martin Robinson.
+
+        Property set/get functions generated was referencing WebCore::interface without any condition guard.
+        This issue was triggered usually when an interface gets disabled; For instance; --disable-video, disables WebCore::HTMLMediaElement.
+        Also updated the GObject binding reference tests
+
+        No new tests - covered by existing bindings tests
+
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GenerateProperties):
+        * bindings/scripts/test/GObject/WebKitDOMTestActiveDOMObject.cpp:
+        (webkit_dom_test_active_dom_object_get_property):
+        * bindings/scripts/test/GObject/WebKitDOMTestEventConstructor.cpp:
+        (webkit_dom_test_event_constructor_get_property):
+        * bindings/scripts/test/GObject/WebKitDOMTestException.cpp:
+        (webkit_dom_test_exception_get_property):
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
+        (webkit_dom_test_interface_set_property):
+        (webkit_dom_test_interface_get_property):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_set_property):
+        (webkit_dom_test_obj_get_property):
+        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp:
+        (webkit_dom_test_serialized_script_value_interface_get_property):
+
+2012-05-14  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] css properties copied into clipboard contain extra line breaks before color values
+        https://bugs.webkit.org/show_bug.cgi?id=86372
+
+        Reviewed by Vsevolod Vlasov.
+
+        The "display: block" property found in the ".swatch-inner" CSS class was causing the issue
+        (an additional \n was rendered in the plain text value).
+
+        * inspector/front-end/inspector.css:
+        (.swatch-inner):
+
+2012-05-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        [Qt] REGRESSION (r116789): inspector/debugger/script-formatter-console.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=86336
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype.location):
+
+2012-05-14  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        TiledBackingStore: Prevent partial tile updates when they intersect the keep rect.
+        https://bugs.webkit.org/show_bug.cgi?id=85488
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Right now an invalidate can cause problems for tiles on the boundary of the keep
+        rect. Intersecting the dirty rect causes only part of the tile to be updated,
+        and the glitch becomes visible if the user scrolls this tile back into the viewport.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::invalidate):
+
+2012-05-14  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Esc should revert the colorpicker-modifed color to the original
+        https://bugs.webkit.org/show_bug.cgi?id=86349
+
+        Reviewed by Vsevolod Vlasov.
+
+        A boolean parameter has been added to the Spectrum's hide() method to denote the picker cancellation,
+        which gets passed into the "Hidden" event listeners. StylesSidebarPane is made to remember the original property value
+        when the picker is opened, and restore it if the color picker is cancelled.
+
+        * inspector/front-end/Spectrum.js:
+        (WebInspector.Spectrum):
+        (WebInspector.Spectrum.prototype.toggle):
+        (WebInspector.Spectrum.prototype.show):
+        (WebInspector.Spectrum.prototype.hide):
+        (WebInspector.Spectrum.prototype._onKeyDown):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype.willHide):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+
+2012-05-14  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] TextureMapperGL::drawTexture marked OVERRIDE but does not override any member function.
+        https://bugs.webkit.org/show_bug.cgi?id=86347
+
+        This bug was introduced by r116834.
+        TextureMapperGL implements two drawTexture functions.
+        The first one takes a BitmapTexture as an argument and does override TextureMapper::drawTexture().
+        The second one takes a texture id as an argument and does not override any member function.
+
+        * platform/graphics/texmap/TextureMapperGL.h:
+
+2012-05-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: implement tabs reordering via drag'n'drop.
+        https://bugs.webkit.org/show_bug.cgi?id=86294
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPaneTab.prototype._createTabElement):
+        (WebInspector.TabbedPaneTab.prototype._tabClicked):
+        (WebInspector.TabbedPaneTab.prototype._tabMouseDown):
+        (WebInspector.TabbedPaneTab.prototype._tabContextMenu):
+        (WebInspector.TabbedPaneTab.prototype._tabMouseMove):
+        (WebInspector.TabbedPaneTab.prototype._tabDragging):
+        (WebInspector.TabbedPaneTab.prototype._endTabDragging):
+
+2012-05-14  MORITA Hajime  <morrita@google.com>
+
+        Should have Node::inDetach() for assertion purposes.
+        https://bugs.webkit.org/show_bug.cgi?id=86157
+
+        Reviewed by Darin Adler.
+
+        Implemented Node::inDetach() and added an assertio in Document::setFocusedNode().
+        This is a follow up of r116644 which removes inDetach() checking.
+
+        No new tests. Just adding an asssertion.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Node.cpp:
+        (WebCore):
+        (WebCore::Node::inDetach):
+        (WebCore::Node::detach):
+        * dom/Node.h:
+        (Node):
+
+2012-05-13  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Remove platform/image-decoders/xbm from WebCore.gyp
+        https://bugs.webkit.org/show_bug.cgi?id=86333
+
+        Reviewed by Adam Barth.
+
+        No new tests. No change in behavior.
+
+        * WebCore.gyp/WebCore.gyp: Remove reference to platform/image-decoders/xbm
+        since that directory was removed from the repository long ago.
+
+2012-05-13  Darin Adler  <darin@apple.com>
+
+        [CG] Unneeded CFRetain/Release of CGImageRef in BitmapImage::draw
+        https://bugs.webkit.org/show_bug.cgi?id=86332
+
+        Reviewed by Dan Bernstein.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw): Don't use RetainPtr since the result of
+        the function is used before anything could call CFRelease on it.
+
+2012-05-13  Darin Adler  <darin@apple.com>
+
+        Listeners map uses raw pointers, but should use OwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=86298
+
+        Reviewed by Dan Bernstein.
+
+        * bindings/js/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::~PageScriptDebugServer): Removed call
+        to deleteAllValues since the destructor now takes care of this
+        (WebCore::PageScriptDebugServer::addListener): Changed idiom of the add
+        function call here to use adoptPtr.
+        (WebCore::PageScriptDebugServer::removeListener): Added a now-needed
+        call to get and removed a now-uneeeded call to delete.
+        * bindings/js/PageScriptDebugServer.h: Changed the key type of
+        PageListenersMap to OwnPtr.
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::~ScriptDebugServer): Removed code to delete
+        the values in m_pageListenersMap. This map was never used and so I have
+        removed it.
+        * bindings/js/ScriptDebugServer.h: Removed the type PageListenersMap
+        and the unused data member, m_pageListenersMap.
+
+2012-05-13  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Move ValidityState methods implementation to another place
+        https://bugs.webkit.org/show_bug.cgi?id=86058
+
+        Reviewed by Kent Tamura.
+
+        This patch changes ValidityState class for limiting scope of
+        number/range input type related methods for introducing decimal
+        arithmetic.
+
+        Methods related to validation are moved from ValidateState to
+        input, select and textarea elements with virtual method based
+        dispatching via FormAssociateElement instead of tag name
+        dispatching so far for code simplification.
+
+        No new tests. This patch doesn't change behavior.
+
+        * html/FormAssociatedElement.cpp:
+        (WebCore::FormAssociatedElement::customError): Added. Called from ValidateState. Returns custom error mssage in member variable.
+        (WebCore::FormAssociatedElement::patternMismatch): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::rangeOverflow): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::rangeUnderflow): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::stepMismatch): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::tooLong): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::typeMismatch): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::valid): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::valueMissing): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::customValidationMessage): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::validationMessage): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::setCustomValidity): Added.  set custom error message.
+        * html/FormAssociatedElement.h:
+        (FormAssociatedElement): Added new instance value m_customValidationMessage.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::validationMessage): Removed. Note: HTMLInputElement, HTMLSelectElement, and HTMLTextAreaElement implement this method.
+        (WebCore::HTMLFormControlElement::setCustomValidity): Changed. Calls base class setCustomValidity.
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isValidValue): Call m_inputType methods instead of HTMLInputElement's.
+        (WebCore::HTMLInputElement::tooLong): Call m_inputType methods instead of HTMLInputElement's.
+        (WebCore):
+        (WebCore::HTMLInputElement::typeMismatch): Move implementation to InputType.
+        (WebCore::HTMLInputElement::valueMissing):  Move implementation to InputType.
+        (WebCore::HTMLInputElement::patternMismatch): Move implementation to InputType.
+        (WebCore::HTMLInputElement::rangeUnderflow): Move implementation to InputType.
+        (WebCore::HTMLInputElement::rangeOverflow): Move implementation to InputType.
+        (WebCore::HTMLInputElement::validationMessage): Move implementation to InputType.
+        (WebCore::HTMLInputElement::stepMismatch): Move implementation to InputType.
+        (WebCore::HTMLInputElement::isInRange): Call m_inputType methods instead of HTMLInputElement's.
+        (WebCore::HTMLInputElement::isOutOfRange): Call m_inputType methods instead of HTMLInputElement's.
+        * html/HTMLInputElement.h:
+        (HTMLInputElement): Make tooLong method private.
+        * html/HTMLObjectElement.h: Add "virtual" and "OVERRIDE".
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::validationMessage): Added. Implementation for HTMLSelectElement.
+        (WebCore::HTMLSelectElement::valueMissing): Added. Implementation for HTMLSelectElement.
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):  Added entries for newly added methods.
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::validationMessage): Added. Implementation for HTMLTextAreaElement.
+        (WebCore::HTMLTextAreaElement::valueMissing): Added. Implementation for HTMLTextAreaElement.
+        (WebCore::HTMLTextAreaElement::tooLong): Added. Implementation for HTMLTextAreaElement.
+        * html/HTMLTextAreaElement.h:
+        (HTMLTextAreaElement): Added entries for newly added methods. Change tooLong and valueMissing private.
+        * html/InputType.cpp:
+        (WebCore::InputType::stepMismatch): Change method signature.
+        (WebCore::InputType::alignValueForStep):  Changed for calling InputClass instead of HTMLINputElement.
+        (WebCore::InputType::stepUpFromRenderer):  Added. Moved from HTMLInputElement.
+        (WebCore::InputType::validationMessage): Added.  Moved from HTMLInputElement.
+        * html/InputType.h:
+        (InputType): Added entries for newly added methods and update methods signature.
+        * html/ValidityState.cpp: Move actual implementation to FormAssociatedElement and derived classes for localizing implementation change of elements and input types.
+        (WebCore::ValidityState::validationMessage): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::valueMissing): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::typeMismatch): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::patternMismatch): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::tooLong): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::rangeUnderflow): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::rangeOverflow): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::stepMismatch): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::customError): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::valid):
+        * html/ValidityState.h:
+        (ValidityState): Remove custom validation message related things.
+
+2012-05-13  Mike Lawther  <mikelawther@chromium.org>
+
+        Heap-use-after-free in WTF::HashMap<int, WTF::RefPtr<WebCore::CalculationValue>, WTF::IntHash<unsigned int>, WTF::HashTrait
+        https://bugs.webkit.org/show_bug.cgi?id=85195
+
+        This bug was caused by Length not understanding that calc expressions shouldn't be 
+        blended - a Length with a calc expression handle was created without incrementing
+        the ref count of the expression. Length no longer attempts to blend calc expressions,
+        http://webkit.org/b/86160 has been filed to track expression blending. Fixing this fixed
+        the crash.
+
+        Once this was fixed, the RenderStyle diff checker thought the style was changing,
+        as Length didn't know how to compare calc expressions, resulting in an infinite
+        loop of style recalcs. Expressions can now compare themselves.
+
+        Reviewed by Darin Adler.
+
+        Tests: css3/calc/transition-crash.html
+               css3/calc/transition-crash2.html
+
+        * platform/CalculationValue.h:
+        (WebCore::CalcExpressionNode::CalcExpressionNode):
+        (CalcExpressionNode):
+        (WebCore::CalcExpressionNode::type):
+        (CalculationValue):
+        (WebCore::CalculationValue::operator==):
+        (WebCore::CalcExpressionNumber::CalcExpressionNumber):
+        (WebCore::CalcExpressionNumber::operator==):
+        (CalcExpressionNumber):
+        (WebCore::CalcExpressionLength::CalcExpressionLength):
+        (WebCore::CalcExpressionLength::operator==):
+        (CalcExpressionLength):
+        (WebCore::CalcExpressionBinaryOperation::CalcExpressionBinaryOperation):
+        (WebCore::CalcExpressionBinaryOperation::operator==):
+        (CalcExpressionBinaryOperation):
+        * platform/Length.cpp:
+        (WebCore::Length::isCalculatedEqual):
+        (WebCore):
+        * platform/Length.h:
+        (WebCore::Length::operator==):
+        (Length):
+        (WebCore::Length::blend):
+
+2012-05-13  Darin Adler  <darin@apple.com>
+
+        Roll out local changes accidentally landed in r116905.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/cg/ImageCG.cpp:
+
+2012-05-13  Rob Buis  <rbuis@rim.com>
+
+        Use emptyString instead of String("")
+        https://bugs.webkit.org/show_bug.cgi?id=86305
+
+        Reviewed by Darin Adler.
+
+        Use emptyString() instead of String("") because it is better style and faster.
+
+        No new tests. No change in behavior.
+
+        * Modules/webdatabase/AbstractDatabase.cpp:
+        (WebCore::AbstractDatabase::performOpenAndVerify):
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::subprotocol):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::extensions):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * platform/SharedBufferChunkReader.cpp:
+        (WebCore::SharedBufferChunkReader::nextChunkAsUTF8StringWithLatin1Fallback):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setProxyInfo):
+        * platform/text/LocaleICU.cpp:
+        (WebCore::LocaleICU::initializeLocalizedDateFormatText):
+        * rendering/RenderQuote.cpp:
+        (WebCore::RenderQuote::originalText):
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        * svg/SVGStringList.cpp:
+        (WebCore::SVGStringList::reset):
+
+2012-05-13  Darin Adler  <darin@apple.com>
+
+        Image::initPlatformData is always an empty function so we can remove it
+        https://bugs.webkit.org/show_bug.cgi?id=86297
+
+        Reviewed by Dan Bernstein.
+
+        * platform/graphics/BitmapImage.h: Removed declaration of initPlatformData.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage): Removed call to initPlatformData.
+        * platform/graphics/cairo/BitmapImageCairo.cpp:
+        (WebCore::BitmapImage::BitmapImage): Ditto.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::BitmapImage): Ditto.
+        * platform/graphics/chromium/ImageChromiumMac.mm: Removed empty
+        initPlatformData function.
+        * platform/graphics/efl/ImageEfl.cpp: Ditto.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        * platform/graphics/mac/ImageMac.mm:
+        * platform/graphics/openvg/ImageOpenVG.cpp:
+        (WebCore::BitmapImage::BitmapImage): Removed call to initPlatformData.
+        Removed empty initPlatformData function.
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::BitmapImage): Removed call to initPlatformData.
+        Removed empty initPlatformData function.
+        * platform/graphics/skia/ImageSkia.cpp: Removed empty initPlatformData function.
+        * platform/graphics/win/ImageWin.cpp: Ditto.
+        * platform/graphics/wx/ImageWx.cpp: Ditto.
+        (WebCore::BitmapImage::BitmapImage): Removed call to initPlatformData.
+
+2012-05-13  Darin Adler  <darin@apple.com>
+
+        RenderView::selectionBounds and RenderView::setSelection use maps with raw pointers that should be OwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=86300
+
+        Reviewed by Eric Seidel.
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds): Changed SelectionMap type to use OwnPtr.
+        Added code to do adoptPtr as needed and removed explicit delete code.
+        (WebCore::RenderView::setSelection): Changed SelectedBlockMap type to use OwnPtr.
+        Added code to do adoptPtr as needed and removed explicit delete code.
+
+2012-05-13  Darin Adler  <darin@apple.com>
+
+        FractionalLayoutUnit class has unneeded redundant uses of "inline" keyword
+        https://bugs.webkit.org/show_bug.cgi?id=86301
+
+        Reviewed by Andreas Kling.
+
+        * platform/FractionalLayoutUnit.h: Removed uses of inline for functions
+        defined inside a class definition. The C++ language defines that all such
+        functions are treated as if specified with inline, and explicitly stating
+        inline in addition does not add anything or change behavior.
+
+2012-05-13  Darin Adler  <darin@apple.com>
+
+        Dangling node to ID maps vector uses raw pointers, but should use OwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=86299
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::releaseDanglingNodes): Removed now-unneeded call
+        to deleteAllValues since the clear function now takes care of that.
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend): Added code that uses
+        adoptPtr and release as neeed to deal with a Vector<OwnPtr>.
+        * inspector/InspectorDOMAgent.h: Changed m_danglingNodeToIdMaps to be
+        Vector<OwnPtr> instead of a vector of raw pointers.
+
+2012-05-13  Victor Carbune  <vcarbune@adobe.com>
+
+        Volume slider needs to be displayed below the mute button
+        https://bugs.webkit.org/show_bug.cgi?id=85990
+
+        Reviewed by Dimitri Glazkov.
+
+        Added back code for rendering offset, but used only when the volume slider
+        needs to be displayed below the controls.
+
+        Test: media/media-volume-slider-rendered-below.html
+
+        * css/mediaControlsChromium.css:
+        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
+        Changed positioning of the slider to absolute, otherwise it is not possible to position it from the layout() method.
+        * css/mediaControlsQuickTime.css:
+        Added back the double mute-button and changed the z-index of the original button. When the slider is displayed
+        the second mute button is actually there.
+        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
+        (audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button):
+        Added copy.
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlPanelElement::makeTransparent): Disabled the possible of hiding controls. WebVTT rendering
+        in the place of controls when these are visible is not possible with the current code.
+        (RenderMediaVolumeSliderContainer):
+        (WebCore):
+        (WebCore::RenderMediaVolumeSliderContainer::RenderMediaVolumeSliderContainer):
+        (WebCore::RenderMediaVolumeSliderContainer::layout):
+        Checked if the absolute coordinates of the corner of the slider would be rendered outside the page. This part of the
+        code is faulty if display:none is toggled on the controls.
+        (WebCore::MediaControlVolumeSliderContainerElement::createRenderer):
+        * html/shadow/MediaControlElements.h:
+        (MediaControlVolumeSliderContainerElement):
+        * html/shadow/MediaControlRootElement.cpp:
+        (WebCore::MediaControlRootElement::create):
+
+2012-05-13  Igor Oliveira  <igor.o@sisa.samsung.com>
+
+        [Texmap] TextureMapperAnimations does not support keyframe with multiple animations
+        https://bugs.webkit.org/show_bug.cgi?id=86303
+
+        Qt and GTK, in WebKit1, use TextureMapper to store AC animations using
+        TextureMapperAnimations::add(keyframeName, TextureMapperAnimation). And when a 
+        CSS animation animates several CSS properties, TextureMapperAnimations::add is
+        called more than once with the same keyframeName value. However, currently,
+        TextureMapperAnimations can not store more than one animated property in the keyframe
+        because it is using HashMap<String, TextureMapperAnimation>, and WebKit HashMap 
+        does not support add the same key twice.
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/texmap/TextureMapperAnimation.cpp:
+        (WebCore::TextureMapperAnimations::hasActiveAnimationsOfType):
+        (WebCore::TextureMapperAnimations::hasRunningAnimations):
+        (WebCore::TextureMapperAnimations::add):
+        (WebCore):
+        (WebCore::TextureMapperAnimations::pause):
+        (WebCore::TextureMapperAnimations::apply):
+        * platform/graphics/texmap/TextureMapperAnimation.h:
+        (TextureMapperAnimations): Use HashMap<String, Vector<TextureMapperAnimation> >,
+        so we can support an keyframe with multiple animations.
+
+2012-05-12  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in HTMLSelectElement::setOption
+        https://bugs.webkit.org/show_bug.cgi?id=85420
+
+        Reviewed by Eric Seidel
+        
+        RefPtr before option in HTMLSelectElement::setOption since it
+        can get destroyed due to mutation events.
+
+        Test: fast/dom/HTMLSelectElement/option-add-crash.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setOption):
+
+2012-05-12  Robin Dunn  <robin@alldunn.com>
+
+        [wx] Restore text paste implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=86311
+
+        Reviewed by Kevin Ollivier.
+
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::plainText):
+
+2012-05-12  Philip Rogers  <pdr@google.com>
+
+        Cleanup before changing attributeName in SVG <animate>
+        https://bugs.webkit.org/show_bug.cgi?id=86100
+
+        Reviewed by Nikolas Zimmermann.
+
+        Changing attributeName caused a crash because references were not removed from the old target.
+        This change simply cleans up before changing attributeName in SVG animation elements.
+
+        Test: svg/animations/dynamic-modify-attributename-crash.svg
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::svgAttributeChanged):
+
+2012-05-12  Max Feil  <mfeil@rim.com>
+
+        [BlackBerry] Allow the platform media player to determine the media element's paused/playing status
+        https://bugs.webkit.org/show_bug.cgi?id=86235
+
+        Reviewed by George Staikos.
+
+        The platform media player needs to know when the HTMLMediaElement
+        is not paused. This is to address problems when switching
+        source element, which causes the destruction of the old
+        MediaPlayerPrivate object and construction of a new one. The
+        new one must resume playing ASAP if the old one was playing.
+
+        Test: media/media-continues-playing-after-replace-source.html
+
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
+        (WebCore::MediaPlayerPrivate::isElementPaused):
+        (WebCore):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
+        (MediaPlayerPrivate):
+
+2012-05-12  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: heap profiler should allow revealing an element which is logged to the console
+        https://bugs.webkit.org/show_bug.cgi?id=86204
+
+        Reviewed by Pavel Feldman.
+
+        JS objects in the console have context menu item that allows to reveal them in a heap snapshot view.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsObject):
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextMenu.prototype.isEmpty):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGridNode.prototype._detach):
+        (WebInspector.DataGridNode.prototype.wasDetached):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshot.prototype.nodeClassName):
+        (WebInspector.HeapSnapshotNodesProvider.prototype.nodePosition):
+        * inspector/front-end/HeapSnapshotDataGrids.js:
+        (WebInspector.HeapSnapshotSortableDataGrid):
+        (WebInspector.HeapSnapshotSortableDataGrid.prototype.highlightObjectByHeapSnapshotId):
+        (WebInspector.HeapSnapshotSortableDataGrid.prototype.highlightNode):
+        (WebInspector.HeapSnapshotSortableDataGrid.prototype.nodeWasDetached):
+        (WebInspector.HeapSnapshotSortableDataGrid.prototype._clearCurrentHighlight):
+        (WebInspector.HeapSnapshotViewportDataGrid):
+        (WebInspector.HeapSnapshotViewportDataGrid.prototype.highlightNode):
+        (WebInspector.HeapSnapshotViewportDataGrid.prototype._onScroll):
+        (WebInspector.HeapSnapshotConstructorsDataGrid):
+        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype.highlightObjectByHeapSnapshotId.didGetClassName):
+        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype.highlightObjectByHeapSnapshotId):
+        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype.setDataSource):
+        * inspector/front-end/HeapSnapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype.wasDetached):
+        (WebInspector.HeapSnapshotConstructorNode.prototype.revealNodeBySnapshotObjectId):
+        (WebInspector.HeapSnapshotConstructorNode.prototype.revealNodeBySnapshotObjectId.didPopulateChildren):
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.HeapSnapshotProxy.prototype.nodeClassName):
+        (WebInspector.HeapSnapshotProviderProxy.prototype.nodePosition):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.ContextMenuProvider):
+        (WebInspector.ObjectPropertiesSection.ContextMenuProvider.prototype.populateContextMenu):
+        (WebInspector.ObjectPropertiesSection.addContextMenuProvider):
+        (WebInspector.ObjectPropertiesSection.prototype.enableContextMenu):
+        (WebInspector.ObjectPropertiesSection.prototype._contextMenuEventFired):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.showObject):
+        (WebInspector.RevealInHeapSnapshotContextMenuProvider):
+        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.revealInSummaryView):
+        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu.didReceiveHeapObjectId):
+        (WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype.populateContextMenu):
+        * inspector/front-end/profilesPanel.css:
+        (.highlighted-row):
+        (@-webkit-keyframes row_highlight):
+        (to):
+
+2012-05-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: move recording button state control out of addProfileHeader.
+        https://bugs.webkit.org/show_bug.cgi?id=86293
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/CSSSelectorProfileView.js:
+        (WebInspector.CSSSelectorProfileType.prototype.buttonClicked):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfilesPanel.prototype.toggleRecordButton):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
+        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot.done):
+        (WebInspector.ProfilesPanel.prototype.takeHeapSnapshot):
+
+2012-05-12  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Turn HelpScreen to be View.
+        https://bugs.webkit.org/show_bug.cgi?id=85711
+
+        Reviewed by Yury Semikhatsky.
+
+        Motivation: for further UI changes, HelpSceen needs to be View.
+        It is planned to combine Settings Screen and Shortcuts Screen in one
+        tabbed screen.
+        Bonus: "helpScreen.css" will be lazy-loaded.
+        Additional changes: move settingsScreen logic out of inspector.js
+
+        UI change, no test required.
+
+        * WebCore.gypi: Change "helpScreen.css" file group.
+        * inspector/front-end/HelpScreen.js: 
+        (WebInspector.HelpScreen): Turned to View subclass.
+        (WebInspector.HelpScreen.prototype.showModal): Remove "onHide" param
+        (WebInspector.HelpScreen.prototype.hide): Ditto.
+        (WebInspector.HelpScreen.prototype._onKeyDown): Adopt View members.
+        (WebInspector.HelpScreen.prototype._onBlur): Ditto.
+        * inspector/front-end/SettingsScreen.js: Adopt new workflow.
+        (WebInspector.SettingsScreen): Put onHide function to member
+        (WebInspector.SettingsScreen.prototype.willHide): Invoke onHide
+        (WebInspector.SettingsController): Mediator pattern - this class
+        takes care of status bar button - settings screen relationship.
+        (WebInspector.SettingsController.prototype.get statusBarItem):
+        Getter fot representative element.
+        (WebInspector.SettingsController.prototype._buttonClicked):
+        Classifies user action.
+        (WebInspector.SettingsController.prototype._onHideSettingsScreen):
+        Cleanup after settings screen is hidden.
+        (WebInspector.SettingsController.prototype._showSettingsScreen):
+        Presents settings screen.
+        (WebInspector.SettingsController.prototype._hideSettingsScreen):
+        Hides settings screen.
+        * inspector/front-end/ShortcutsScreen.js: Adopt new workflow.
+        (WebInspector.ShortcutsScreen.prototype.wasShown): Lazy initialization.
+        * inspector/front-end/WorkerManager.js: Adopt new workflow.
+        (WebInspector.WorkerManager.prototype._disconnectedFromWorker): Ditto.
+        (WebInspector.WorkerTerminatedScreen.prototype.willHide): Ditto.
+        * inspector/front-end/helpScreen.css: Fix spacing.
+        (.help-window-outer): Ditto.
+        (body.compact .help-window-outer): Ditto.
+        (body.compact .help-window-main): Ditto.
+        (body.compact .help-window-caption): Ditto.
+        (.help-content): Ditto.
+        (body.compact .help-content): Ditto.
+        (.help-content select): Ditto.
+        * inspector/front-end/inspector.html: Ditto.
+        * inspector/front-end/inspector.js: Ditto.
+        (WebInspector._createGlobalStatusBarItems): Create SettingsController.
+        (WebInspector.documentKeyDown): Adopt new workflow.
+
+2012-05-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add tab context menu
+        https://bugs.webkit.org/show_bug.cgi?id=86292
+
+        Reviewed by Yury Semikhatsky.
+
+        This tab context menu will have "Close", "Close Others" and "Close All".
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPane.prototype.closeOtherTabs):
+        (WebInspector.TabbedPaneTab.prototype._createTabElement):
+        (WebInspector.TabbedPaneTab.prototype._tabClicked):
+        (WebInspector.TabbedPaneTab.prototype._tabContextMenu):
+        (WebInspector.TabbedPaneTab.prototype._tabContextMenu.closeOthers):
+        (WebInspector.TabbedPaneTab.prototype._tabContextMenu.closeAll):
+
+2012-05-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: make call frame selector pane focusable, allow Up / Down to select current call frame.
+        https://bugs.webkit.org/show_bug.cgi?id=86291
+
+        Reviewed by Yury Semikhatsky.
+
+        This change makes sidebar section focusable, introduces key listeners for Up and Down.
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane):
+        (WebInspector.CallStackSidebarPane.prototype.setStatus):
+        (WebInspector.CallStackSidebarPane.prototype._treeKeyDown):
+        * inspector/front-end/UISourceCode.js:
+        * inspector/front-end/scriptsPanel.css:
+        (#scripts-debug-toolbar img):
+
+2012-05-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: unreviewed one line fix.
+
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.HeapSnapshotWorker):
+
+2012-05-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: Load context menu item has to be shown for all Profiles panel.
+        https://bugs.webkit.org/show_bug.cgi?id=86290
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._handleContextMenuEvent):
+
+2012-05-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: shrink SourceFrame editing API to two methods (was 4).
+        https://bugs.webkit.org/show_bug.cgi?id=86288
+
+        Reviewed by Yury Semikhatsky.
+
+        Used specific workflow in two SourceFrame implementations.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.commitEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.EditableResourceSourceFrame.prototype.commitEditing.callbackWrapper):
+        (WebInspector.EditableResourceSourceFrame.prototype.commitEditing):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.commitEditing):
+        (WebInspector.TextViewerDelegateForSourceFrame.prototype.commitEditing):
+
+2012-05-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: allow showing arbitrary range of nodes in heap snapshot view
+        https://bugs.webkit.org/show_bug.cgi?id=86230
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/profiler/heap-snapshot-summary-show-ranges.html
+
+        It was only possible to expand heap snapshot node children sequentially starting
+        from the first child and then pressing either "Show next X items" or "Show all X items".
+        This change makes it possible to show any range of children.
+
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotFilteredOrderedIterator):
+        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.serializeItemsRange):
+        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.sortAll):
+        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.sortAndRewind):
+        (WebInspector.HeapSnapshotEdgesProvider.prototype.serializeItem):
+        (WebInspector.HeapSnapshotNodesProvider.prototype.serializeItem):
+        * inspector/front-end/HeapSnapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode):
+        (WebInspector.HeapSnapshotGridNode.prototype._populate.sorted):
+        (WebInspector.HeapSnapshotGridNode.prototype._populate):
+        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.serializeNextChunk):
+        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.insertRetrievedChild):
+        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.insertShowMoreButton):
+        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren.childrenRetrieved):
+        (WebInspector.HeapSnapshotGridNode.prototype._populateChildren):
+        (WebInspector.HeapSnapshotGridNode.prototype._saveChildren):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort.afterSort):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort):
+        (WebInspector.HeapSnapshotDiffNodesProvider):
+        (WebInspector.HeapSnapshotDiffNodesProvider.prototype.serializeItemsRange):
+        (WebInspector.HeapSnapshotDiffNodesProvider.prototype.serializeItemsRange.didReceiveDeletedItems):
+        (WebInspector.HeapSnapshotDiffNodesProvider.prototype.serializeItemsRange.didReceiveAddedItems):
+        (WebInspector.HeapSnapshotDiffNodesProvider.prototype.sortAndRewind):
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.HeapSnapshotWorker):
+        (WebInspector.HeapSnapshotProviderProxy.prototype.serializeItemsRange):
+        * inspector/front-end/ShowMoreDataGridNode.js:
+        (WebInspector.ShowMoreDataGridNode):
+        (WebInspector.ShowMoreDataGridNode.prototype._showNextChunk):
+        (WebInspector.ShowMoreDataGridNode.prototype._showAll):
+        (WebInspector.ShowMoreDataGridNode.prototype._updateLabels):
+        (WebInspector.ShowMoreDataGridNode.prototype.setStartPosition):
+        (WebInspector.ShowMoreDataGridNode.prototype.setEndPosition):
+        * inspector/front-end/utilities.js:
+
+2012-05-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: remove UISourceCode.id since it is no longer used.
+        https://bugs.webkit.org/show_bug.cgi?id=86286
+
+        Reviewed by Vsevolod Vlasov.
+
+        We are now using breakpointStorageId property for breakpoint persistence.
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager):
+        (WebInspector.BreakpointManager.prototype._debuggerReset):
+        (WebInspector.BreakpointManager.prototype._uiLocationAdded.get if):
+        (WebInspector.BreakpointManager.prototype._uiLocationAdded):
+        (WebInspector.BreakpointManager.prototype._uiLocationRemoved.get if):
+        (WebInspector.BreakpointManager.prototype._uiLocationRemoved):
+        * inspector/front-end/CompilerScriptMapping.js:
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode):
+        (WebInspector.RawSourceCode.prototype.rawLocationToUILocation):
+        (WebInspector.RawSourceCode.prototype._createUISourceCode):
+        (WebInspector.RawSourceCode.prototype._finishedLoading):
+        * inspector/front-end/SnippetsModel.js:
+        (WebInspector.SnippetsScriptMapping.prototype._snippetAdded):
+        (WebInspector.SnippetsScriptMapping.prototype._createUISourceCodeForScript):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode):
+
+2012-05-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: merge MainScriptMapping into DebuggerPresentationModel; move other classes into their own files.
+        https://bugs.webkit.org/show_bug.cgi?id=86285
+
+        Reviewed by Yury Semikhatsky.
+
+        The only purpose of the debugger presentation model now is to manage mappings. Merging main script mapping back into it.
+        Other classes defined in that class are moved out into their own files.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        * inspector/front-end/DebuggerResourceBinding.js: Added.
+        (WebInspector.DebuggerResourceBinding):
+        (WebInspector.DebuggerResourceBinding.canEditScriptSource):
+        (WebInspector.DebuggerResourceBinding.setScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerResourceBinding.setScriptSource):
+        (WebInspector.DebuggerResourceBinding.prototype.canSetContent):
+        (WebInspector.DebuggerResourceBinding.prototype.setContent):
+        (WebInspector.DebuggerResourceBinding.prototype._uiSourceCodeForResource):
+        (WebInspector.DebuggerResourceBinding.prototype._setContentWithInitialContent):
+        * inspector/front-end/PresentationConsoleMessageHelper.js: Added.
+        (WebInspector.PresentationConsoleMessageHelper):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._consoleMessageAdded):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._addConsoleMessageToScript):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._addPendingConsoleMessage):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._parsedScriptSource):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._consoleCleared):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._debuggerReset):
+        (WebInspector.PresentationConsoleMessage):
+        (WebInspector.PresentationConsoleMessage.prototype._updateLocation):
+        (WebInspector.PresentationConsoleMessage.prototype.get lineNumber):
+        (WebInspector.PresentationConsoleMessage.prototype.dispose):
+        * inspector/front-end/ScriptMapping.js:
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2012-05-12  Mike West  <mkwst@chromium.org>
+
+        Cleanup ContentSecurityPolicy naming conventions.
+        https://bugs.webkit.org/show_bug.cgi?id=86282
+
+        Reviewed by Adam Barth.
+
+        Two tiny changes:
+        
+        1. `reportURI` and `reportURL` are both used within the CSP
+           implementation. We should standardize on `reportURI` to match the
+           spec.
+        
+        2. Renames `ContentSecurityPolicy::allowConnectFromSource` to
+           `ContentSecurityPolicy::allowConnectToSource` for clarity.
+
+        No new tests, as there's no user-visible change.
+
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        * page/ContentSecurityPolicy.cpp:
+        (CSPDirectiveList):
+        (WebCore::CSPDirectiveList::reportViolation):
+        (WebCore::CSPDirectiveList::allowConnectToSource):
+        (WebCore::CSPDirectiveList::parseReportURI):
+        (WebCore::CSPDirectiveList::addDirective):
+        (WebCore::ContentSecurityPolicy::allowConnectToSource):
+        * page/ContentSecurityPolicy.h:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::create):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::open):
+
+2012-05-11  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Call isLinkVisited directly
+        https://bugs.webkit.org/show_bug.cgi?id=85412
+
+        Reviewed by Adam Barth.
+
+        Part of a refactoring series. See tracking bug 82948.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::isLinkVisited):
+        * platform/VisitedLinks.cpp: Added.
+        (WebCore):
+        (WebCore::VisitedLinks::isLinkVisited):
+        * platform/VisitedLinks.h: Added.
+        (WebCore):
+        (VisitedLinks):
+        * platform/chromium/PlatformSupport.h:
+        * platform/chromium/VisitedLinksChromium.cpp: Added.
+        (WebCore):
+        (WebCore::VisitedLinks::isLinkVisited):
+
+2012-05-11  Martin Robinson  <mrobinson@igalia.com>
+
+        [TextureMapper] Tiles are not created for large textures
+        https://bugs.webkit.org/show_bug.cgi?id=86245
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests. This will not produce any observable behavior changes,
+        unless run on a machine with a small texture size limit.
+
+        The maxTextureSize() method on TextureMapperGL was missing a "const"
+        keyword, meaning that it was not properly overriding the version in
+        the abstract base class (TextureMapper). This patch adds the const
+        modifier and cleans up the list of override methods in the two 
+        TextureMapper sublcasses, adding the OVERRIDE macro for compilers that
+        support it and removing a couple unused methods.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        * platform/graphics/texmap/TextureMapperGL.h:
+        (WebCore::TextureMapperGL::create):
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+        (TextureMapperImageBuffer):
+
+2012-05-11  Adrienne Walker  <enne@google.com>
+
+        [chromium] Prevent deadlock on CCVideoLayerImpl destruction
+        https://bugs.webkit.org/show_bug.cgi?id=86258
+
+        Reviewed by James Robinson.
+
+        ~CCVideoLayerImpl had a common deadlock issue where if it got
+        destroyed before WebMediaPlayerClientImpl, it would take a lock,
+        call WebMediaPlayerClientImpl::setVideoFrameProviderClient(0),
+        which in turn would call CCVideoLayerImpl::stopUsingProvider(),
+        which would try to take the same lock and would deadlock.
+
+        CCVideoLayerImpl is only created and destroyed during tree
+        synchronization in a commit or during synchronous compositor thread
+        destruction. In either case, the main thread is blocked, and so no
+        lock needs to be taken at all.
+
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::stopUsingProvider):
+
+2012-05-11  Jeffrey Pfau  <jpfau@apple.com>
+
+        REGRESSION (r114170): Scroll areas in nested frames improperly placed when tiled drawing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=86239
+
+        Reviewed by Anders Carlsson.
+
+        Fixes a regression introduced in r114170 by recursively adding positions of parent frames to placement of nested frame scroll areas.
+
+        Manual tests: ManualTests/scrollable-positioned-frame.html
+                      ManualTests/scrollable-positioned-nested-frame.html
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::computeNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::frameViewLayoutUpdated):
+
+2012-05-11  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=86278
+        Composited layers should only run the overlay scrollbars painting pass 
+        if necessary
+
+        Reviewed by Dan Bernstein.
+
+        It's not enough that the rootLayer has dirty scrollbars; we also have 
+        to actually be doing the overlay scrollbars painting pass to skip the 
+        early return.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+
+2012-05-11  Anders Carlsson  <andersca@apple.com>
+
+        Comcast website displays bottom of page when loaded
+        https://bugs.webkit.org/show_bug.cgi?id=86277
+        <rdar://problem/11426887>
+
+        Reviewed by Beth Dakin.
+
+        There were two bugs here. The first bug was that FrameView::setScrollPosition didn't end up calling into the scrolling coordinator
+        to update the scroll position. The second bug was that ScrollingTreeNodeMac::setScrollPosition didn't constrain the scroll position
+        to the edge of the page.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setScrollPosition):
+        Call requestScrollPositionUpdate.
+
+        * page/scrolling/ScrollingTree.cpp:
+        * page/scrolling/ScrollingTree.h:
+        Remove setMainFrameScrollPosition, it is not called by anyone.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        Clamp to the page size and call setScrollPositionWithoutContentEdgeConstraints.
+
+        (WebCore::ScrollingTreeNodeMac::setScrollPositionWithoutContentEdgeConstraints):
+        Update the scroll layer position and call back to the main thread.
+
+        (WebCore::ScrollingTreeNodeMac::scrollBy):
+        Call setScrollPosition.
+
+        (WebCore::ScrollingTreeNodeMac::scrollByWithoutContentEdgeConstraints):
+        Call setScrollPositionWithoutContentEdgeConstraints.
+
+2012-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Introduce PropertyName class
+        https://bugs.webkit.org/show_bug.cgi?id=86241
+
+        Reviewed by Geoff Garen.
+
+        Replace 'const Identifier&' arguments to functions accessing object properties with a new 'PropertyName' type.
+        This change paves the way to allow for properties keyed by values that are not Identifiers.
+
+        This change is largely a mechanical find & replace.
+        It also changes JSFunction's constructor to take a UString& instead of an Identifier&
+        (since in some cases we can no longer guarantee that we'lll have an Identifier), and
+        unifies Identifier's methods to obtain array indices onto PropertyName.
+
+        The new PropertyName class retains the ability to support .impl() and .ustring(), but
+        in a future patch we may need to rework this, since not all PropertyNames should be
+        equal based on their string representation.
+
+        * WebCore.exp.in:
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::cssPropertyIDForJSCSSPropertyName):
+        (WebCore::JSCSSStyleDeclaration::getOwnPropertySlotDelegate):
+        (WebCore::JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate):
+        (WebCore::JSCSSStyleDeclaration::putDelegate):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::findAtomicString):
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore):
+        (WebCore::propertyNameToString):
+        (WebCore::propertyNameToAtomicString):
+        * bindings/js/JSDOMMimeTypeArrayCustom.cpp:
+        (WebCore::JSDOMMimeTypeArray::canGetItemsForName):
+        (WebCore::JSDOMMimeTypeArray::nameGetter):
+        * bindings/js/JSDOMPluginArrayCustom.cpp:
+        (WebCore::JSDOMPluginArray::canGetItemsForName):
+        (WebCore::JSDOMPluginArray::nameGetter):
+        * bindings/js/JSDOMPluginCustom.cpp:
+        (WebCore::JSDOMPlugin::canGetItemsForName):
+        (WebCore::JSDOMPlugin::nameGetter):
+        * bindings/js/JSDOMStringMapCustom.cpp:
+        (WebCore::JSDOMStringMap::canGetItemsForName):
+        (WebCore::JSDOMStringMap::nameGetter):
+        (WebCore::JSDOMStringMap::deleteProperty):
+        (WebCore::JSDOMStringMap::putDelegate):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::childFrameGetter):
+        (WebCore::namedItemGetter):
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        (WebCore::JSDOMWindow::put):
+        (WebCore::JSDOMWindow::deleteProperty):
+        (WebCore::JSDOMWindow::defineOwnProperty):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertySlot):
+        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
+        (WebCore::JSDOMWindowShell::put):
+        (WebCore::JSDOMWindowShell::putDirectVirtual):
+        (WebCore::JSDOMWindowShell::defineOwnProperty):
+        (WebCore::JSDOMWindowShell::deleteProperty):
+        * bindings/js/JSDOMWindowShell.h:
+        (JSDOMWindowShell):
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::canGetItemsForName):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::getOwnPropertySlotDelegate):
+        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
+        (WebCore::JSHTMLAppletElement::putDelegate):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::JSHTMLCollection::canGetItemsForName):
+        (WebCore::JSHTMLCollection::nameGetter):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::canGetItemsForName):
+        (WebCore::JSHTMLDocument::nameGetter):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::getOwnPropertySlotDelegate):
+        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
+        (WebCore::JSHTMLEmbedElement::putDelegate):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::canGetItemsForName):
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::canGetItemsForName):
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::getOwnPropertySlotDelegate):
+        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
+        (WebCore::JSHTMLObjectElement::putDelegate):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        (WebCore::JSHistory::getOwnPropertySlotDelegate):
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        (WebCore::JSHistory::putDelegate):
+        (WebCore::JSHistory::deleteProperty):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        (WebCore::JSLocation::getOwnPropertySlotDelegate):
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        (WebCore::JSLocation::putDelegate):
+        (WebCore::JSLocation::deleteProperty):
+        (WebCore::JSLocation::defineOwnProperty):
+        (WebCore::JSLocationPrototype::putDelegate):
+        (WebCore::JSLocationPrototype::defineOwnProperty):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::canGetItemsForName):
+        (WebCore::JSNamedNodeMap::nameGetter):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::JSNodeList::canGetItemsForName):
+        (WebCore::JSNodeList::nameGetter):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectPropertyGetter):
+        (WebCore::runtimeObjectCustomGetOwnPropertySlot):
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        (WebCore::runtimeObjectCustomPut):
+        * bindings/js/JSPluginElementFunctions.h:
+        (WebCore):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::canGetItemsForName):
+        (WebCore::JSStorage::nameGetter):
+        (WebCore::JSStorage::deleteProperty):
+        (WebCore::JSStorage::putDelegate):
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::canGetItemsForName):
+        (WebCore::JSStyleSheetList::nameGetter):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::getOwnPropertySlotDelegate):
+        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody):
+        (GenerateGetOwnPropertyDescriptorBody):
+        (GenerateHeader):
+        (GenerateImplementation):
+        (GenerateConstructorDeclaration):
+        (GenerateConstructorDefinition):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_class.h:
+        (CClass):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CRuntimeMethod::create):
+        (JSC::Bindings::CRuntimeMethod::finishCreation):
+        (JSC::Bindings::CInstance::getMethod):
+        * bridge/c/c_instance.h:
+        (CInstance):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::methodsNamed):
+        (JavaClass::fieldNamed):
+        * bridge/jni/jsc/JavaClassJSC.h:
+        (JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaRuntimeMethod::create):
+        (JavaRuntimeMethod::finishCreation):
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        (JavaInstance):
+        * bridge/jsc/BridgeJSC.h:
+        (Class):
+        (JSC::Bindings::Class::fallbackObject):
+        (JSC::Bindings::Instance::setValueOfUndefinedField):
+        (Instance):
+        (JSC::Bindings::Instance::getOwnPropertySlot):
+        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
+        (JSC::Bindings::Instance::put):
+        * bridge/objc/objc_class.h:
+        (ObjcClass):
+        * bridge/objc/objc_class.mm:
+        (JSC::Bindings::ObjcClass::methodsNamed):
+        (JSC::Bindings::ObjcClass::fieldNamed):
+        (JSC::Bindings::ObjcClass::fallbackObject):
+        * bridge/objc/objc_instance.h:
+        (ObjcInstance):
+        * bridge/objc/objc_instance.mm:
+        (ObjCRuntimeMethod::create):
+        (ObjCRuntimeMethod::finishCreation):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::create):
+        (JSC::Bindings::ObjcFallbackObjectImp::propertyName):
+        (ObjcFallbackObjectImp):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertySlot):
+        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
+        (JSC::Bindings::ObjcFallbackObjectImp::put):
+        (JSC::Bindings::callObjCFallbackObject):
+        (JSC::Bindings::ObjcFallbackObjectImp::deleteProperty):
+        (JSC::Bindings::ObjcFallbackObjectImp::defaultValue):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        (JSC::RuntimeArray::getOwnPropertySlot):
+        (JSC::RuntimeArray::getOwnPropertyDescriptor):
+        (JSC::RuntimeArray::put):
+        (JSC::RuntimeArray::deleteProperty):
+        * bridge/runtime_array.h:
+        (RuntimeArray):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::finishCreation):
+        (JSC::RuntimeMethod::lengthGetter):
+        (JSC::RuntimeMethod::getOwnPropertySlot):
+        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::create):
+        (RuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
+        (JSC::Bindings::RuntimeObject::fieldGetter):
+        (JSC::Bindings::RuntimeObject::methodGetter):
+        (JSC::Bindings::RuntimeObject::getOwnPropertySlot):
+        (JSC::Bindings::RuntimeObject::getOwnPropertyDescriptor):
+        (JSC::Bindings::RuntimeObject::put):
+        (JSC::Bindings::RuntimeObject::deleteProperty):
+        * bridge/runtime_object.h:
+        (RuntimeObject):
+
+2012-05-11  David Barton  <dbarton@mathscribe.com>
+
+        use after free in WebCore::RenderObject::document
+        https://bugs.webkit.org/show_bug.cgi?id=84891
+
+        Reviewed by Julien Chaffraix.
+
+        Change RenderMathMLFenced::addChild() to use the beforeChild parameter. When beforeChild
+        is 0, insert child renderers before the closing fence, which might not be the same as
+        this->lastChild(), e.g. possibly due to anonymous blocks or generated content.
+
+        Tests: mathml/presentation/mfenced-add-child1-expected.html
+               mathml/presentation/mfenced-add-child1.html
+               mathml/presentation/mfenced-add-child2-expected.html
+               mathml/presentation/mfenced-add-child2.html
+
+        * rendering/mathml/RenderMathMLFenced.cpp:
+        (WebCore::RenderMathMLFenced::RenderMathMLFenced):
+        (WebCore::RenderMathMLFenced::makeFences):
+        (WebCore::RenderMathMLFenced::addChild):
+        * rendering/mathml/RenderMathMLFenced.h:
+        (RenderMathMLFenced):
+
+2012-05-11  Anders Carlsson  <andersca@apple.com>
+
+        Can't scroll on webpage after following links from Blogger
+        https://bugs.webkit.org/show_bug.cgi?id=86274
+        <rdar://problem/11431352>
+
+        Reviewed by Beth Dakin.
+
+        When committing a new scroll layer, make sure to reset the scroll position.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::commitNewTreeState):
+
+2012-05-11  Martin Robinson  <mrobinson@igalia.com>
+
+        [TextureMapper] Support drawing debug borders
+        https://bugs.webkit.org/show_bug.cgi?id=86237
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests. This is the implementation of an interactive debugging
+        feature.
+
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayer::create): Moved this to the top of the file to
+        reduce contention for the coveted last spot in the file. This also
+        follows the pattern used in many WebCore files of having the factories
+        at the top.
+        (WebCore::GraphicsLayerTextureMapper::setDebugBorder): Added this
+        plumbing.
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h: Added
+        plumbing.
+        * platform/graphics/texmap/TextureMapper.h: Ditto.
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
+        (WebCore::TextureMapperTiledBackingStore::TextureMapperTiledBackingStore):
+        Initialize the new member.
+        (WebCore::TextureMapperTiledBackingStore::paintToTextureMapper): When
+        debug borders are enabled call the new drawBorder method on the TM.
+        (WebCore::TextureMapperTiledBackingStore::setDebugBorder): Added this
+        plumbing.
+        * platform/graphics/texmap/TextureMapperBackingStore.h: Added plumbing
+        and members to store debug border states. This is necessary because of
+        the when painting there is no handle on the GraphicsLayers.
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::drawRect): Factored out the common bits of
+        drawTexture and drawBorder into this helper.
+        (WebCore::TextureMapperGL::drawBorder): Added this method, which works
+        very similarly to drawTexture, but uses a different shader program and
+        must also set the line width and color.
+        (WebCore::TextureMapperGL::drawTexture): Factored out the bits that
+        are shared with drawRect.
+        * platform/graphics/texmap/TextureMapperGL.h:
+        (TextureMapperGL): Added the new method declarations.
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+        (WebCore::TextureMapperImageBuffer::drawBorder): Added an empty
+        implementation. Later we can add an implementation for the ImageBuffer
+        TM.
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::updateBackingStore): When updating the
+        backing store send the debug border information through.
+        (WebCore::TextureMapperLayer::syncCompositingStateSelf): When updating
+        the layer state, also update the debug indicators. This is required to
+        initialize the debug border values for the layer.
+        (WebCore::TextureMapperLayer::setDebugBorder): Added this plumbing.
+        * platform/graphics/texmap/TextureMapperLayer.h: Ditto.
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Added a
+        solid color shader that doesn't care about texture coordinates or
+        opacity values.
+        (WebCore::TextureMapperShaderManager::solidColorProgram): Added. This
+        is a shorter getter for the solid color program that doesn't require
+        casting from the caller.
+        (WebCore::TextureMapperShaderManager::getShaderProgram): Added support
+        for the solid color program.
+        (WebCore::TextureMapperShaderProgramSolidColor::create): Added.
+        (WebCore::TextureMapperShaderProgramSolidColor::TextureMapperShaderProgramSolidColor):
+        Ditto.
+        (WebCore::TextureMapperShaderProgramSolidColor::vertexShaderSource):
+        Ditto.
+        (WebCore::TextureMapperShaderProgramSolidColor::fragmentShaderSource):
+        Ditto.
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+        (TextureMapperShaderProgramSolidColor): Added.
+        (WebCore::TextureMapperShaderProgramSolidColor::colorVariable): Added.
+
+2012-05-10  Timothy Hatcher  <timothy@apple.com>
+
+        Instrument timer function calls so they show up in the Web Inspector Timeline.
+
+        https://webkit.org/b/86173
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/timeline/timeline-timer.html
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext): Wrap the call with JSMainThreadExecState::instrumentFunctionCall
+        and InspectorInstrumentation::didCallFunction.
+
+2012-05-11  Nico Weber  <thakis@chromium.org>
+
+        [chromium/mac] Let libwebkit.dylib link in Debug/components build
+        https://bugs.webkit.org/show_bug.cgi?id=86244
+
+        Reviewed by James Robinson.
+
+        In static builds, this was not needed because the targets depending on
+        'webkit' already link in QuartzCore. In Release components builds, it wasn't
+        needed because they are built with -dead_strip, which stripped the referencing
+        code.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r116802.
+        http://trac.webkit.org/changeset/116802
+        https://bugs.webkit.org/show_bug.cgi?id=86260
+
+        This patch causes compiling error to chromium builds
+        (Requested by jianli_ on #webkit).
+
+        * WebCore.gypi:
+
+2012-05-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Regression fix after r116798.
+
+        We need to return true for the html element in the design mode
+        in which case parentNode() is editable and is not a body element.
+
+        * dom/Node.cpp:
+        (WebCore::Node::isRootEditableElement):
+
+2012-05-11  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move implementation of WebCore::GraphicsContext3D and related from WebKit/chromium/src to WebCore/platform/chromium/support
+        https://bugs.webkit.org/show_bug.cgi?id=86257
+
+        Reviewed by Adam Barth.
+
+        The WebCore platform interfaces GraphicsContext3D and Extensions3DChromium are implemented in chromium on top of
+        the Platform interface WebGraphicsContext3D. This moves the implementation support code from WebKit/chromium/src
+        to WebCore/platform/chromium/support, which avoids having code in WebKit/ implementing WebCore interfaces and
+        allows code in WebCore/platform to use this support code directly where appropriate.
+
+        Refactor only, no new functionality or tests.
+
+        * WebCore.gypi:
+        * platform/chromium/support/Extensions3DChromium.cpp: Renamed from Source/WebKit/chromium/src/Extensions3DChromium.cpp.
+        (WebCore):
+        (WebCore::Extensions3DChromium::Extensions3DChromium):
+        (WebCore::Extensions3DChromium::~Extensions3DChromium):
+        (WebCore::Extensions3DChromium::supports):
+        (WebCore::Extensions3DChromium::ensureEnabled):
+        (WebCore::Extensions3DChromium::isEnabled):
+        (WebCore::Extensions3DChromium::getGraphicsResetStatusARB):
+        (WebCore::Extensions3DChromium::blitFramebuffer):
+        (WebCore::Extensions3DChromium::renderbufferStorageMultisample):
+        (WebCore::Extensions3DChromium::postSubBufferCHROMIUM):
+        (WebCore::Extensions3DChromium::mapBufferSubDataCHROMIUM):
+        (WebCore::Extensions3DChromium::unmapBufferSubDataCHROMIUM):
+        (WebCore::Extensions3DChromium::mapTexSubImage2DCHROMIUM):
+        (WebCore::Extensions3DChromium::unmapTexSubImage2DCHROMIUM):
+        (WebCore::Extensions3DChromium::setVisibilityCHROMIUM):
+        (WebCore::Extensions3DChromium::discardFramebufferEXT):
+        (WebCore::Extensions3DChromium::ensureFramebufferCHROMIUM):
+        (WebCore::Extensions3DChromium::setGpuMemoryAllocationChangedCallbackCHROMIUM):
+        (WebCore::Extensions3DChromium::createVertexArrayOES):
+        (WebCore::Extensions3DChromium::deleteVertexArrayOES):
+        (WebCore::Extensions3DChromium::isVertexArrayOES):
+        (WebCore::Extensions3DChromium::bindVertexArrayOES):
+        (WebCore::Extensions3DChromium::getTranslatedShaderSourceANGLE):
+        (WebCore::Extensions3DChromium::setSwapBuffersCompleteCallbackCHROMIUM):
+        (WebCore::Extensions3DChromium::rateLimitOffscreenContextCHROMIUM):
+        (WebCore::Extensions3DChromium::paintFramebufferToCanvas):
+        (WebCore::Extensions3DChromium::texImageIOSurface2DCHROMIUM):
+        (WebCore::Extensions3DChromium::texStorage2DEXT):
+        (WebCore::Extensions3DChromium::createQueryEXT):
+        (WebCore::Extensions3DChromium::deleteQueryEXT):
+        (WebCore::Extensions3DChromium::isQueryEXT):
+        (WebCore::Extensions3DChromium::beginQueryEXT):
+        (WebCore::Extensions3DChromium::endQueryEXT):
+        (WebCore::Extensions3DChromium::getQueryivEXT):
+        (WebCore::Extensions3DChromium::getQueryObjectuivEXT):
+        * platform/chromium/support/GraphicsContext3DChromium.cpp: Renamed from Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp.
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::createGraphicsContextFromWebContext):
+        (WebCore::GraphicsContext3DPrivate::extractWebGraphicsContext3D):
+        (WebCore::GraphicsContext3DPrivate::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3DPrivate::platformTexture):
+        (GrMemoryAllocationChangedCallback):
+        (WebCore::GrMemoryAllocationChangedCallback::GrMemoryAllocationChangedCallback):
+        (WebCore::GrMemoryAllocationChangedCallback::onGpuMemoryAllocationChanged):
+        (WebCore::GraphicsContext3DPrivate::grContext):
+        (WebCore::GraphicsContext3DPrivate::prepareTexture):
+        (WebCore::GraphicsContext3DPrivate::markContextChanged):
+        (WebCore::GraphicsContext3DPrivate::markLayerComposited):
+        (WebCore::GraphicsContext3DPrivate::layerComposited):
+        (WebCore::GraphicsContext3DPrivate::paintFramebufferToCanvas):
+        (WebCore::GraphicsContext3DPrivate::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3DPrivate::paintCompositedResultsToCanvas):
+        (WebCore::GraphicsContext3DPrivate::paintRenderingResultsToImageData):
+        (WebCore::GraphicsContext3DPrivate::reshape):
+        (WebCore::GraphicsContext3DPrivate::getInternalFramebufferSize):
+        (WebCore::GraphicsContext3DPrivate::isContextLost):
+        (WebCore::GraphicsContext3DPrivate::isGLES2Compliant):
+        (WebCore::GraphicsContext3DPrivate::bindAttribLocation):
+        (WebCore::GraphicsContext3DPrivate::bufferData):
+        (WebCore::GraphicsContext3DPrivate::bufferSubData):
+        (WebCore::GraphicsContext3DPrivate::getActiveAttrib):
+        (WebCore::GraphicsContext3DPrivate::getActiveUniform):
+        (WebCore::GraphicsContext3DPrivate::getAttribLocation):
+        (WebCore::GraphicsContext3DPrivate::getContextAttributes):
+        (WebCore::GraphicsContext3DPrivate::getProgramInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getShaderInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getShaderSource):
+        (WebCore::GraphicsContext3DPrivate::getString):
+        (WebCore::GraphicsContext3DPrivate::getUniformLocation):
+        (WebCore::GraphicsContext3DPrivate::shaderSource):
+        (WebCore::GraphicsContext3DPrivate::texImage2D):
+        (WebCore::GraphicsContext3DPrivate::texSubImage2D):
+        (WebCore::GraphicsContext3DPrivate::uniform1fv):
+        (WebCore::GraphicsContext3DPrivate::uniform1iv):
+        (WebCore::GraphicsContext3DPrivate::uniform2fv):
+        (WebCore::GraphicsContext3DPrivate::uniform2iv):
+        (WebCore::GraphicsContext3DPrivate::uniform3fv):
+        (WebCore::GraphicsContext3DPrivate::uniform3iv):
+        (WebCore::GraphicsContext3DPrivate::uniform4fv):
+        (WebCore::GraphicsContext3DPrivate::uniform4iv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix2fv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix3fv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix4fv):
+        (WebCore::GraphicsContext3DPrivate::getExtensions):
+        (WebCore::GraphicsContext3DPrivate::isResourceSafe):
+        (WebCore::GraphicsContext3DPrivate::initializeExtensions):
+        (WebCore::GraphicsContext3DPrivate::supportsExtension):
+        (WebCore::GraphicsContext3DPrivate::ensureExtensionEnabled):
+        (WebCore::GraphicsContext3DPrivate::isExtensionEnabled):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        (WebCore::GraphicsContext3D::grContext):
+        (WebCore::GraphicsContext3D::prepareTexture):
+        (WebCore::GraphicsContext3D::getInternalFramebufferSize):
+        (WebCore::GraphicsContext3D::isResourceSafe):
+        (WebCore::GraphicsContext3D::platformLayer):
+        (WebCore::GraphicsContext3D::layerComposited):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
+        (GraphicsContextLostCallbackAdapter):
+        (WebCore::GraphicsContextLostCallbackAdapter::~GraphicsContextLostCallbackAdapter):
+        (WebCore::GraphicsContextLostCallbackAdapter::GraphicsContextLostCallbackAdapter):
+        (WebCore::GraphicsContextLostCallbackAdapter::onContextLost):
+        (WebCore::GraphicsContextLostCallbackAdapter::create):
+        (WebCore::GraphicsContext3DPrivate::setContextLostCallback):
+        (GraphicsErrorMessageCallbackAdapter):
+        (WebCore::GraphicsErrorMessageCallbackAdapter::~GraphicsErrorMessageCallbackAdapter):
+        (WebCore::GraphicsErrorMessageCallbackAdapter::GraphicsErrorMessageCallbackAdapter):
+        (WebCore::GraphicsErrorMessageCallbackAdapter::onErrorMessage):
+        (WebCore::GraphicsErrorMessageCallbackAdapter::create):
+        (WebCore::GraphicsContext3DPrivate::setErrorMessageCallback):
+        (WebCore::GraphicsContext3D::isGLES2Compliant):
+        (GraphicsContext3DSwapBuffersCompleteCallbackAdapter):
+        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::~GraphicsContext3DSwapBuffersCompleteCallbackAdapter):
+        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::GraphicsContext3DSwapBuffersCompleteCallbackAdapter):
+        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::onSwapBuffersComplete):
+        (WebCore::GraphicsContext3DSwapBuffersCompleteCallbackAdapter::create):
+        (WebCore::GraphicsContext3DPrivate::setSwapBuffersCompleteCallbackCHROMIUM):
+        (GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::~GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::onMemoryAllocationChanged):
+        (WebCore::GraphicsContext3DPrivate::setGpuMemoryAllocationChangedCallbackCHROMIUM):
+        * platform/chromium/support/GraphicsContext3DPrivate.h: Renamed from Source/WebKit/chromium/src/GraphicsContext3DPrivate.h.
+        (WebKit):
+        (WebCore):
+        (GraphicsContext3DPrivate):
+
+2012-05-11  Keyar Hood  <keyar@chromium.org>
+
+        ImageSkia.cpp does not conform to style guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=86219
+
+        Reviewed by Stephen White.
+
+        No tests as this is purely style changees.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::TransformDimensions):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+
+2012-05-11  Tim Horton  <timothy_horton@apple.com>
+
+        Unreviewed Chromium build fix after http://trac.webkit.org/changeset/116799.
+
+        * rendering/RenderLayerBacking.cpp:
+
+2012-05-11  Terry Anderson  <tdanderson@chromium.org>
+
+        [chromium] Compute the best target node on a GestureTap event
+        https://bugs.webkit.org/show_bug.cgi?id=85101
+
+        Reviewed by Adam Barth.
+
+        Will be using the tests in the touchadjustment/ directory.
+
+        * WebCore.gypi:
+        Include TouchAdjustment.* files.
+
+2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r116498.
+        http://trac.webkit.org/changeset/116498
+        https://bugs.webkit.org/show_bug.cgi?id=86251
+
+        Causes crashes in major sites and security issues (Requested
+        by schenney on #webkit).
+
+        * rendering/svg/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::addChild):
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::willBeDestroyed):
+        (WebCore::RenderSVGInlineText::setTextInternal):
+        (WebCore::RenderSVGInlineText::styleDidChange):
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::recursiveUpdateLayoutAttributes):
+        (WebCore::RenderSVGText::layoutAttributesChanged):
+        (WebCore::RenderSVGText::layoutAttributesWillBeDestroyed):
+        (WebCore::RenderSVGText::invalidateTextPositioningElements):
+        (WebCore::recursiveUpdateScaledFont):
+        (WebCore::RenderSVGText::layout):
+        (WebCore::RenderSVGText::addChild):
+        (WebCore::recursiveCollectLayoutAttributes):
+        (WebCore::RenderSVGText::rebuildLayoutAttributes):
+        (WebCore):
+        * rendering/svg/RenderSVGText.h:
+        (RenderSVGText):
+        (WebCore::RenderSVGText::layoutAttributes):
+        * rendering/svg/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
+        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributes):
+
+2012-05-11  Tim Horton  <timothy_horton@apple.com>
+
+        FrameView->m_lastPaintTime is not updated in the tiled drawing case
+        https://bugs.webkit.org/show_bug.cgi?id=86246
+        <rdar://problem/11248475>
+
+        Reviewed by Simon Fraser.
+
+        Update FrameView's m_lastPaintTime from RenderLayerBacking::paintContents
+        if the RenderLayerBacking is backing a tiled drawing layer.
+
+        In the future we might want to consider updating m_lastPaintTime when any
+        compositing layer is painted into, but this change gets us on par with the
+        non-tiled-drawing case as it stands now.
+
+        No new tests.
+
+        * page/FrameView.h:
+        (WebCore::FrameView::setLastPaintTime):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintContents):
+
+2012-05-11  Shezan Baig  <shezbaig.wk@gmail.com>
+
+        Add helper function for node()->rootEditableElement() == node()
+        https://bugs.webkit.org/show_bug.cgi?id=86217
+
+        Reviewed by Ryosuke Niwa.
+
+        Added Node::isRootEditableElement and updated existing code that did
+        (node->rootEditableElement() == node) to use isRootEditableElement
+        instead.
+
+        No new tests. No change in behavior.
+
+        * dom/Node.cpp:
+        (WebCore::Node::isRootEditableElement):
+        (WebCore):
+        * dom/Node.h:
+        (Node):
+        Added new helper function.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedNode):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hasLineIfEmpty):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        Updates to existing code to use the new helper function.
+
+2012-05-11  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Create WebTransformationMatrix interface for chromium platform
+        https://bugs.webkit.org/show_bug.cgi?id=86049
+
+        Reviewed by James Robinson.
+
+        This patch creates a WebTransformationMatrix interface. It will
+        remain unused at the moment, until (a) unit tests are created
+        and (b) when we are ready to make a brief transition of all other
+        chromium code to use it.
+
+        * WebCore.gypi:
+        * platform/chromium/support/WebTransformationMatrix.cpp: Added.
+        (WebKit):
+        (WebKit::WebTransformationMatrix::WebTransformationMatrix):
+        (WebKit::WebTransformationMatrix::operator=):
+        (WebKit::WebTransformationMatrix::operator==):
+        (WebKit::WebTransformationMatrix::operator*):
+        (WebKit::WebTransformationMatrix::inverse):
+        (WebKit::WebTransformationMatrix::to2dTransform):
+        (WebKit::WebTransformationMatrix::multiply):
+        (WebKit::WebTransformationMatrix::makeIdentity):
+        (WebKit::WebTransformationMatrix::translate):
+        (WebKit::WebTransformationMatrix::translate3d):
+        (WebKit::WebTransformationMatrix::translateRight3d):
+        (WebKit::WebTransformationMatrix::scale):
+        (WebKit::WebTransformationMatrix::scaleNonUniform):
+        (WebKit::WebTransformationMatrix::scale3d):
+        (WebKit::WebTransformationMatrix::rotate):
+        (WebKit::WebTransformationMatrix::rotate3d):
+        (WebKit::WebTransformationMatrix::skewX):
+        (WebKit::WebTransformationMatrix::skewY):
+        (WebKit::WebTransformationMatrix::applyPerspective):
+        (WebKit::WebTransformationMatrix::blend):
+        (WebKit::WebTransformationMatrix::hasPerspective):
+        (WebKit::WebTransformationMatrix::isInvertible):
+        (WebKit::WebTransformationMatrix::isBackFaceVisible):
+        (WebKit::WebTransformationMatrix::isIdentity):
+        (WebKit::WebTransformationMatrix::isIdentityOrTranslation):
+        (WebKit::WebTransformationMatrix::isIntegerTranslation):
+        (WebKit::WebTransformationMatrix::m11):
+        (WebKit::WebTransformationMatrix::setM11):
+        (WebKit::WebTransformationMatrix::m12):
+        (WebKit::WebTransformationMatrix::setM12):
+        (WebKit::WebTransformationMatrix::m13):
+        (WebKit::WebTransformationMatrix::setM13):
+        (WebKit::WebTransformationMatrix::m14):
+        (WebKit::WebTransformationMatrix::setM14):
+        (WebKit::WebTransformationMatrix::m21):
+        (WebKit::WebTransformationMatrix::setM21):
+        (WebKit::WebTransformationMatrix::m22):
+        (WebKit::WebTransformationMatrix::setM22):
+        (WebKit::WebTransformationMatrix::m23):
+        (WebKit::WebTransformationMatrix::setM23):
+        (WebKit::WebTransformationMatrix::m24):
+        (WebKit::WebTransformationMatrix::setM24):
+        (WebKit::WebTransformationMatrix::m31):
+        (WebKit::WebTransformationMatrix::setM31):
+        (WebKit::WebTransformationMatrix::m32):
+        (WebKit::WebTransformationMatrix::setM32):
+        (WebKit::WebTransformationMatrix::m33):
+        (WebKit::WebTransformationMatrix::setM33):
+        (WebKit::WebTransformationMatrix::m34):
+        (WebKit::WebTransformationMatrix::setM34):
+        (WebKit::WebTransformationMatrix::m41):
+        (WebKit::WebTransformationMatrix::setM41):
+        (WebKit::WebTransformationMatrix::m42):
+        (WebKit::WebTransformationMatrix::setM42):
+        (WebKit::WebTransformationMatrix::m43):
+        (WebKit::WebTransformationMatrix::setM43):
+        (WebKit::WebTransformationMatrix::m44):
+        (WebKit::WebTransformationMatrix::setM44):
+        (WebKit::WebTransformationMatrix::a):
+        (WebKit::WebTransformationMatrix::setA):
+        (WebKit::WebTransformationMatrix::b):
+        (WebKit::WebTransformationMatrix::setB):
+        (WebKit::WebTransformationMatrix::c):
+        (WebKit::WebTransformationMatrix::setC):
+        (WebKit::WebTransformationMatrix::d):
+        (WebKit::WebTransformationMatrix::setD):
+        (WebKit::WebTransformationMatrix::e):
+        (WebKit::WebTransformationMatrix::setE):
+        (WebKit::WebTransformationMatrix::f):
+        (WebKit::WebTransformationMatrix::setF):
+        (WebKit::WebTransformationMatrix::toWebCoreTransform):
+        (WebKit::WebTransformationMatrix::mapRect):
+        (WebKit::WebTransformationMatrix::mapPoint):
+        (WebKit::WebTransformationMatrix::mapQuad):
+        (WebKit::WebTransformationMatrix::projectPoint):
+
+2012-05-11  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Make CSS Shaders render to texture framebuffers
+        https://bugs.webkit.org/show_bug.cgi?id=85113
+
+        Reviewed by Dean Jackson.
+
+        Added the required members to store the framebuffer, the texture and the depth buffer. Also removed the m_drawingBuffer
+        because context->readPixels doesn't require one anymore.
+
+        ReadPixels is not flipping the result, so I've also removed the flipping projection matrix that was specific only to Chromium.
+
+        Added a test to check that colors are not switched and the resulting image is not mirrored.
+
+        Test: css3/filters/custom/effect-color-check.html
+
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::FECustomFilter):
+        (WebCore::FECustomFilter::~FECustomFilter):
+        (WebCore):
+        (WebCore::FECustomFilter::deleteRenderBuffers):
+        (WebCore::FECustomFilter::platformApplySoftware):
+        (WebCore::FECustomFilter::initializeContext):
+        (WebCore::FECustomFilter::resizeContext):
+        (WebCore::FECustomFilter::bindProgramAndBuffers):
+        * platform/graphics/filters/FECustomFilter.h:
+        (FECustomFilter):
+
+2012-05-11  Anders Carlsson  <andersca@apple.com>
+
+        REGRESSION(r116687): [Chromium] plugins/embed-attributes-style.html shows a garbled string
+        https://bugs.webkit.org/show_bug.cgi?id=86170
+
+        Reviewed by Andreas Kling.
+
+        The string we are passing to the TextRun constructor needs to stay alive for longer so revert back to the old
+        behavior where we store it as a member variable.
+
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::unavailablePluginReplacementText):
+        (WebCore):
+        (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReason):
+        (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
+        * rendering/RenderEmbeddedObject.h:
+        (RenderEmbeddedObject):
+
+2012-05-11  Simon Fraser  <simon.fraser@apple.com>
+
+        CVDisplayLink keeps running after a single requestAnimationFrame
+        https://bugs.webkit.org/show_bug.cgi?id=86174
+        
+        Reviewed by Sam Weinig.
+        
+        A DisplayRefreshMonitor would keep its CVDisplayLink alive for as long
+        as it had clients, and the client is the ScriptedAnimationController, which
+        lives on the document. So a single requestAnimationFrame call would kick
+        off a CVDisplayLink which lived until the document was destroyed.
+        
+        Fix by having the DisplayRefreshMonitor kill itself if the CVDisplayLink
+        fires for 10 times with no scheduled callbacks (to avoid creation/deletion
+        thrash on pages that call requestAnimationFrames with short setTimeouts,
+        as some do).
+        
+        Use a HashMap in DisplayRefreshMonitorManager for the set of DisplayRefreshMonitor,
+        with the displayID as the key (using UnsignedWithZeroKeyHashTraits<uint64_t> since
+        we want to allow for 0 to be a valid displayID).
+        
+        Use a HashSet in DisplayRefreshMonitor for the client set, so that we don't have to
+        worry about adding clients twice.
+        
+        Also fix a possible crash when the only client of a DisplayRefreshMonitor
+        was removed from inside the callback by making DisplayRefreshMonitor ref-counted,
+        with a protector.
+
+        Test: fast/animation/request-animation-frame-detach-element2.html
+
+        * platform/graphics/DisplayRefreshMonitor.cpp:
+        (WebCore::DisplayRefreshMonitor::DisplayRefreshMonitor): Initialize m_unscheduledFireCount
+        (WebCore::DisplayRefreshMonitor::handleDisplayRefreshedNotificationOnMainThread): Renamed
+        from refreshDisplayOnMainThread, since it doesn't just refresh the display.
+        (WebCore::DisplayRefreshMonitor::addClient): No longer inline.
+        (WebCore::DisplayRefreshMonitor::removeClient): No longer inline.
+        (WebCore::DisplayRefreshMonitor::displayDidRefresh): Keep track of m_unscheduledFireCount,
+        which we used to kill this monitor if it has been idle for a while.
+        Use a RefPtr<DisplayRefreshMonitor> to prevent deletion while running the callback.
+        Copy the clients to a vector to protect against mutating the set while enumerating it.
+        Notify the DisplayRefreshMonitorManager when we're done, so that it can decide
+        to delete inactive monitors.
+        
+        (WebCore::DisplayRefreshMonitorManager::ensureMonitorForClient): find or allocate
+        a DisplayRefreshMonitor for a given client.
+        (WebCore::DisplayRefreshMonitorManager::registerClient): Simplified by use of HashMap.
+        (WebCore::DisplayRefreshMonitorManager::unregisterClient): Ditto.
+        (WebCore::DisplayRefreshMonitorManager::scheduleAnimation): Ditto. Uses
+        ensureMonitorForClient() since an earlier inactive monitor may have been removed.
+        (WebCore::DisplayRefreshMonitorManager::displayDidRefresh): Remove inactive
+        monitors.
+        * platform/graphics/DisplayRefreshMonitor.h: Make DisplayRefreshMonitor
+        ref-counted, to make it easier to avoid deletion while it's on the stack.
+        (WebCore::DisplayRefreshMonitor::create):
+        (DisplayRefreshMonitor):
+        (WebCore::DisplayRefreshMonitor::shouldBeTerminated):
+        (DisplayRefreshMonitorManager):
+        * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp: Attempt to
+        keep things building.
+        (WebCore::DisplayRefreshMonitor::~DisplayRefreshMonitor):
+        (WebCore::DisplayRefreshMonitor::displayLinkFired):
+        to give the manager a chance to kill this monitor.
+        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
+        (WebCore::DisplayRefreshMonitor::~DisplayRefreshMonitor):
+        (WebCore::DisplayRefreshMonitor::displayLinkFired): Don't bail early
+        if not scheduled; we want to call handleDisplayRefreshedNotificationOnMainThread(),
+
+2012-05-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: move canEditScriptSource and setScriptSource from DebuggerPresentationModel into ResourceBinding
+        https://bugs.webkit.org/show_bug.cgi?id=86234
+
+        Reviewed by Vsevolod Vlasov.
+
+        Simple move refactoring.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerResourceBinding):
+        (WebInspector.DebuggerResourceBinding.canEditScriptSource):
+        (WebInspector.DebuggerResourceBinding.setScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerResourceBinding.setScriptSource):
+        (WebInspector.DebuggerResourceBinding.prototype.canSetContent):
+        (WebInspector.DebuggerResourceBinding.prototype._uiSourceCodeForResource):
+        (WebInspector.DebuggerResourceBinding.prototype._setContentWithInitialContent):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.canEditSource):
+        (WebInspector.JavaScriptSourceFrame.prototype.editContent):
+
+2012-05-11  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Remove RenderLayer::m_scrollOverflow
+        https://bugs.webkit.org/show_bug.cgi?id=86226
+
+        Reviewed by Simon Fraser.
+
+        No expected change in behavior.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeScrollDimensions):
+        Added 2 local variables to compute the left / top scrollable overflows.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::scrolledContentOffset):
+        Returned m_scrollOffset directly as this is what the old code was doing by adding
+        m_scrollOrigin then adding m_scrollOverflow (which was set to -m_scrollOrigin in
+        computeScrollDimensions).
+
+        (RenderLayer::m_scrollOffset): Improved the comment about what m_scrollOffset is.
+
+2012-05-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: extract PresentationConsoleMessageHelper from DebuggerPresentationModel.
+        https://bugs.webkit.org/show_bug.cgi?id=86229
+
+        Reviewed by Vsevolod Vlasov.
+
+        This change also starts tracking messages along with the live location changes.
+
+        Tested with script-formatter-console.html.
+
+        * inspector/front-end/BreakpointManager.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        (WebInspector.PresentationConsoleMessageHelper):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._addPendingConsoleMessage):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._parsedScriptSource):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._debuggerReset):
+        (WebInspector.PresentationConsoleMessage):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.populateLineGutterContextMenu):
+        (WebInspector.JavaScriptSourceFrame.prototype._consoleMessageAdded):
+        (WebInspector.JavaScriptSourceFrame.prototype._setBreakpoint):
+
+2012-05-11  Emil A Eklund  <eae@chromium.org>
+
+        Simplify FloatingObject by removing unnecessary convenience methods.
+        https://bugs.webkit.org/show_bug.cgi?id=86163
+
+        Reviewed by Eric Seidel.
+
+        Simplify the pixel snapping in FloatingObject by getting rid of a bunch
+        of convenience methods.
+
+        No new tests, no change in functionality.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::addIntrudingFloats):
+        (WebCore::RenderBlock::FloatingObjects::intervalForFloatingObject):
+        (WebCore::::string):
+        * rendering/RenderBlock.h:
+        (FloatingObject):
+        (WebCore::RenderBlock::pixelSnappedLogicalTopForFloat):
+        (WebCore::RenderBlock::pixelSnappedLogicalBottomForFloat):
+        (WebCore::RenderBlock::pixelSnappedLogicalLeftForFloat):
+        (WebCore::RenderBlock::pixelSnappedLogicalRightForFloat):
+
+2012-05-11  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure that animations continue to run when transform-style is changed
+        https://bugs.webkit.org/show_bug.cgi?id=83283
+
+        Make sure that we transfer animations when changing layers due to a transform-style change.
+        Unit tested in GraphicsLayerChromiumTest.updateLayerPreserves3DWithAnimations
+
+        Reviewed by James Robinson.
+
+        Test: animations/change-transform-style-during-animation.html
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setLayerAnimationController):
+        (WebCore::LayerChromium::releaseLayerAnimationController):
+        (WebCore):
+        (WebCore::LayerChromium::notifyAnimationStarted):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
+        (WebCore::CCLayerAnimationController::CCLayerAnimationController):
+        (WebCore::CCLayerAnimationController::pushAnimationUpdatesTo):
+        (WebCore::CCLayerAnimationController::notifyAnimationStarted):
+        (WebCore::CCLayerAnimationController::setClient):
+        (WebCore):
+        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
+        (WebCore::CCLayerAnimationController::replaceImplThreadAnimations):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
+        (CCLayerAnimationController):
+        (WebCore::CCLayerAnimationController::setForceSync):
+
+2012-05-11  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Fix a reference counting issue in UserMediaRequest
+        https://bugs.webkit.org/show_bug.cgi?id=86210
+
+        Reviewed by Abhishek Arya.
+
+        When contextDestroyed() is called on UserMediaRequest it does a callback to the
+        page client. If the receiving code clears their stored copy the UserMediaRequest
+        object is destroyed in the middle of the call.
+
+        Currently only testable manually against chrome, preferably with asan turned on.
+        I have added a manual test that verifies the fix, but I have started work
+        to make DumpRenderTree able to test this and many other things. The first patch is here:
+        https://bugs.webkit.org/show_bug.cgi?id=86215
+
+        * Modules/mediastream/UserMediaRequest.cpp:
+        (WebCore::UserMediaRequest::contextDestroyed):
+
+2012-05-11  Min Qin  <qinmin@google.com>
+
+        split MediaPlayer::enterFullscreen into 2 seperate functions
+        https://bugs.webkit.org/show_bug.cgi?id=86052
+
+        Reviewed by Adam Barth.
+
+        It is confusing that enterFullscreen returns a boolean while exitFullscreen does
+        not do the same. And ios does not need the return value.
+        So remove the return value on enterFullscreen and make a seperate canEnterFullscreen()
+        function for android.
+        No tests as there are no behavior change, just refactoring.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::enterFullscreen):
+        (WebCore):
+        (WebCore::MediaPlayer::canEnterFullscreen):
+        * platform/graphics/MediaPlayer.h:
+        (MediaPlayer):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::enterFullscreen):
+        (MediaPlayerPrivateInterface):
+        (WebCore::MediaPlayerPrivateInterface::canEnterFullscreen):
+
+2012-05-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: move breakpoint manager from debuggerPresentationModel to WebInspector.
+        https://bugs.webkit.org/show_bug.cgi?id=86220
+
+        Reviewed by Yury Semikhatsky.
+
+        Now that breakpoint manager does not depend on the source mapping instance from the
+        debugger presentation model, it can be moved out.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource):
+        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent.didFormatContent):
+        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent):
+        (WebInspector.JavaScriptSource.prototype.setFormatted):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/inspector.js:
+
+2012-05-11  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Move instantiation of texture uploader to LayerRendererChromium.
+        https://bugs.webkit.org/show_bug.cgi?id=85893
+
+        Reviewed by Adrienne Walker.
+
+        Move instantiation of texture uploader to LayerRendererChromium and
+        allow CCProxy to decide between a throttled or unthrottled uploader
+        using a flag passed to the LayerRendererChromium constructor.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::create):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::initializeLayerRenderer):
+        (WebCore::CCSingleThreadProxy::recreateContext):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::initializeLayerRendererOnImplThread):
+        (WebCore::CCThreadProxy::recreateContextOnImplThread):
+
+2012-05-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: pass source mapping into UISourceCode's constructor; move formatting outside mapping.
+        https://bugs.webkit.org/show_bug.cgi?id=86099
+
+        Reviewed by Vsevolod Vlasov.
+
+        This changes moves formatting out of the source mapping machinery.
+        As a result, it removes most of the DebuggerPresentation's mapping-related code as well
+        as most of the raw source code's code.
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager):
+        (WebInspector.BreakpointManager.prototype.restoreBreakpoints):
+        (WebInspector.BreakpointManager.Breakpoint):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.setStatus):
+        * inspector/front-end/CompilerScriptMapping.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._callFrameSelected):
+        (WebInspector.DebuggerPresentationModel.prototype._handleUISourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource):
+        (WebInspector.JavaScriptSource.prototype.fireContentAvailable):
+        (WebInspector.JavaScriptSource.prototype.setFormatted.if):
+        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent.didFormatContent):
+        (WebInspector.JavaScriptSource.prototype.setFormatted.didGetContent):
+        (WebInspector.JavaScriptSource.prototype.setFormatted):
+        (WebInspector.JavaScriptSource.prototype.togglingFormatter):
+        (WebInspector.JavaScriptSource.prototype.uiLocationToRawLocation):
+        (WebInspector.JavaScriptSource.prototype.overrideLocation):
+        (WebInspector.JavaScriptSource.prototype.breakpointStorageId):
+        (WebInspector):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype._onContentChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype._breakpointRemoved):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode):
+        (WebInspector.RawSourceCode.prototype.addScript):
+        (WebInspector.RawSourceCode.prototype.rawLocationToUILocation):
+        (WebInspector.RawSourceCode.prototype._createUISourceCode):
+        (WebInspector.RawSourceCode.prototype.uiLocationToRawLocation):
+        (WebInspector.RawSourceCode.prototype.uiSourceCode):
+        (WebInspector.RawSourceCode.prototype._finishedLoading):
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping):
+        (WebInspector.ResourceScriptMapping.prototype.addScript):
+        (WebInspector.ResourceScriptMapping.prototype._handleUISourceCodeChanged):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeChanged):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.rawLocationToUILocation):
+        * inspector/front-end/ScriptFormatter.js:
+        (WebInspector.ScriptFormatter.prototype._didFormatContent):
+        (WebInspector.FormatterSourceMapping):
+        (WebInspector.FormatterSourceMapping.prototype.originalToFormatted):
+        (WebInspector.FormatterSourceMapping.prototype.formattedToOriginal):
+        (WebInspector.IdentityFormatterSourceMapping):
+        (WebInspector.IdentityFormatterSourceMapping.prototype.originalToFormatted):
+        (WebInspector.IdentityFormatterSourceMapping.prototype.formattedToOriginal):
+        (WebInspector.FormatterSourceMappingImpl):
+        (WebInspector.FormatterSourceMappingImpl.prototype.originalToFormatted):
+        (WebInspector.FormatterSourceMappingImpl.prototype.formattedToOriginal):
+        * inspector/front-end/ScriptMapping.js:
+        (WebInspector.MainScriptMapping):
+        (WebInspector.MainScriptMapping.prototype._handleUISourceCodeListChanged):
+        (WebInspector.MainScriptMapping.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._handleUISourceCodeAdded):
+        (WebInspector.ScriptsPanel.prototype.showFunctionDefinition):
+        (WebInspector.ScriptsPanel.prototype._showFile):
+        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
+        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchResultsPane.prototype.createAnchor):
+        * inspector/front-end/SnippetsModel.js:
+        (WebInspector.SnippetsScriptMapping.prototype._snippetAdded):
+        (WebInspector.SnippetsScriptMapping.prototype._createUISourceCodeForScript):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode):
+        (WebInspector.UISourceCode.prototype.requestContent):
+        (WebInspector.UISourceCode.prototype.mimeType):
+        (WebInspector.UISourceCode.prototype.content):
+        (WebInspector.UISourceCode.prototype.fireContentAvailable):
+        (WebInspector.UISourceCode.prototype.contentLoaded):
+        (WebInspector.UISourceCode.prototype.uiLocationToRawLocation):
+
+2012-05-11  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [EFL][DRT] Input Attribute Placeholder RefTests failing
+        https://bugs.webkit.org/show_bug.cgi?id=85603
+
+        Unreviewed, build fix for EFL.
+
+        * platform/efl/RenderThemeEfl.cpp:
+
+2012-05-11  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Remove support of combined nodes and edges serialization schema.
+        https://bugs.webkit.org/show_bug.cgi?id=86209
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotNode.prototype.get _nodes):
+        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesStart):
+        (WebInspector.HeapSnapshotNode.prototype._edgeIndexesEnd):
+        (WebInspector.HeapSnapshot):
+        (WebInspector.HeapSnapshot.prototype._init):
+        (WebInspector.HeapSnapshot.prototype._buildRetainers):
+        (WebInspector.HeapSnapshot.prototype._bfs):
+        (WebInspector.HeapSnapshot.prototype._buildAggregates):
+        (WebInspector.HeapSnapshot.prototype._calculateClassesRetainedSize):
+        (WebInspector.HeapSnapshot.prototype._buildDominatedNodes):
+        * inspector/front-end/HeapSnapshotLoader.js:
+        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):
+
+2012-05-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add Profiler.getHeapObjectId command
+        https://bugs.webkit.org/show_bug.cgi?id=86211
+
+        Reviewed by Pavel Feldman.
+
+        Added Profiler.getHeapObjectId command to the protocol which allows to convert remote
+        object id to heap snapshot object id.
+
+        * bindings/js/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::getHeapObjectId):
+        (WebCore):
+        * bindings/js/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::getHeapObjectId):
+        (WebCore):
+        * bindings/v8/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::findObjectById):
+        (WebCore):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::getHeapObjectId):
+        (WebCore):
+        * inspector/InspectorProfilerAgent.h:
+        (InspectorProfilerAgent):
+
+2012-05-11  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Qt support for new layout types.
+        https://bugs.webkit.org/show_bug.cgi?id=85607
+
+        Reviewed by Simon Hausmann.
+
+        Adds similar Qt support to FractionalLayout classes as Qt has for
+        FloatSomething and IntSomething classes. This means Qt code can stay
+        unchanged from after the redefinition of Layout classes.
+
+        No new functionality. No new tests.
+
+        * Target.pri:
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+        * platform/graphics/FractionalLayoutPoint.h:
+        (FractionalLayoutPoint):
+        * platform/graphics/FractionalLayoutRect.h:
+        (FractionalLayoutRect):
+        * platform/graphics/FractionalLayoutSize.h:
+        (FractionalLayoutSize):
+        * platform/graphics/qt/FractionalLayoutPointQt.cpp: Added.
+        (WebCore::FractionalLayoutPoint::FractionalLayoutPoint):
+        (WebCore::FractionalLayoutPoint::operator QPointF):
+        * platform/graphics/qt/FractionalLayoutRectQt.cpp: Added.
+        (WebCore::FractionalLayoutRect::FractionalLayoutRect):
+        (WebCore::FractionalLayoutRect::operator QRectF):
+        * platform/graphics/qt/FractionalLayoutSizeQt.cpp: Added.
+        (WebCore::FractionalLayoutSize::FractionalLayoutSize):
+        (WebCore::FractionalLayoutSize::operator QSizeF):
+
+2012-05-11  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Internals::touchPositionAdjustedToBestClickableNode adjust twice for scroll-offset
+        https://bugs.webkit.org/show_bug.cgi?id=86205
+
+        Reviewed by Simon Hausmann.
+
+        Remove the redundant conversion from document to window coords.
+
+        Test: touchadjustment/scroll-offset.html
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::touchPositionAdjustedToBestClickableNode):
+        (WebCore::Internals::bestZoomableAreaForTouchPoint):
+
+2012-05-11  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: load heap snapshot implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=86097
+
+        The idea is to have a hidden file selector control.
+        When the user select a context menu item or click a button
+        we redirect this user-action to file selector.
+        As result we see the standard file selector dialog.
+        When the user selects a file we load it's chunks and push the chunks to the worker.
+        The loaded snapshot can be completely unrelated to the current page.
+        Thats why we have to skip range selection options in Summary tab.
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/CSSSelectorProfileView.js:
+        (WebInspector.CSSSelectorProfileType.prototype.createTemporaryProfile): now it accepts a custom title.
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype._updateFilterOptions): we have to skip the profiles loaded from file because there is no guaranty t
+        (WebInspector.HeapSnapshotProfileType.prototype.createTemporaryProfile): now it accepts a custom title.
+        (WebInspector.HeapSnapshotProfileType.prototype.createProfile): cosmetic changes.
+        (WebInspector.HeapProfileHeader):
+        (WebInspector.HeapProfileHeader.prototype._setupWorker): a common part was extracted from load method and reused in loadFromFile.
+        (WebInspector.HeapProfileHeader.prototype._saveStatusUpdate): cosmetic changes.
+        (WebInspector.HeapProfileHeader.prototype.finishHeapSnapshot):
+        (WebInspector.HeapProfileHeader.prototype.canSaveToFile): cosmetic rename for better consistency with 'load' part.
+        (WebInspector.HeapProfileHeader.prototype.saveToFile): cosmetic rename for better consistency with 'load' part.
+        (WebInspector.HeapProfileHeader.prototype.canLoadFromFile): cosmetic rename for better consistency with 'load' part.
+        (WebInspector.HeapProfileHeader.prototype.loadFromFile): chunk based file loader.
+        (WebInspector.HeapProfileHeader.prototype.loadFromFile.loadNextChunk):
+        (WebInspector.HeapProfileHeader.prototype.loadFromFile.onLoad):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.createTemporaryProfile): now it accepts a custom title.
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.createTemporaryProfile): now it accepts a custom title.
+        (WebInspector.ProfileHeader.prototype.canSaveToFile): cosmetic rename for better consistency with 'load' part.
+        (WebInspector.ProfileHeader.prototype.saveToFile): cosmetic rename for better consistency with 'load' part.
+        (WebInspector.ProfileHeader.prototype.canLoadFromFile): default implementation for 'load' part.
+        (WebInspector.ProfileHeader.prototype.loadFromFile): default implementation for 'load' part.
+        (WebInspector.ProfilesPanel.prototype._createFileSelectorElement):
+        (WebInspector.ProfilesPanel.prototype._loadFromFile):
+        (WebInspector.ProfileSidebarTreeElement.prototype.handleContextMenuEvent):
+
+2012-05-11  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [EFL][DRT] Input Attribute Placeholder RefTests failing
+        https://bugs.webkit.org/show_bug.cgi?id=85603
+
+        Reviewed by Hajime Morita.
+
+        Refrain from overriding style coloring by theme coloring.
+        RenderThemeEfl was always overriding colors and whitespace
+        handling leading to failures in reftests that verify placeholder styling
+        which expect the user agent stylesheet to be applied correctly
+        without any color overrides. Also, leave whitespace handling untouched.
+
+        No new tests, covered by existing tests. See also
+        the LayoutTests/ChangeLog in this commit for the required
+        rebaselining.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::createEdje):
+        (WebCore::RenderThemeEfl::applyEdjeColors):
+        (WebCore::RenderThemeEfl::RenderThemeEfl):
+        (WebCore::RenderThemeEfl::adjustButtonStyle):
+        (WebCore::RenderThemeEfl::adjustMenuListStyle):
+        (WebCore::RenderThemeEfl::adjustTextFieldStyle):
+        (WebCore::RenderThemeEfl::adjustSearchFieldStyle):
+        * platform/efl/RenderThemeEfl.h:
+        (RenderThemeEfl):
+
+2012-05-11  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Web Intents code only supports V8
+        https://bugs.webkit.org/show_bug.cgi?id=85954
+
+        Reviewed by Adam Barth.
+
+        Add necessary abstraction for js Dictionary and ScriptValue so that
+        the Web Intents code in WebCore compiles with JSC, not just V8.
+
+        This required changes in the JSC bindings generator to pass
+        callback arguments of type SerializedScriptValue as raw pointers
+        instead of RefPtr. This matches the change made to the V8 bindings
+        generator in r104531.
+
+        * CMakeLists.txt:
+        * Modules/intents/Intent.cpp:
+        * Modules/intents/Intent.h:
+        * bindings/js/Dictionary.cpp:
+        (WebCore::Dictionary::Dictionary):
+        (WebCore):
+        (WebCore::Dictionary::getOwnPropertiesAsStringHashMap):
+        * bindings/js/Dictionary.h:
+        (Dictionary):
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::convertValue):
+        (WebCore):
+        * bindings/js/JSDictionary.h:
+        (WebCore):
+        (WebCore::JSDictionary::initializerObject):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        (WebCore):
+        * bindings/js/ScriptValue.h:
+        (ScriptValue):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (AddIncludesForType):
+        (GenerateCallbackHeader):
+        (GenerateCallbackImplementation):
+        (GetNativeTypeForCallbacks):
+
+2012-05-11  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Can't type spaces in "Override User Agent" field
+        https://bugs.webkit.org/show_bug.cgi?id=86202
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/HelpScreen.js:
+        (WebInspector.HelpScreen.prototype.isClosingKey):
+        (WebInspector.HelpScreen.prototype._onKeyDown):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen.prototype.isClosingKey):
+
+2012-05-11  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [EFL][DRT] Input Attribute Placeholder RefTests failing
+        https://bugs.webkit.org/show_bug.cgi?id=85603
+
+        Reviewed by Hajime Morita.
+
+        Refrain from overriding style coloring by theme coloring.
+        RenderThemeEfl was always overriding colors and whitespace
+        handling leading to failures in reftests that verify placeholder styling
+        which expect the user agent stylesheet to be applied correctly
+        without any color overrides. Also, leave whitespace handling untouched.
+
+        No new tests, covered by existing tests. See also
+        the LayoutTests/ChangeLog in this commit for the required
+        rebaselining.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::createEdje):
+        (WebCore::RenderThemeEfl::applyEdjeColors):
+        (WebCore::RenderThemeEfl::RenderThemeEfl):
+        (WebCore::RenderThemeEfl::adjustButtonStyle):
+        (WebCore::RenderThemeEfl::adjustMenuListStyle):
+        (WebCore::RenderThemeEfl::adjustTextFieldStyle):
+        (WebCore::RenderThemeEfl::adjustSearchFieldStyle):
+        * platform/efl/RenderThemeEfl.h:
+        (RenderThemeEfl):
+
+2012-05-11  Gustavo Noronha Silva  <gns@gnome.org>
+
+        REGRESSION(r116205): [GTK]: build no longer supports thin archives
+        https://bugs.webkit.org/show_bug.cgi?id=86207
+
+        * GNUmakefile.am: go back to not linking libWebCoreModules into
+        libWebCore; when linking 2 convenience libraries libtools tries to
+        extract the object files from one of them to add to the other, breaking
+        thin archive builds
+
+2012-05-11  Keishi Hattori  <keishi@webkit.org>
+
+        Sanitization algorithm for input type=email should strip whitespaces
+        https://bugs.webkit.org/show_bug.cgi?id=86177
+
+        Reviewed by Kent Tamura.
+
+        No new tests. Covered by: fast/forms/ValidityState-typeMismatch-email.html
+
+        The spec says that the value sanitization algorithm should
+        > Strip line breaks from the value, then strip leading and trailing whitespace from the value.
+
+        * html/EmailInputType.cpp:
+        (WebCore::EmailInputType::sanitizeValue):
+
+2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r116752.
+        http://trac.webkit.org/changeset/116752
+        https://bugs.webkit.org/show_bug.cgi?id=86201
+
+        Build failure on Chromium-mac (Requested by tkent on #webkit).
+
+        * html/FormAssociatedElement.cpp:
+        * html/FormAssociatedElement.h:
+        (FormAssociatedElement):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::setCustomValidity):
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isValidValue):
+        (WebCore::HTMLInputElement::typeMismatch):
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::minimum):
+        (WebCore::HTMLInputElement::maximum):
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::minimumString):
+        (WebCore::HTMLInputElement::maximumString):
+        (WebCore):
+        (WebCore::HTMLInputElement::stepBaseString):
+        (WebCore::HTMLInputElement::stepString):
+        (WebCore::HTMLInputElement::typeMismatchText):
+        (WebCore::HTMLInputElement::valueMissingText):
+        (WebCore::HTMLInputElement::isInRange):
+        (WebCore::HTMLInputElement::isOutOfRange):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/HTMLObjectElement.h:
+        (WebCore::HTMLObjectElement::setCustomValidity):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::valueMissing):
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLTextAreaElement.cpp:
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::valueMissing):
+        (HTMLTextAreaElement):
+        * html/InputType.cpp:
+        (WebCore::InputType::alignValueForStep):
+        (WebCore::InputType::stepUpFromRenderer):
+        * html/InputType.h:
+        (InputType):
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::validationMessage):
+        (WebCore):
+        (WebCore::ValidityState::setCustomErrorMessage):
+        (WebCore::ValidityState::valueMissing):
+        (WebCore::ValidityState::typeMismatch):
+        (WebCore::ValidityState::patternMismatch):
+        (WebCore::ValidityState::tooLong):
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        (WebCore::ValidityState::stepMismatch):
+        (WebCore::ValidityState::customError):
+        (WebCore::ValidityState::valid):
+        * html/ValidityState.h:
+        (ValidityState):
+
+2012-05-11  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Search box doesn't allow CSS selectors anymore
+        https://bugs.webkit.org/show_bug.cgi?id=86196
+
+        Reviewed by Pavel Feldman.
+
+        Refactoring in http://trac.webkit.org/changeset/99983 inadvertently removed the selector matching during
+        node search in the InspectorDOMAgent. This change re-introduces the Document::querySelectorAll() evaluation
+        for the user query.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::performSearch):
+
+2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r116527.
+        http://trac.webkit.org/changeset/116527
+        https://bugs.webkit.org/show_bug.cgi?id=86199
+
+        Causing crashes on ClusterFuzz (Requested by inferno-sec on
+        #webkit).
+
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::updateScrollbarPart):
+        * rendering/RenderScrollbarPart.h:
+
+2012-05-11  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Move ValidityState methods implementation to another place
+        https://bugs.webkit.org/show_bug.cgi?id=86058
+
+        Reviewed by Kent Tamura.
+
+        This patch changes ValidityState class for limiting scope of
+        number/range input type related methods for introducing decimal
+        arithmetic.
+
+        Methods related to validation are moved from ValidateState to
+        input, select and textarea elements with virtual method based
+        dispatching via FormAssociateElement instead of tag name
+        dispatching so far for code simplification.
+
+        No new tests. This patch doesn't change behavior.
+
+        * html/FormAssociatedElement.cpp:
+        (WebCore::FormAssociatedElement::customError): Added. Called from ValidateState. Returns custom error mssage in member variable.
+        (WebCore::FormAssociatedElement::patternMismatch): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::rangeOverflow): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::rangeUnderflow): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::stepMismatch): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::tooLong): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::typeMismatch): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::valid): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::valueMissing): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::customValidationMessage): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::validationMessage): Added.  Called from ValidateState. This is default implementation.
+        (WebCore::FormAssociatedElement::setCustomValidity): Added.  set custom error message.
+        * html/FormAssociatedElement.h:
+        (FormAssociatedElement): Added new instance value m_customValidationMessage.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::setCustomValidity): Changed. Calls base class setCustomValidity.
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isValidValue): Call m_inputType methods instead of HTMLInputElement's.
+        (WebCore::HTMLInputElement::tooLong): Call m_inputType methods instead of HTMLInputElement's.
+        (WebCore):
+        (WebCore::HTMLInputElement::typeMismatch): Move implementation to InputType.
+        (WebCore::HTMLInputElement::valueMissing):  Move implementation to InputType.
+        (WebCore::HTMLInputElement::patternMismatch): Move implementation to InputType.
+        (WebCore::HTMLInputElement::rangeUnderflow): Move implementation to InputType.
+        (WebCore::HTMLInputElement::rangeOverflow): Move implementation to InputType.
+        (WebCore::HTMLInputElement::validationMessage): Move implementation to InputType.
+        (WebCore::HTMLInputElement::stepMismatch): Move implementation to InputType.
+        (WebCore::HTMLInputElement::isInRange): Call m_inputType methods instead of HTMLInputElement's.
+        (WebCore::HTMLInputElement::isOutOfRange): Call m_inputType methods instead of HTMLInputElement's.
+        * html/HTMLInputElement.h:
+        (HTMLInputElement): Make tooLong method private.
+        * html/HTMLObjectElement.h: Add "virtual" and "OVERRIDE".
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::validationMessage): Added. Implementation for HTMLSelectElement.
+        (WebCore::HTMLSelectElement::valueMissing): Added. Implementation for HTMLSelectElement.
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):  Added entries for newly added methods.
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::validationMessage): Added. Implementation for HTMLTextAreaElement.
+        (WebCore::HTMLTextAreaElement::valueMissing): Added. Implementation for HTMLTextAreaElement.
+        (WebCore::HTMLTextAreaElement::tooLong): Added. Implementation for HTMLTextAreaElement.
+        * html/HTMLTextAreaElement.h:
+        (HTMLTextAreaElement): Added entries for newly added methods. Change tooLong and valueMissing private.
+        * html/InputType.cpp:
+        (WebCore::InputType::stepMismatch): Change method signature.
+        (WebCore::InputType::alignValueForStep):  Changed for calling InputClass instead of HTMLINputElement.
+        (WebCore::InputType::stepUpFromRenderer):  Added. Moved from HTMLInputElement.
+        (WebCore::InputType::validationMessage): Added.  Moved from HTMLInputElement.
+        * html/InputType.h:
+        (InputType): Added entries for newly added methods and update methods signature.
+        * html/ValidityState.cpp: Move actual implementation to FormAssociatedElement and derived classes for localizing implementation change of elements and input types.
+        (WebCore::ValidityState::validationMessage): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::valueMissing): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::typeMismatch): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::patternMismatch): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::tooLong): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::rangeUnderflow): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::rangeOverflow): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::stepMismatch): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::customError): Changed to call FormAssociatedElement's method.
+        (WebCore::ValidityState::valid):
+        * html/ValidityState.h:
+        (ValidityState): Remove custom validation message related things.
+
+2012-05-11  Kent Tamura  <tkent@chromium.org>
+
+        Fix a build error without SVG, introduced by tab-size support.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-05-11  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Refactoring] Move Selection from DOMWindow to TreeScope.
+        https://bugs.webkit.org/show_bug.cgi?id=82699
+
+        Reviewed by Ryosuke Niwa.
+
+        Since ShadowRoot will also manage its own version of DOMSelection, we would like to
+        share the code among Document and DOMSelection. This patch moves DOMSelection from DOMWindow to TreeScope
+        so that ShadowRoot can also use it.
+
+        No new tests, should covered by existing tests.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateFocusAppearanceTimerFired):
+        * dom/Document.h:
+        (Document):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::selection):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::~TreeScope):
+        (WebCore::TreeScope::getSelection):
+        (WebCore):
+        * dom/TreeScope.h:
+        (WebCore):
+        (TreeScope):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::DOMSelection):
+        (WebCore::DOMSelection::clearTreeScope):
+        (WebCore):
+        * page/DOMSelection.h:
+        (WebCore):
+        (WebCore::DOMSelection::create):
+        (DOMSelection):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::clearDOMWindowProperties):
+        (WebCore::DOMWindow::getSelection):
+        * page/DOMWindow.h:
+        (DOMWindow):
+
+2012-05-04  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: console should allow JS execution in the context of an isolated world
+        https://bugs.webkit.org/show_bug.cgi?id=85612
+
+        Reviewed by Pavel Feldman.
+
+        Added an option to select not only a frame but also isolated world in which
+        to perform evaluation of the code typed into the console.
+
+        Each execution context can be identified using it injected script id. We call it
+        execution context id in the protocol. Runtime agent is extended with an event that
+        is sent when new ExecutionContext is created. The event tracking can be enabled/disabled
+        using setReportExecutionContextCreation command.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore):
+        (WebCore::isolatedWorldToSecurityOriginMap):
+        * bindings/js/ScriptController.h:
+        (ScriptController):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::isolatedWorldScriptState):
+        (WebCore):
+        * bindings/js/ScriptState.h:
+        (WebCore):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore):
+        (WebCore::ScriptController::isolatedWorldToSecurityOriginMap):
+        * bindings/v8/ScriptController.h:
+        (ScriptController):
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::isolatedWorldScriptState):
+        (WebCore):
+        * bindings/v8/ScriptState.h:
+        (WebCore):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::setSecurityOrigin):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setIsolatedWorldSecurityOrigin):
+        (WebCore::V8Proxy::isolatedWorldContext):
+        (WebCore):
+        (WebCore::V8Proxy::isolatedWorldToSecurityOriginMap):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+        * inspector/CodeGeneratorInspector.py:
+        (DomainNameFixes):
+        * inspector/Inspector.json:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didCreateIsolatedContextImpl):
+        (WebCore):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::didCreateIsolatedContext):
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        * inspector/InspectorRuntimeAgent.h:
+        (InspectorRuntimeAgent):
+        * inspector/InstrumentingAgents.h:
+        (WebCore):
+        (WebCore::InstrumentingAgents::InstrumentingAgents):
+        (WebCore::InstrumentingAgents::pageRuntimeAgent):
+        (WebCore::InstrumentingAgents::setPageRuntimeAgent):
+        (InstrumentingAgents):
+        * inspector/PageRuntimeAgent.cpp:
+        (PageRuntimeAgentState):
+        (WebCore):
+        (WebCore::PageRuntimeAgent::PageRuntimeAgent):
+        (WebCore::PageRuntimeAgent::setFrontend):
+        (WebCore::PageRuntimeAgent::clearFrontend):
+        (WebCore::PageRuntimeAgent::restore):
+        (WebCore::PageRuntimeAgent::setReportExecutionContextCreation):
+        (WebCore::PageRuntimeAgent::didCreateExecutionContext):
+        (WebCore::PageRuntimeAgent::getScriptStateForEval):
+        * inspector/PageRuntimeAgent.h:
+        (WebCore):
+        (PageRuntimeAgent):
+        * inspector/WorkerRuntimeAgent.cpp:
+        (WebCore::WorkerRuntimeAgent::setReportExecutionContextCreation):
+        (WebCore::WorkerRuntimeAgent::getScriptStateForEval):
+        * inspector/WorkerRuntimeAgent.h:
+        (WorkerRuntimeAgent):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.get statusBarItems):
+        (WebInspector.ConsoleView.prototype.addContext):
+        (WebInspector.ConsoleView.prototype.removeContext):
+        (WebInspector.ConsoleView.prototype._updateIsolatedWorldSelector):
+        (WebInspector.ConsoleView.prototype._contextUpdated):
+        (WebInspector.ConsoleView.prototype._addedExecutionContext):
+        (WebInspector.ConsoleView.prototype._currentEvaluationContextId):
+        (WebInspector.ConsoleView.prototype._currentEvaluationContext):
+        (WebInspector.ConsoleView.prototype._currentIsolatedWorldId):
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionSidebarPane.prototype.setExpression):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onEvaluateOnInspectedPage):
+        * inspector/front-end/JavaScriptContextManager.js:
+        (WebInspector.JavaScriptContextManager):
+        (WebInspector.JavaScriptContextManager.prototype._didLoadCachedResources):
+        (WebInspector.JavaScriptContextManager.prototype.isolatedContextCreated):
+        (WebInspector.RuntimeDispatcher):
+        (WebInspector.RuntimeDispatcher.prototype.isolatedContextCreated):
+        (WebInspector.ExecutionContext):
+        (WebInspector.ExecutionContext.comparator):
+        (WebInspector.FrameEvaluationContext):
+        (WebInspector.FrameEvaluationContext.prototype._frameNavigated):
+        (WebInspector.FrameEvaluationContext.prototype._addExecutionContext):
+        (WebInspector.FrameEvaluationContext.prototype._ensureMainWorldContextAdded):
+        (WebInspector.FrameEvaluationContext.prototype.isolatedContexts):
+
+2012-05-11  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: use div, not span as a parent element for ElementsTreeOutline in Audits panel
+        https://bugs.webkit.org/show_bug.cgi?id=86188
+
+        Reviewed by Yury Semikhatsky.
+
+        We need to use <div>, not <span> as a container for ElementsTreeOutline, as latter accesses its parent offsetWidth
+        within _treeElementFromEvent(), which returns 0 for inline elements.
+
+        * inspector/front-end/AuditFormatters.js:
+        (WebInspector.AuditFormatters.node.onNodeAvailable):
+        (WebInspector.AuditFormatters.node):
+
+2012-05-11  Antti Koivisto  <antti@apple.com>
+
+        Inline Node::traverseNextNode
+        https://bugs.webkit.org/show_bug.cgi?id=85844
+
+        Reviewed by Ryosuke Niwa.
+        
+        Inline traverseNextNode and traverseNextSibling to reduce entry/exit overhead and allow better code generation
+        for many hot loops.
+
+        In this version only the firstChild()/nextSibling() tests are inlined and the ancestor traversal is not.
+        
+        Performance bots will tell if this was worthwhile.
+
+        * dom/ContainerNode.h:
+        (WebCore::Node::traverseNextNode):
+        (WebCore):
+        (WebCore::Node::traverseNextSibling):
+        * dom/Node.cpp:
+        (WebCore::Node::traverseNextAncestorSibling):
+        * dom/Node.h:
+        (Node):
+        * bindings/v8/RetainedDOMInfo.cpp:
+
+2012-05-07  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: get rid of InspectorAgent::emitCommitLoadIfNeeded method
+        https://bugs.webkit.org/show_bug.cgi?id=85708
+
+        Reviewed by Pavel Feldman.
+
+        Instead of calling emitCommitLoadIfNeeded after all agents are restored
+        required actions are performed directly in the restore() methods.
+
+        * inspector/InspectorAgent.cpp:
+        * inspector/InspectorAgent.h:
+        (WebCore::InspectorAgent::didCommitLoadFired):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::restoreInspectorStateFromCookie):
+        * inspector/InspectorDatabaseAgent.cpp:
+        (WebCore::InspectorDatabaseAgent::restore):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::create):
+        (WebCore::InspectorPageAgent::InspectorPageAgent):
+        (WebCore::InspectorPageAgent::restore):
+        * inspector/InspectorPageAgent.h:
+        (WebCore):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::restore):
+
+2012-05-10  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [Extensions API] add audit formatters for remote objects and DOM elements
+        https://bugs.webkit.org/show_bug.cgi?id=86108
+
+        Reviewed by Pavel Feldman.
+
+       - added two new formatters to AuditResults object of webInspector.audits API;
+
+        * inspector/front-end/AuditFormatters.js:
+        (WebInspector.AuditFormatters.resourceLink):
+        (WebInspector.AuditFormatters.object.onEvaluate):
+        (WebInspector.AuditFormatters.object): format as a remote object property list;
+        (WebInspector.AuditFormatters.node.onNodeAvailable):
+        (WebInspector.AuditFormatters.node.onEvaluate):
+        (WebInspector.AuditFormatters.node): format as a DOM elements sub-tree;
+        (WebInspector.AuditFormatters.Utilities.evaluate): common expression evaluation logic for both new formatters;
+        * inspector/front-end/ExtensionAPI.js:
+        (injectedExtensionAPI.AuditResultImpl):
+        * inspector/front-end/auditsPanel.css:
+        (.audit-result-tree ol.outline-disclosure):
+        (.audit-result-tree .section .header):
+        (.audit-result-tree .section .header::before):
+
 2012-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r116727.
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index 94526ac8b..9542d1058 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -38,6 +38,7 @@ ENABLE_BLOB = ENABLE_BLOB;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
 ENABLE_CSS_GRID_LAYOUT = ENABLE_CSS_GRID_LAYOUT;
+ENABLE_CSS_VARIABLES = ;
 ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
 ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 ENABLE_DATALIST = ;
@@ -123,4 +124,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PREFENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PREFENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index 62c44ed52..1a5ed6613 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index ef85bd959..de29105b7 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -344,11 +344,6 @@ if USE_GSTREAMER
 if ENABLE_DEBUG
 webcore_cppflags += -DGST_DISABLE_DEPRECATED
 endif # END ENABLE_DEBUG
-webcore_libadd += \
-	-lgstinterfaces-0.10 \
-	-lgstvideo-0.10 \
-	-lgstpbutils-0.10 \
-	-lgstapp-0.10
 endif # END USE_GSTREAMER
 endif # END ENABLE_VIDEO
 
@@ -911,9 +906,6 @@ libWebCore_la_CPPFLAGS = \
 	$(XRENDER_CFLAGS) \
 	$(XT_CFLAGS)
 
-libWebCore_la_LIBADD = \
-	libWebCoreModules.la
-
 libWebCoreModules_la_SOURCES = \
 	$(webcore_modules_sources)
 
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index 99b439866..68a99a3cb 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -1651,7 +1651,6 @@ webcore_sources += \
 	Source/WebCore/css/CSSSelector.h \
 	Source/WebCore/css/CSSSelectorList.cpp \
 	Source/WebCore/css/CSSSelectorList.h \
-	Source/WebCore/css/CSSStyleDeclaration.cpp \
 	Source/WebCore/css/CSSStyleDeclaration.h \
 	Source/WebCore/css/CSSStyleRule.cpp \
 	Source/WebCore/css/CSSStyleRule.h \
@@ -1990,8 +1989,6 @@ webcore_sources += \
 	Source/WebCore/dom/TreeDepthLimit.h \
 	Source/WebCore/dom/TreeScope.cpp \
 	Source/WebCore/dom/TreeScope.h \
-	Source/WebCore/dom/TreeScopeAdjuster.cpp \
-	Source/WebCore/dom/TreeScopeAdjuster.h \
 	Source/WebCore/dom/TreeScopeAdopter.cpp \
 	Source/WebCore/dom/TreeScopeAdopter.h \
 	Source/WebCore/dom/TreeWalker.cpp \
@@ -2502,14 +2499,14 @@ webcore_sources += \
 	Source/WebCore/html/parser/XSSAuditor.h \
 	Source/WebCore/html/shadow/CalendarPickerElement.cpp \
 	Source/WebCore/html/shadow/CalendarPickerElement.h \
+	Source/WebCore/html/shadow/ContentDistributor.cpp \
+	Source/WebCore/html/shadow/ContentDistributor.h \
 	Source/WebCore/html/shadow/ContentSelectorQuery.cpp \
 	Source/WebCore/html/shadow/ContentSelectorQuery.h \
 	Source/WebCore/html/shadow/DetailsMarkerControl.cpp \
 	Source/WebCore/html/shadow/DetailsMarkerControl.h \
 	Source/WebCore/html/shadow/HTMLContentElement.cpp \
 	Source/WebCore/html/shadow/HTMLContentElement.h \
-	Source/WebCore/html/shadow/HTMLContentSelector.cpp \
-	Source/WebCore/html/shadow/HTMLContentSelector.h \
 	Source/WebCore/html/shadow/InsertionPoint.cpp \
 	Source/WebCore/html/shadow/InsertionPoint.h \
 	Source/WebCore/html/shadow/MediaControls.cpp \
@@ -2850,6 +2847,10 @@ webcore_sources += \
 	Source/WebCore/loader/PolicyCallback.h \
 	Source/WebCore/loader/PolicyChecker.cpp \
 	Source/WebCore/loader/PolicyChecker.h \
+	Source/WebCore/loader/Prerenderer.cpp \
+	Source/WebCore/loader/Prerenderer.h \
+	Source/WebCore/loader/PrerendererClient.cpp \
+	Source/WebCore/loader/PrerendererClient.h \
 	Source/WebCore/loader/ProgressTracker.cpp \
 	Source/WebCore/loader/ProgressTracker.h \
 	Source/WebCore/loader/NavigationScheduler.cpp \
@@ -3211,7 +3212,6 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/filters/SourceGraphic.h \
 	Source/WebCore/platform/graphics/filters/SpotLightSource.cpp \
 	Source/WebCore/platform/graphics/filters/SpotLightSource.h \
-	Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp \
 	Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.h \
 	Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.cpp \
 	Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h \
@@ -3547,6 +3547,7 @@ webcore_sources += \
 	Source/WebCore/platform/PopupMenuClient.h \
 	Source/WebCore/platform/PopupMenu.h \
 	Source/WebCore/platform/PopupMenuStyle.h \
+	Source/WebCore/platform/PrerenderHandle.h \
 	Source/WebCore/platform/PurgeableBuffer.h \
 	Source/WebCore/platform/PurgePriority.h \
 	Source/WebCore/platform/ReferrerPolicy.h \
@@ -3670,6 +3671,8 @@ webcore_sources += \
 	Source/WebCore/platform/UUID.cpp \
 	Source/WebCore/platform/UUID.h \
 	Source/WebCore/platform/VisitedLinkStrategy.h \
+	Source/WebCore/platform/VisitedLinks.cpp \
+	Source/WebCore/platform/VisitedLinks.h \
 	Source/WebCore/platform/Widget.cpp \
 	Source/WebCore/platform/Widget.h \
 	Source/WebCore/platform/WindowsKeyboardCodes.h \
@@ -4923,6 +4926,10 @@ if ENABLE_INDEXED_DATABASE
 webcore_built_sources += \
 	DerivedSources/WebCore/JSIDBAny.cpp \
 	DerivedSources/WebCore/JSIDBAny.h \
+	DerivedSources/WebCore/JSIDBCursor.cpp \
+	DerivedSources/WebCore/JSIDBCursor.h \
+	DerivedSources/WebCore/JSIDBCursorWithValue.cpp \
+	DerivedSources/WebCore/JSIDBCursorWithValue.h \
 	DerivedSources/WebCore/JSIDBDatabaseException.cpp \
 	DerivedSources/WebCore/JSIDBDatabaseException.h \
 	DerivedSources/WebCore/JSIDBDatabase.cpp \
@@ -4931,6 +4938,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSIDBFactory.h \
 	DerivedSources/WebCore/JSIDBIndex.cpp \
 	DerivedSources/WebCore/JSIDBIndex.h \
+	DerivedSources/WebCore/JSIDBKey.cpp \
+	DerivedSources/WebCore/JSIDBKey.h \
 	DerivedSources/WebCore/JSIDBKeyRange.cpp \
 	DerivedSources/WebCore/JSIDBKeyRange.h \
 	DerivedSources/WebCore/JSIDBObjectStore.cpp \
@@ -4938,20 +4947,30 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSIDBRequest.cpp \
 	DerivedSources/WebCore/JSIDBRequest.h \
 	DerivedSources/WebCore/JSIDBTransaction.cpp \
-	DerivedSources/WebCore/JSIDBTransaction.h
+	DerivedSources/WebCore/JSIDBTransaction.h \
+	DerivedSources/WebCore/JSIDBVersionChangeEvent.cpp \
+	DerivedSources/WebCore/JSIDBVersionChangeEvent.h \
+	DerivedSources/WebCore/JSIDBVersionChangeRequest.cpp \
+	DerivedSources/WebCore/JSIDBVersionChangeRequest.h
 
 dom_binding_idls += \
 	$(WebCore)/Modules/indexeddb/DOMWindowIndexedDatabase.idl \
 	$(WebCore)/Modules/indexeddb/IDBAny.idl \
-	$(WebCore)/Modules/indexeddb/IDBDatabase.idl \
+	$(WebCore)/Modules/indexeddb/IDBCursor.idl \
+	$(WebCore)/Modules/indexeddb/IDBCursorWithValue.idl \
 	$(WebCore)/Modules/indexeddb/IDBDatabaseException.idl \
+	$(WebCore)/Modules/indexeddb/IDBDatabase.idl \
 	$(WebCore)/Modules/indexeddb/IDBFactory.idl \
 	$(WebCore)/Modules/indexeddb/IDBIndex.idl \
+	$(WebCore)/Modules/indexeddb/IDBKey.idl \
 	$(WebCore)/Modules/indexeddb/IDBKeyRange.idl \
 	$(WebCore)/Modules/indexeddb/IDBObjectStore.idl \
 	$(WebCore)/Modules/indexeddb/IDBRequest.idl \
 	$(WebCore)/Modules/indexeddb/IDBTransaction.idl \
+	$(WebCore)/Modules/indexeddb/IDBVersionChangeEvent.idl \
+	$(WebCore)/Modules/indexeddb/IDBVersionChangeRequest.idl \
 	$(WebCore)/Modules/indexeddb/WorkerContextIndexedDatabase.idl
+
 endif # END ENABLE_INDEXED_DATABASE
 
 # ----
@@ -5526,6 +5545,8 @@ webcore_sources += \
 	Source/WebCore/Modules/webaudio/AudioProcessingEvent.h \
 	Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp \
 	Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.h \
+	Source/WebCore/Modules/webaudio/AudioSummingJunction.cpp \
+	Source/WebCore/Modules/webaudio/AudioSummingJunction.h \
 	Source/WebCore/Modules/webaudio/AudioSourceNode.h \
 	Source/WebCore/Modules/webaudio/BiquadDSPKernel.cpp \
 	Source/WebCore/Modules/webaudio/BiquadDSPKernel.h \
diff --git a/Source/WebCore/Modules/filesystem/DOMFileSystem.cpp b/Source/WebCore/Modules/filesystem/DOMFileSystem.cpp
index 090bcc052..7bb0a6757 100644
--- a/Source/WebCore/Modules/filesystem/DOMFileSystem.cpp
+++ b/Source/WebCore/Modules/filesystem/DOMFileSystem.cpp
@@ -123,11 +123,11 @@ void DOMFileSystem::createWriter(const FileEntry* fileEntry, PassRefPtr<FileWrit
 
 namespace {
 
-class GetPathCallback : public FileSystemCallbacksBase {
+class GetMetadataCallback : public FileSystemCallbacksBase {
 public:
-    static PassOwnPtr<GetPathCallback> create(PassRefPtr<DOMFileSystem> filesystem, const String& name, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+    static PassOwnPtr<GetMetadataCallback> create(PassRefPtr<DOMFileSystem> filesystem, const String& name, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
     {
-        return adoptPtr(new GetPathCallback(filesystem, name, successCallback, errorCallback));
+        return adoptPtr(new GetMetadataCallback(filesystem, name, successCallback, errorCallback));
     }
 
     virtual void didReadMetadata(const FileMetadata& metadata)
@@ -136,12 +136,18 @@ public:
         if (!m_successCallback)
             return;
 
-        m_successCallback->handleEvent(File::createWithName(metadata.platformPath, m_name).get());
+        // For regular filesystem types (temporary or persistent), we should not cache file metadata as it could change File semantics.
+        // For other filesystem types (which could be platform-specific ones), there's a chance that the files are on remote filesystem. If the port has returned metadata just pass it to File constructor (so we may cache the metadata).
+        if (m_filesystem->type() == FileSystemTypeTemporary || m_filesystem->type() == FileSystemTypePersistent)
+            m_successCallback->handleEvent(File::createWithName(metadata.platformPath, m_name).get());
+        else
+            m_successCallback->handleEvent(File::createForFileSystemFile(m_name, metadata).get());
+
         m_successCallback.release();
     }
 
 private:
-    GetPathCallback(PassRefPtr<DOMFileSystem> filesystem, const String& name,  PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+    GetMetadataCallback(PassRefPtr<DOMFileSystem> filesystem, const String& name,  PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
         : FileSystemCallbacksBase(errorCallback)
         , m_filesystem(filesystem)
         , m_name(name)
@@ -158,7 +164,7 @@ private:
 
 void DOMFileSystem::createFile(const FileEntry* fileEntry, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
-    m_asyncFileSystem->createSnapshotFileAndReadMetadata(createFileSystemURL(fileEntry), GetPathCallback::create(this, fileEntry->name(), successCallback, errorCallback));
+    m_asyncFileSystem->createSnapshotFileAndReadMetadata(createFileSystemURL(fileEntry), GetMetadataCallback::create(this, fileEntry->name(), successCallback, errorCallback));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/filesystem/DOMFileSystemBase.cpp b/Source/WebCore/Modules/filesystem/DOMFileSystemBase.cpp
index 62fcea00a..33cc1301c 100644
--- a/Source/WebCore/Modules/filesystem/DOMFileSystemBase.cpp
+++ b/Source/WebCore/Modules/filesystem/DOMFileSystemBase.cpp
@@ -68,6 +68,50 @@ DOMFileSystemBase::~DOMFileSystemBase()
 {
 }
 
+#if !PLATFORM(CHROMIUM)
+// static
+bool DOMFileSystemBase::isValidType(FileSystemType type)
+{
+    return type == FileSystemTypeTemporary || type == FileSystemTypePersistent;
+}
+
+// static
+bool DOMFileSystemBase::crackFileSystemURL(const KURL& url, FileSystemType& type, String& filePath)
+{
+    if (!url.protocolIs("filesystem"))
+        return false;
+
+    if (!url.innerURL())
+        return false;
+
+    String typeString = url.innerURL()->path().substring(1);
+    if (typeString == temporaryPathPrefix)
+        type = FileSystemTypeTemporary;
+    else if (typeString == persistentPathPrefix)
+        type = FileSystemTypePersistent;
+    else
+        return false;
+
+    filePath = decodeURLEscapeSequences(url.path());
+    return true;
+}
+
+bool DOMFileSystemBase::supportsToURL() const
+{
+    ASSERT(isValidType(m_type));
+    return true;
+}
+
+KURL DOMFileSystemBase::createFileSystemURL(const String& fullPath) const
+{
+    ASSERT(DOMFilePath::isAbsolute(fullPath));
+    KURL url = m_filesystemRootURL;
+    // Remove the extra leading slash.
+    url.setPath(url.path() + encodeWithURLEscapeSequences(fullPath.substring(1)));
+    return url;
+}
+#endif
+
 SecurityOrigin* DOMFileSystemBase::securityOrigin() const
 {
     return m_context->securityOrigin();
diff --git a/Source/WebCore/Modules/filesystem/DOMFileSystemSync.cpp b/Source/WebCore/Modules/filesystem/DOMFileSystemSync.cpp
index 8a57d005e..bc36caedd 100644
--- a/Source/WebCore/Modules/filesystem/DOMFileSystemSync.cpp
+++ b/Source/WebCore/Modules/filesystem/DOMFileSystemSync.cpp
@@ -98,9 +98,9 @@ public:
         friend class WTF::RefCounted<CreateFileResult>;
     };
 
-    static PassOwnPtr<CreateFileHelper> create(PassRefPtr<CreateFileResult> result, const String& name)
+    static PassOwnPtr<CreateFileHelper> create(PassRefPtr<CreateFileResult> result, const String& name, FileSystemType type)
     {
-        return adoptPtr(new CreateFileHelper(result, name));
+        return adoptPtr(new CreateFileHelper(result, name, type));
     }
 
     virtual void didFail(int code)
@@ -115,17 +115,24 @@ public:
 
     void didReadMetadata(const FileMetadata& metadata)
     {
-        m_result->m_file = File::createWithName(metadata.platformPath, m_name);
+        // For regular filesystem types (temporary or persistent), we should not cache file metadata as it could change File semantics.
+        // For other filesystem types (which could be platform-specific ones), there's a chance that the files are on remote filesystem. If the port has returned metadata just pass it to File constructor (so we may cache the metadata).
+        if (m_type == FileSystemTypeTemporary || m_type == FileSystemTypePersistent)
+            m_result->m_file = File::createWithName(metadata.platformPath, m_name);
+        else
+            m_result->m_file = File::createForFileSystemFile(m_name, metadata);
     }
 private:
-    CreateFileHelper(PassRefPtr<CreateFileResult> result, const String& name)
+    CreateFileHelper(PassRefPtr<CreateFileResult> result, const String& name, FileSystemType type)
         : m_result(result)
         , m_name(name)
+        , m_type(type)
     {
     }
 
     RefPtr<CreateFileResult> m_result;
     String m_name;
+    FileSystemType m_type;
 };
 
 } // namespace
@@ -134,7 +141,7 @@ PassRefPtr<File> DOMFileSystemSync::createFile(const FileEntrySync* fileEntry, E
 {
     ec = 0;
     RefPtr<CreateFileHelper::CreateFileResult> result(CreateFileHelper::CreateFileResult::create());
-    m_asyncFileSystem->createSnapshotFileAndReadMetadata(createFileSystemURL(fileEntry), CreateFileHelper::create(result, fileEntry->name()));
+    m_asyncFileSystem->createSnapshotFileAndReadMetadata(createFileSystemURL(fileEntry), CreateFileHelper::create(result, fileEntry->name(), type()));
     if (!m_asyncFileSystem->waitForOperationToComplete()) {
         ec = FileException::ABORT_ERR;
         return 0;
diff --git a/Source/WebCore/Modules/filesystem/LocalFileSystem.cpp b/Source/WebCore/Modules/filesystem/LocalFileSystem.cpp
index 0eaafae19..664352184 100644
--- a/Source/WebCore/Modules/filesystem/LocalFileSystem.cpp
+++ b/Source/WebCore/Modules/filesystem/LocalFileSystem.cpp
@@ -82,13 +82,13 @@ static void openFileSystem(ScriptExecutionContext*, const String& basePath, cons
     AsyncFileSystem::openFileSystem(basePath, identifier, create, callbacks);
 }
 
-void LocalFileSystem::readFileSystem(ScriptExecutionContext* context, DOMFileSystemBase::Type, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, FileSystemSynchronousMode)
+void LocalFileSystem::readFileSystem(ScriptExecutionContext* context, FileSystemType, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, FileSystemSynchronousType)
 {
     // AsyncFileSystem::openFileSystem calls callbacks synchronously, so the method needs to be called asynchronously.
     context->postTask(createCallbackTask(&openFileSystem, fileSystemBasePath(), context->securityOrigin()->databaseIdentifier(), false, callbacks));
 }
 
-void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, DOMFileSystemBase::Type, long long, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, FileSystemSynchronousType)
+void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, FileSystemType, long long, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, FileSystemSynchronousType)
 {
     // AsyncFileSystem::openFileSystem calls callbacks synchronously, so the method needs to be called asynchronously.
     context->postTask(createCallbackTask(&openFileSystem, fileSystemBasePath(), context->securityOrigin()->databaseIdentifier(), true, callbacks));
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
index 63d484147..5f54e6ad2 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
@@ -41,26 +41,24 @@
 
 namespace WebCore {
 
-IDBIndexBackendImpl::IDBIndexBackendImpl(IDBBackingStore* backingStore, int64_t databaseId, const IDBObjectStoreBackendImpl* objectStoreBackend, int64_t id, const String& name, const String& storeName, const String& keyPath, bool unique, bool multiEntry)
+IDBIndexBackendImpl::IDBIndexBackendImpl(IDBBackingStore* backingStore, int64_t databaseId, IDBObjectStoreBackendImpl* objectStoreBackend, int64_t id, const String& name, const String& keyPath, bool unique, bool multiEntry)
     : m_backingStore(backingStore)
     , m_databaseId(databaseId)
     , m_objectStoreBackend(objectStoreBackend)
     , m_id(id)
     , m_name(name)
-    , m_storeName(storeName)
     , m_keyPath(keyPath)
     , m_unique(unique)
     , m_multiEntry(multiEntry)
 {
 }
 
-IDBIndexBackendImpl::IDBIndexBackendImpl(IDBBackingStore* backingStore, int64_t databaseId, const IDBObjectStoreBackendImpl* objectStoreBackend, const String& name, const String& storeName, const String& keyPath, bool unique, bool multiEntry)
+IDBIndexBackendImpl::IDBIndexBackendImpl(IDBBackingStore* backingStore, int64_t databaseId, IDBObjectStoreBackendImpl* objectStoreBackend, const String& name, const String& keyPath, bool unique, bool multiEntry)
     : m_backingStore(backingStore)
     , m_databaseId(databaseId)
     , m_objectStoreBackend(objectStoreBackend)
     , m_id(InvalidId)
     , m_name(name)
-    , m_storeName(storeName)
     , m_keyPath(keyPath)
     , m_unique(unique)
     , m_multiEntry(multiEntry)
@@ -80,10 +78,10 @@ void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr
 
     switch (cursorType) {
     case IDBCursorBackendInterface::IndexKeyCursor:
-        backingStoreCursor = index->m_backingStore->openIndexKeyCursor(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), range.get(), direction);
+        backingStoreCursor = index->backingStore()->openIndexKeyCursor(index->databaseId(), index->m_objectStoreBackend->id(), index->id(), range.get(), direction);
         break;
     case IDBCursorBackendInterface::IndexCursor:
-        backingStoreCursor = index->m_backingStore->openIndexCursor(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), range.get(), direction);
+        backingStoreCursor = index->backingStore()->openIndexCursor(index->databaseId(), index->m_objectStoreBackend->id(), index->id(), range.get(), direction);
         break;
     case IDBCursorBackendInterface::ObjectStoreCursor:
     case IDBCursorBackendInterface::InvalidCursorType:
@@ -96,11 +94,7 @@ void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr
         return;
     }
 
-    ExceptionCode ec = 0;
-    RefPtr<IDBObjectStoreBackendInterface> objectStore = transaction->objectStore(index->m_storeName, ec);
-    ASSERT(objectStore && !ec);
-
-    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(backingStoreCursor.get(), direction, cursorType, transaction.get(), objectStore.get());
+    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(backingStoreCursor.get(), direction, cursorType, transaction.get(), index->m_objectStoreBackend);
     callbacks->onSuccess(cursor.release());
 }
 
@@ -131,7 +125,7 @@ void IDBIndexBackendImpl::countInternal(ScriptExecutionContext*, PassRefPtr<IDBI
     IDB_TRACE("IDBIndexBackendImpl::countInternal");
     uint32_t count = 0;
 
-    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = index->m_backingStore->openIndexKeyCursor(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), range.get(), IDBCursor::NEXT);
+    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = index->backingStore()->openIndexKeyCursor(index->databaseId(), index->m_objectStoreBackend->id(), index->id(), range.get(), IDBCursor::NEXT);
     if (!backingStoreCursor) {
         callbacks->onSuccess(SerializedScriptValue::numberValue(count));
         return;
@@ -154,7 +148,7 @@ void IDBIndexBackendImpl::count(PassRefPtr<IDBKeyRange> range, PassRefPtr<IDBCal
 void IDBIndexBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
 {
     IDB_TRACE("IDBIndexBackendImpl::getInternal");
-    String value = index->m_backingStore->getObjectViaIndex(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), *key);
+    String value = index->backingStore()->getObjectViaIndex(index->databaseId(), index->m_objectStoreBackend->id(), index->id(), *key);
     if (value.isNull()) {
         callbacks->onSuccess(SerializedScriptValue::undefinedValue());
         return;
@@ -167,14 +161,14 @@ void IDBIndexBackendImpl::getByRangeInternal(ScriptExecutionContext*, PassRefPtr
     IDB_TRACE("IDBIndexBackendImpl::getByRangeInternal");
 
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor =
-            index->m_backingStore->openIndexCursor(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), keyRange.get(), IDBCursor::NEXT);
+            index->backingStore()->openIndexCursor(index->databaseId(), index->m_objectStoreBackend->id(), index->id(), keyRange.get(), IDBCursor::NEXT);
 
     if (!backingStoreCursor) {
         callbacks->onSuccess(SerializedScriptValue::undefinedValue());
         return;
     }
 
-    String value = index->m_backingStore->getObjectViaIndex(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), *backingStoreCursor->key());
+    String value = index->backingStore()->getObjectViaIndex(index->databaseId(), index->m_objectStoreBackend->id(), index->id(), *backingStoreCursor->key());
     if (value.isNull()) {
         callbacks->onSuccess(SerializedScriptValue::undefinedValue());
         backingStoreCursor->close();
@@ -187,7 +181,7 @@ void IDBIndexBackendImpl::getByRangeInternal(ScriptExecutionContext*, PassRefPtr
 void IDBIndexBackendImpl::getKeyInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
 {
     IDB_TRACE("IDBIndexBackendImpl::getKeyInternal");
-    RefPtr<IDBKey> keyResult = index->m_backingStore->getPrimaryKeyViaIndex(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), *key);
+    RefPtr<IDBKey> keyResult = index->backingStore()->getPrimaryKeyViaIndex(index->databaseId(), index->m_objectStoreBackend->id(), index->id(), *key);
     if (!keyResult) {
         callbacks->onSuccess(static_cast<IDBKey*>(0));
         return;
@@ -200,14 +194,14 @@ void IDBIndexBackendImpl::getKeyByRangeInternal(ScriptExecutionContext* context,
     IDB_TRACE("IDBIndexBackendImpl::getByRangeInternal");
 
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor =
-            index->m_backingStore->openIndexKeyCursor(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), keyRange.get(), IDBCursor::NEXT);
+            index->backingStore()->openIndexKeyCursor(index->databaseId(), index->m_objectStoreBackend->id(), index->id(), keyRange.get(), IDBCursor::NEXT);
 
     if (!backingStoreCursor) {
         callbacks->onSuccess(static_cast<IDBKey*>(0));
         return;
     }
 
-    RefPtr<IDBKey> keyResult = index->m_backingStore->getPrimaryKeyViaIndex(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), *backingStoreCursor->key());
+    RefPtr<IDBKey> keyResult = index->backingStore()->getPrimaryKeyViaIndex(index->databaseId(), index->m_objectStoreBackend->id(), index->id(), *backingStoreCursor->key());
     if (!keyResult) {
         callbacks->onSuccess(static_cast<IDBKey*>(0));
         backingStoreCursor->close();
@@ -264,7 +258,7 @@ bool IDBIndexBackendImpl::addingKeyAllowed(const IDBKey* indexKey, const IDBKey*
         return true;
 
     RefPtr<IDBKey> foundPrimaryKey;
-    bool found = m_backingStore->keyExistsInIndex(m_databaseId, m_objectStoreBackend->id(), m_id, *indexKey, foundPrimaryKey);
+    bool found = backingStore()->keyExistsInIndex(databaseId(), m_objectStoreBackend->id(), m_id, *indexKey, foundPrimaryKey);
     if (!found)
         return true;
     if (primaryKey && foundPrimaryKey->isEqual(primaryKey))
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
index e6485b664..95e0f1e01 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
@@ -40,13 +40,13 @@ class ScriptExecutionContext;
 
 class IDBIndexBackendImpl : public IDBIndexBackendInterface {
 public:
-    static PassRefPtr<IDBIndexBackendImpl> create(IDBBackingStore* backingStore, int64_t databaseId, const IDBObjectStoreBackendImpl* objectStoreBackend, int64_t id, const String& name, const String& storeName, const String& keyPath, bool unique, bool multiEntry)
+    static PassRefPtr<IDBIndexBackendImpl> create(IDBBackingStore* backingStore, int64_t databaseId, IDBObjectStoreBackendImpl* objectStoreBackend, int64_t id, const String& name, const String& keyPath, bool unique, bool multiEntry)
     {
-        return adoptRef(new IDBIndexBackendImpl(backingStore, databaseId, objectStoreBackend, id, name, storeName, keyPath, unique, multiEntry));
+        return adoptRef(new IDBIndexBackendImpl(backingStore, databaseId, objectStoreBackend, id, name, keyPath, unique, multiEntry));
     }
-    static PassRefPtr<IDBIndexBackendImpl> create(IDBBackingStore* backingStore, int64_t databaseId, const IDBObjectStoreBackendImpl* objectStoreBackend, const String& name, const String& storeName, const String& keyPath, bool unique, bool multiEntry)
+    static PassRefPtr<IDBIndexBackendImpl> create(IDBBackingStore* backingStore, int64_t databaseId, IDBObjectStoreBackendImpl* objectStoreBackend, const String& name, const String& keyPath, bool unique, bool multiEntry)
     {
-        return adoptRef(new IDBIndexBackendImpl(backingStore, databaseId, objectStoreBackend, name, storeName, keyPath, unique, multiEntry));
+        return adoptRef(new IDBIndexBackendImpl(backingStore, databaseId, objectStoreBackend, name, keyPath, unique, multiEntry));
     }
     virtual ~IDBIndexBackendImpl();
 
@@ -62,7 +62,6 @@ public:
 
     // Implements IDBIndexBackendInterface.
     virtual String name() { return m_name; }
-    virtual String storeName() { return m_storeName; }
     virtual String keyPath() { return m_keyPath; }
     virtual bool unique() { return m_unique; }
     virtual bool multiEntry() { return m_multiEntry; }
@@ -76,8 +75,8 @@ public:
     virtual void getKey(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
 private:
-    IDBIndexBackendImpl(IDBBackingStore*, int64_t databaseId, const IDBObjectStoreBackendImpl*, int64_t id, const String& name, const String& storeName, const String& keyPath, bool unique, bool multiEntry);
-    IDBIndexBackendImpl(IDBBackingStore*, int64_t databaseId, const IDBObjectStoreBackendImpl*, const String& name, const String& storeName, const String& keyPath, bool unique, bool multiEntry);
+    IDBIndexBackendImpl(IDBBackingStore*, int64_t databaseId, IDBObjectStoreBackendImpl*, int64_t id, const String& name, const String& keyPath, bool unique, bool multiEntry);
+    IDBIndexBackendImpl(IDBBackingStore*, int64_t databaseId, IDBObjectStoreBackendImpl*, const String& name, const String& keyPath, bool unique, bool multiEntry);
 
     static void openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKeyRange>, unsigned short direction, IDBCursorBackendInterface::CursorType, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
     static void countInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
@@ -86,15 +85,17 @@ private:
     static void getKeyInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
     static void getKeyByRangeInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>);
 
+    PassRefPtr<IDBBackingStore> backingStore() const { return m_backingStore; }
+    int64_t databaseId() const { return m_databaseId; }
+
     static const int64_t InvalidId = 0;
 
     RefPtr<IDBBackingStore> m_backingStore;
 
     int64_t m_databaseId;
-    const IDBObjectStoreBackendImpl* m_objectStoreBackend;
+    IDBObjectStoreBackendImpl* m_objectStoreBackend;
     int64_t m_id;
     String m_name;
-    String m_storeName;
     String m_keyPath;
     bool m_unique;
     bool m_multiEntry;
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
index 81270ae4a..15ac38646 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
@@ -46,7 +46,6 @@ public:
     virtual ~IDBIndexBackendInterface() { }
 
     virtual String name() = 0;
-    virtual String storeName() = 0;
     virtual String keyPath() = 0;
     virtual bool unique() = 0;
     virtual bool multiEntry() = 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBKey.h b/Source/WebCore/Modules/indexeddb/IDBKey.h
index 17c4eaea5..40ce833f9 100644
--- a/Source/WebCore/Modules/indexeddb/IDBKey.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.h
@@ -98,7 +98,7 @@ public:
     };
 
     Type type() const { return m_type; }
-    bool valid() const { return m_type != InvalidType; }
+    bool isValid() const { return m_type != InvalidType; }
 
     const KeyArray& array() const
     {
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
index 301631497..c35fb488c 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
@@ -78,6 +78,12 @@ IDBTransaction* IDBObjectStore::transaction() const
     return m_transaction.get();
 }
 
+bool IDBObjectStore::autoIncrement() const
+{
+    IDB_TRACE("IDBObjectStore::autoIncrement");
+    return m_backend->autoIncrement();
+}
+
 PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec)
 {
     IDB_TRACE("IDBObjectStore::get");
@@ -177,7 +183,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* co
 PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     IDB_TRACE("IDBObjectStore::delete");
-    if (!key || !key->valid()) {
+    if (!key || !key->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
@@ -231,7 +237,7 @@ PassRefPtr<IDBIndex> IDBObjectStore::createIndex(const String& name, const Strin
 PassRefPtr<IDBIndex> IDBObjectStore::index(const String& name, ExceptionCode& ec)
 {
     IDB_TRACE("IDBObjectStore::index");
-    if (m_transaction->finished()) {
+    if (m_transaction->isFinished()) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return 0;
     }
@@ -324,7 +330,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::count(ScriptExecutionContext* context, Pa
 
 void IDBObjectStore::transactionFinished()
 {
-    ASSERT(m_transaction->finished());
+    ASSERT(m_transaction->isFinished());
 
     // Break reference cycles.
     m_indexMap.clear();
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStore.h b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
index 8dd292d60..c5aaf383c 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
@@ -55,10 +55,12 @@ public:
     }
     ~IDBObjectStore() { }
 
+    // Implement the IDBObjectStore IDL
     String name() const;
     String keyPath() const;
     PassRefPtr<DOMStringList> indexNames() const;
     IDBTransaction* transaction() const;
+    bool autoIncrement() const;
 
     // FIXME: Try to modify the code generator so this is unneeded.
     PassRefPtr<IDBRequest> add(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec) { return add(context, value, 0, ec);  }
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl b/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
index 06642c69b..4cc3345a5 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
@@ -32,6 +32,7 @@ module storage {
         readonly attribute [TreatReturnedNullStringAs=Null] DOMString keyPath;
         readonly attribute DOMStringList indexNames;
         readonly attribute IDBTransaction transaction;
+        readonly attribute boolean autoIncrement;
 
         [CallWith=ScriptExecutionContext] IDBRequest put(in SerializedScriptValue value, in [Optional] IDBKey key)
             raises (IDBDatabaseException);
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
index 7e2b55271..794d65021 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
@@ -108,13 +108,13 @@ void IDBObjectStoreBackendImpl::get(PassRefPtr<IDBKeyRange> prpKeyRange, PassRef
 void IDBObjectStoreBackendImpl::getByRangeInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> keyRange, PassRefPtr<IDBCallbacks> callbacks)
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::getByRangeInternal");
-    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), keyRange.get(), IDBCursor::NEXT);
+    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->backingStore()->openObjectStoreCursor(objectStore->databaseId(), objectStore->id(), keyRange.get(), IDBCursor::NEXT);
     if (!backingStoreCursor) {
         callbacks->onSuccess(SerializedScriptValue::undefinedValue());
         return;
     }
 
-    String wireData = objectStore->m_backingStore->getObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), *backingStoreCursor->key());
+    String wireData = objectStore->backingStore()->getObjectStoreRecord(objectStore->databaseId(), objectStore->id(), *backingStoreCursor->key());
     if (wireData.isNull()) {
         callbacks->onSuccess(SerializedScriptValue::undefinedValue());
         backingStoreCursor->close();
@@ -128,7 +128,7 @@ void IDBObjectStoreBackendImpl::getByRangeInternal(ScriptExecutionContext*, Pass
 void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::getInternal");
-    String wireData = objectStore->m_backingStore->getObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), *key);
+    String wireData = objectStore->backingStore()->getObjectStoreRecord(objectStore->databaseId(), objectStore->id(), *key);
     if (wireData.isNull()) {
         callbacks->onSuccess(SerializedScriptValue::undefinedValue());
         return;
@@ -184,7 +184,7 @@ void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue,
         }
         if (hasKeyPath) {
             RefPtr<IDBKey> keyPathKey = fetchKeyFromKeyPath(value.get(), objectStore->m_keyPath);
-            if (keyPathKey && !keyPathKey->valid()) {
+            if (keyPathKey && !keyPathKey->isValid()) {
                 ec = IDBDatabaseException::DATA_ERR;
                 return;
             }
@@ -201,14 +201,14 @@ void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue,
                 }
             }
         }
-        if (key && !key->valid()) {
+        if (key && !key->isValid()) {
             ec = IDBDatabaseException::DATA_ERR;
             return;
         }
         for (IndexMap::iterator it = m_indexes.begin(); it != m_indexes.end(); ++it) {
             const RefPtr<IDBIndexBackendImpl>& index = it->second;
             RefPtr<IDBKey> indexKey = fetchKeyFromKeyPath(value.get(), index->keyPath());
-            if (indexKey && !indexKey->valid()) {
+            if (indexKey && !indexKey->isValid()) {
                 ec = IDBDatabaseException::DATA_ERR;
                 return;
             }
@@ -255,7 +255,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
         if (autoIncrement) {
             if (!key) {
                 RefPtr<IDBKey> autoIncKey = objectStore->genAutoIncrementKey();
-                if (!autoIncKey->valid()) {
+                if (!autoIncKey->isValid()) {
                     callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "Maximum key generator value reached."));
                     return;
                 }
@@ -279,10 +279,10 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
         }
     }
 
-    ASSERT(key && key->valid());
+    ASSERT(key && key->isValid());
 
-    RefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> recordIdentifier = objectStore->m_backingStore->createInvalidRecordIdentifier();
-    if (putMode == AddOnly && objectStore->m_backingStore->keyExistsInObjectStore(objectStore->m_databaseId, objectStore->id(), *key, recordIdentifier.get())) {
+    RefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> recordIdentifier = objectStore->backingStore()->createInvalidRecordIdentifier();
+    if (putMode == AddOnly && objectStore->backingStore()->keyExistsInObjectStore(objectStore->databaseId(), objectStore->id(), *key, recordIdentifier.get())) {
         objectStore->resetAutoIncrementKeyCache();
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::CONSTRAINT_ERR, "Key already exists in the object store."));
         return;
@@ -297,7 +297,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
             indexKeys.append(indexKey.release());
             continue;
         }
-        ASSERT(indexKey->valid());
+        ASSERT(indexKey->isValid());
 
         if ((!index->multiEntry() || indexKey->type() != IDBKey::ArrayType) && !index->addingKeyAllowed(indexKey.get(), key.get())) {
             objectStore->resetAutoIncrementKeyCache();
@@ -320,7 +320,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
 
     // Before this point, don't do any mutation.  After this point, rollback the transaction in case of error.
 
-    if (!objectStore->m_backingStore->putObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), *key, value->toWireString(), recordIdentifier.get())) {
+    if (!objectStore->backingStore()->putObjectStoreRecord(objectStore->databaseId(), objectStore->id(), *key, value->toWireString(), recordIdentifier.get())) {
         // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
         transaction->abort();
@@ -333,7 +333,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
         if (!index->hasValidId())
             continue; // The index object has been created, but does not exist in the database yet.
 
-        if (!objectStore->m_backingStore->deleteIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), index->id(), recordIdentifier.get())) {
+        if (!objectStore->backingStore()->deleteIndexDataForRecord(objectStore->databaseId(), objectStore->id(), index->id(), recordIdentifier.get())) {
             // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
             transaction->abort();
@@ -345,7 +345,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
         RefPtr<IDBKey> indexKey = indexKeys[i];
 
         if (!index->multiEntry() || indexKey->type() != IDBKey::ArrayType) {
-            if (!objectStore->m_backingStore->putIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), index->id(), *indexKey, recordIdentifier.get())) {
+            if (!objectStore->backingStore()->putIndexDataForRecord(objectStore->databaseId(), objectStore->id(), index->id(), *indexKey, recordIdentifier.get())) {
                 // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
                 callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
                 transaction->abort();
@@ -355,7 +355,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
             ASSERT(index->multiEntry());
             ASSERT(indexKey->type() == IDBKey::ArrayType);
             for (size_t j = 0; j < indexKey->array().size(); ++j) {
-                if (!objectStore->m_backingStore->putIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), index->id(), *indexKey->array()[j], recordIdentifier.get())) {
+                if (!objectStore->backingStore()->putIndexDataForRecord(objectStore->databaseId(), objectStore->id(), index->id(), *indexKey->array()[j], recordIdentifier.get())) {
                     // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
                     callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
                     transaction->abort();
@@ -372,7 +372,7 @@ void IDBObjectStoreBackendImpl::deleteFunction(PassRefPtr<IDBKey> prpKey, PassRe
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::delete");
     RefPtr<IDBKey> key = prpKey;
-    if (!key || !key->valid()) {
+    if (!key || !key->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return;
     }
@@ -405,7 +405,7 @@ void IDBObjectStoreBackendImpl::deleteInternal(ScriptExecutionContext*, PassRefP
     IDB_TRACE("IDBObjectStoreBackendImpl::deleteInternal");
     RefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> recordIdentifier;
 
-    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), keyRange.get(), IDBCursor::NEXT);
+    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->backingStore()->openObjectStoreCursor(objectStore->databaseId(), objectStore->id(), keyRange.get(), IDBCursor::NEXT);
     if (backingStoreCursor) {
 
         do {
@@ -415,11 +415,11 @@ void IDBObjectStoreBackendImpl::deleteInternal(ScriptExecutionContext*, PassRefP
                 if (!it->second->hasValidId())
                     continue; // The index object has been created, but does not exist in the database yet.
 
-                bool success = objectStore->m_backingStore->deleteIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), it->second->id(), recordIdentifier.get());
+                bool success = objectStore->backingStore()->deleteIndexDataForRecord(objectStore->databaseId(), objectStore->id(), it->second->id(), recordIdentifier.get());
                 ASSERT_UNUSED(success, success);
             }
 
-            objectStore->m_backingStore->deleteObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), recordIdentifier.get());
+            objectStore->backingStore()->deleteObjectStoreRecord(objectStore->databaseId(), objectStore->id(), recordIdentifier.get());
 
         } while (backingStoreCursor->continueFunction(0));
 
@@ -446,7 +446,7 @@ void IDBObjectStoreBackendImpl::clear(PassRefPtr<IDBCallbacks> prpCallbacks, IDB
 
 void IDBObjectStoreBackendImpl::clearInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBCallbacks> callbacks)
 {
-    objectStore->m_backingStore->clearObjectStore(objectStore->m_databaseId, objectStore->id());
+    objectStore->backingStore()->clearObjectStore(objectStore->databaseId(), objectStore->id());
     callbacks->onSuccess(SerializedScriptValue::undefinedValue());
 }
 
@@ -518,7 +518,7 @@ PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::createIndex(cons
         return 0;
     }
 
-    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(m_backingStore.get(), m_databaseId, this, name, m_name, keyPath, unique, multiEntry);
+    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(backingStore().get(), databaseId(), this, name, keyPath, unique, multiEntry);
     ASSERT(index->name() == name);
 
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
@@ -539,14 +539,14 @@ PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::createIndex(cons
 void IDBObjectStoreBackendImpl::createIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
     int64_t id;
-    if (!objectStore->m_backingStore->createIndex(objectStore->m_databaseId, objectStore->id(), index->name(), index->keyPath(), index->unique(), index->multiEntry(), id)) {
+    if (!objectStore->backingStore()->createIndex(objectStore->databaseId(), objectStore->id(), index->name(), index->keyPath(), index->unique(), index->multiEntry(), id)) {
         transaction->abort();
         return;
     }
 
     index->setId(id);
 
-    if (!populateIndex(*objectStore->m_backingStore, objectStore->m_databaseId, objectStore->m_id, index)) {
+    if (!populateIndex(*objectStore->backingStore(), objectStore->databaseId(), objectStore->m_id, index)) {
         transaction->abort();
         return;
     }
@@ -592,7 +592,7 @@ void IDBObjectStoreBackendImpl::deleteIndex(const String& name, IDBTransactionBa
 
 void IDBObjectStoreBackendImpl::deleteIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
-    objectStore->m_backingStore->deleteIndex(objectStore->m_databaseId, objectStore->id(), index->id());
+    objectStore->backingStore()->deleteIndex(objectStore->databaseId(), objectStore->id(), index->id());
     transaction->didCompleteTaskEvents();
 }
 
@@ -615,7 +615,7 @@ void IDBObjectStoreBackendImpl::openCursorInternal(ScriptExecutionContext*, Pass
     IDB_TRACE("IDBObjectStoreBackendImpl::openCursorInternal");
     IDBCursor::Direction direction = static_cast<IDBCursor::Direction>(tmpDirection);
 
-    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), range.get(), direction);
+    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->backingStore()->openObjectStoreCursor(objectStore->databaseId(), objectStore->id(), range.get(), direction);
     if (!backingStoreCursor) {
         callbacks->onSuccess(SerializedScriptValue::nullValue());
         return;
@@ -636,7 +636,7 @@ void IDBObjectStoreBackendImpl::countInternal(ScriptExecutionContext*, PassRefPt
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::countInternal");
     uint32_t count = 0;
-    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), range.get(), IDBCursor::NEXT);
+    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->backingStore()->openObjectStoreCursor(objectStore->databaseId(), objectStore->id(), range.get(), IDBCursor::NEXT);
     if (!backingStoreCursor) {
         callbacks->onSuccess(SerializedScriptValue::numberValue(count));
         return;
@@ -657,7 +657,7 @@ void IDBObjectStoreBackendImpl::loadIndexes()
     Vector<String> keyPaths;
     Vector<bool> uniqueFlags;
     Vector<bool> multiEntryFlags;
-    m_backingStore->getIndexes(m_databaseId, m_id, ids, names, keyPaths, uniqueFlags, multiEntryFlags);
+    backingStore()->getIndexes(databaseId(), m_id, ids, names, keyPaths, uniqueFlags, multiEntryFlags);
 
     ASSERT(names.size() == ids.size());
     ASSERT(keyPaths.size() == ids.size());
@@ -665,7 +665,7 @@ void IDBObjectStoreBackendImpl::loadIndexes()
     ASSERT(multiEntryFlags.size() == ids.size());
 
     for (size_t i = 0; i < ids.size(); i++)
-        m_indexes.set(names[i], IDBIndexBackendImpl::create(m_backingStore.get(), m_databaseId, this, ids[i], names[i], m_name, keyPaths[i], uniqueFlags[i], multiEntryFlags[i]));
+        m_indexes.set(names[i], IDBIndexBackendImpl::create(backingStore().get(), databaseId(), this, ids[i], names[i], keyPaths[i], uniqueFlags[i], multiEntryFlags[i]));
 }
 
 void IDBObjectStoreBackendImpl::removeIndexFromMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index)
@@ -689,7 +689,7 @@ PassRefPtr<IDBKey> IDBObjectStoreBackendImpl::genAutoIncrementKey()
     if (m_autoIncrementNumber > 0)
         return IDBKey::createNumber(m_autoIncrementNumber++);
 
-    m_autoIncrementNumber = m_backingStore->nextAutoIncrementNumber(m_databaseId, id());
+    m_autoIncrementNumber = backingStore()->nextAutoIncrementNumber(databaseId(), id());
     if (m_autoIncrementNumber > kMaxGeneratorValue)
         return IDBKey::createInvalid();
     return IDBKey::createNumber(m_autoIncrementNumber++);
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
index 6e0c5e8fd..3ebc77cf8 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
@@ -59,7 +59,6 @@ public:
         return m_id;
     }
     void setId(int64_t id) { m_id = id; }
-    int64_t databaseId() const { return m_databaseId; }
 
     virtual String name() const { return m_name; }
     virtual String keyPath() const { return m_keyPath; }
@@ -105,6 +104,9 @@ private:
     static void addIndexToMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>);
     static void revertAutoIncrementKeyCache(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>);
 
+    PassRefPtr<IDBBackingStore> backingStore() const { return m_backingStore; }
+    int64_t databaseId() const { return m_databaseId; }
+
     RefPtr<IDBBackingStore> m_backingStore;
 
     int64_t m_databaseId;
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
index ae64a5ef6..bd09fc2ef 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
@@ -50,6 +50,7 @@ public:
     virtual String name() const = 0;
     virtual String keyPath() const = 0;
     virtual PassRefPtr<DOMStringList> indexNames() const = 0;
+    virtual bool autoIncrement() const = 0;
 
     virtual void get(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
index 37e8b0d4d..589042ec0 100644
--- a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
@@ -251,7 +251,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
     IDB_TRACE("IDBRequest::onSuccess(IDBKey)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
-    if (idbKey && idbKey->valid())
+    if (idbKey && idbKey->isValid())
         m_result = IDBAny::create(idbKey);
     else
         m_result = IDBAny::create(SerializedScriptValue::undefinedValue());
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
index 6388d088e..e9d3b97f5 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
@@ -100,7 +100,7 @@ IDBTransactionBackendInterface* IDBTransaction::backend() const
     return m_backend.get();
 }
 
-bool IDBTransaction::finished() const
+bool IDBTransaction::isFinished() const
 {
     return m_transactionFinished;
 }
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.h b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
index b8038e5c1..641f62b81 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
@@ -66,7 +66,7 @@ public:
     static const AtomicString& modeToString(unsigned short, ExceptionCode&);
 
     IDBTransactionBackendInterface* backend() const;
-    bool finished() const;
+    bool isFinished() const;
 
     const String& mode() const;
     IDBDatabase* db() const;
diff --git a/Source/WebCore/Modules/intents/DOMWindowIntents.cpp b/Source/WebCore/Modules/intents/DOMWindowIntents.cpp
new file mode 100644
index 000000000..b89fefe2a
--- /dev/null
+++ b/Source/WebCore/Modules/intents/DOMWindowIntents.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMWindowIntents.h"
+
+#if ENABLE(WEB_INTENTS)
+
+#include "DOMWindow.h"
+#include "DeliveredIntent.h"
+
+namespace WebCore {
+
+DOMWindowIntents::DOMWindowIntents(DOMWindow* window)
+    : DOMWindowProperty(window->frame())
+{
+}
+
+DOMWindowIntents::~DOMWindowIntents()
+{
+}
+
+DOMWindowIntents* DOMWindowIntents::from(DOMWindow* window)
+{
+    ASSERT(window);
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("DOMWindowIntents"));
+    DOMWindowIntents* supplement = static_cast<DOMWindowIntents*>(Supplement<DOMWindow>::from(window, name));
+    if (!supplement) {
+        supplement = new DOMWindowIntents(window);
+        provideTo(window, name, adoptPtr(supplement));
+    }
+    return supplement;
+}
+
+DeliveredIntent* DOMWindowIntents::webkitIntent(DOMWindow* window)
+{
+    return from(window)->webkitIntent();
+}
+
+DeliveredIntent* DOMWindowIntents::webkitIntent()
+{
+    return m_intent.get();
+}
+
+void DOMWindowIntents::deliver(PassRefPtr<DeliveredIntent> intent)
+{
+    if (!frame())
+        return;
+
+    m_intent = intent;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_INTENTS)
diff --git a/Source/WebCore/dom/TreeScopeAdjuster.h b/Source/WebCore/Modules/intents/DOMWindowIntents.h
index 4fad69fa5..9f5be8bf8 100644
--- a/Source/WebCore/dom/TreeScopeAdjuster.h
+++ b/Source/WebCore/Modules/intents/DOMWindowIntents.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2012 Google Inc. All Rights Reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,10 +11,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,31 +24,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef TreeScopeAdjuster_h
-#define TreeScopeAdjuster_h
+#ifndef DOMWindowIntents_h
+#define DOMWindowIntents_h
 
-#include "Position.h"
+#if ENABLE(WEB_INTENTS)
+
+#include "DOMWindowProperty.h"
+#include "Supplementable.h"
 
 namespace WebCore {
 
-class Node;
-class TreeScope;
+class DOMWindow;
+class DeliveredIntent;
 
-class TreeScopeAdjuster {
+class DOMWindowIntents : public DOMWindowProperty, public Supplement<DOMWindow> {
 public:
-    explicit TreeScopeAdjuster(TreeScope*);
-
-    inline TreeScope* treeScope() const { return m_treeScope; }
+    virtual ~DOMWindowIntents();
+    static DOMWindowIntents* from(DOMWindow*);
 
-    Node* ancestorInThisScope(Node*);
+    static DeliveredIntent* webkitIntent(DOMWindow*);
 
-    Position adjustPositionBefore(const Position&);
-    Position adjustPositionAfter(const Position&);
+    void deliver(PassRefPtr<DeliveredIntent>);
 
 private:
-    TreeScope* m_treeScope;
+    explicit DOMWindowIntents(DOMWindow*);
+
+    DeliveredIntent* webkitIntent();
+
+    RefPtr<DeliveredIntent> m_intent;
 };
 
 } // namespace WebCore
 
-#endif // TreeScopeAdjuster_h
+#endif // ENABLE(WEB_INTENTS)
+
+#endif // DOMWindowIntents_h
diff --git a/Source/WebCore/Modules/intents/DOMWindowIntents.idl b/Source/WebCore/Modules/intents/DOMWindowIntents.idl
index f990800c1..451aadf01 100644
--- a/Source/WebCore/Modules/intents/DOMWindowIntents.idl
+++ b/Source/WebCore/Modules/intents/DOMWindowIntents.idl
@@ -31,6 +31,8 @@ module window {
         Supplemental=DOMWindow
     ] DOMWindowIntents {
         attribute IntentConstructor WebKitIntent;
+
+        readonly attribute [Replaceable] DeliveredIntent webkitIntent;
     };
 
 }
diff --git a/Source/WebCore/Modules/intents/DeliveredIntent.cpp b/Source/WebCore/Modules/intents/DeliveredIntent.cpp
new file mode 100644
index 000000000..731c2e06b
--- /dev/null
+++ b/Source/WebCore/Modules/intents/DeliveredIntent.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Google, Inc. ("Google") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DeliveredIntent.h"
+
+#if ENABLE(WEB_INTENTS)
+
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "SerializedScriptValue.h"
+
+namespace WebCore {
+
+PassRefPtr<DeliveredIntent> DeliveredIntent::create(Frame* frame, PassOwnPtr<DeliveredIntentClient> client, const String& action, const String& type,
+                                                    PassRefPtr<SerializedScriptValue> data, PassOwnPtr<MessagePortArray> ports,
+                                                    const HashMap<String, String>& extras)
+{
+    return adoptRef(new DeliveredIntent(frame, client, action, type, data, ports, extras));
+}
+
+DeliveredIntent::DeliveredIntent(Frame* frame, PassOwnPtr<DeliveredIntentClient> client, const String& action, const String& type,
+                                 PassRefPtr<SerializedScriptValue> data, PassOwnPtr<MessagePortArray> ports,
+                                 const HashMap<String, String>& extras)
+    : Intent(action, type, data, PassOwnPtr<MessagePortChannelArray>(), extras, KURL())
+    , FrameDestructionObserver(frame)
+    , m_client(client)
+    , m_ports(ports)
+{
+}
+
+void DeliveredIntent::frameDestroyed()
+{
+    FrameDestructionObserver::frameDestroyed();
+    m_client.clear();
+}
+
+MessagePortArray* DeliveredIntent::ports() const
+{
+    return m_ports.get();
+}
+
+String DeliveredIntent::getExtra(const String& key)
+{
+    return extras().get(key);
+}
+
+void DeliveredIntent::postResult(PassRefPtr<SerializedScriptValue> data)
+{
+    if (!m_client)
+        return;
+
+    m_client->postResult(data);
+}
+
+void DeliveredIntent::postFailure(PassRefPtr<SerializedScriptValue> data)
+{
+    if (!m_client)
+        return;
+
+    m_client->postFailure(data);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_INTENTS)
diff --git a/Source/WebCore/Modules/intents/DeliveredIntent.h b/Source/WebCore/Modules/intents/DeliveredIntent.h
new file mode 100644
index 000000000..23a962a6a
--- /dev/null
+++ b/Source/WebCore/Modules/intents/DeliveredIntent.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Google, Inc. ("Google") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DeliveredIntent_h
+#define DeliveredIntent_h
+
+#if ENABLE(WEB_INTENTS)
+
+#include "FrameDestructionObserver.h"
+#include "Intent.h"
+#include "MessagePort.h"
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Frame;
+class SerializedScriptValue;
+
+// JS calls to postResult/postFailure on DeliveredIntent will be forwarded 
+// to this client interface. The object is owned by the DeliveredIntent to
+// which it is attached, and will be deleted when the delivered intent will issue
+// no further calls to it. Before that point, the destroy() method is invoked.
+class DeliveredIntentClient {
+public:
+    virtual ~DeliveredIntentClient() { }
+
+    virtual void postResult(PassRefPtr<SerializedScriptValue> data) = 0;
+    virtual void postFailure(PassRefPtr<SerializedScriptValue> data) = 0;
+};
+
+class DeliveredIntent : public Intent, public FrameDestructionObserver {
+public:
+    static PassRefPtr<DeliveredIntent> create(Frame*, PassOwnPtr<DeliveredIntentClient>, const String& action, const String& type,
+                                              PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortArray>,
+                                              const HashMap<String, String>&);
+
+    virtual ~DeliveredIntent() { }
+
+    MessagePortArray* ports() const;
+    String getExtra(const String& key);
+    void postResult(PassRefPtr<SerializedScriptValue> data);
+    void postFailure(PassRefPtr<SerializedScriptValue> data);
+
+    void setClient(PassRefPtr<DeliveredIntentClient>);
+
+    virtual void frameDestroyed() OVERRIDE;
+
+private:
+    DeliveredIntent(Frame*, PassOwnPtr<DeliveredIntentClient>, const String& action, const String& type,
+                    PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortArray>,
+                    const HashMap<String, String>&);
+
+    OwnPtr<DeliveredIntentClient> m_client;
+    OwnPtr<MessagePortArray> m_ports;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // Intent_h
diff --git a/Source/WebCore/Modules/intents/DeliveredIntent.idl b/Source/WebCore/Modules/intents/DeliveredIntent.idl
new file mode 100644
index 000000000..25e978deb
--- /dev/null
+++ b/Source/WebCore/Modules/intents/DeliveredIntent.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+    interface [
+        Conditional=WEB_INTENTS,
+    ] DeliveredIntent : Intent {
+        readonly attribute MessagePortArray ports;
+
+        [TreatReturnedNullStringAs=Null] DOMString getExtra(in DOMString key);
+        void postResult(in SerializedScriptValue result);
+        void postFailure(in SerializedScriptValue result);
+    };
+}
diff --git a/Source/WebCore/Modules/intents/Intent.cpp b/Source/WebCore/Modules/intents/Intent.cpp
index bfeba65e3..bf9565ef1 100644
--- a/Source/WebCore/Modules/intents/Intent.cpp
+++ b/Source/WebCore/Modules/intents/Intent.cpp
@@ -33,7 +33,6 @@
 
 #include "ExceptionCode.h"
 #include "MessagePort.h"
-#include "ScriptState.h"
 #include "SerializedScriptValue.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/Modules/intents/Intent.h b/Source/WebCore/Modules/intents/Intent.h
index 450909652..d62c6bf6f 100644
--- a/Source/WebCore/Modules/intents/Intent.h
+++ b/Source/WebCore/Modules/intents/Intent.h
@@ -35,6 +35,7 @@
 #include "KURL.h"
 #include "MessagePort.h"
 #include "MessagePortChannel.h"
+#include "ScriptState.h"
 #include <wtf/Forward.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -43,7 +44,6 @@
 
 namespace WebCore {
 
-class ScriptState;
 class SerializedScriptValue;
 
 typedef int ExceptionCode;
@@ -53,6 +53,8 @@ public:
     static PassRefPtr<Intent> create(const String& action, const String& type, PassRefPtr<SerializedScriptValue> data, const MessagePortArray& ports, ExceptionCode&);
     static PassRefPtr<Intent> create(ScriptState*, const Dictionary&, ExceptionCode&);
 
+    virtual ~Intent() { }
+
     const String& action() const { return m_action; }
     const String& type() const { return m_type; }
     SerializedScriptValue* data() const { return m_data.get(); }
@@ -67,7 +69,6 @@ protected:
            const WTF::HashMap<String, String>& extras, const KURL& service);
 
 private:
-
     String m_action;
     String m_type;
     RefPtr<SerializedScriptValue> m_data;
diff --git a/Source/WebCore/Modules/mediastream/LocalMediaStream.idl b/Source/WebCore/Modules/mediastream/LocalMediaStream.idl
index e9944cf4c..5e769aff8 100644
--- a/Source/WebCore/Modules/mediastream/LocalMediaStream.idl
+++ b/Source/WebCore/Modules/mediastream/LocalMediaStream.idl
@@ -26,6 +26,7 @@ module core {
 
     interface [
         Conditional=MEDIA_STREAM,
+        EventTarget,
         JSGenerateToNativeObject,
         JSGenerateToJSObject
     ] LocalMediaStream : MediaStream {
diff --git a/Source/WebCore/Modules/mediastream/UserMediaRequest.cpp b/Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
index 63d02e29f..6c5faf4fe 100644
--- a/Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
+++ b/Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
@@ -111,6 +111,8 @@ void UserMediaRequest::fail()
 
 void UserMediaRequest::contextDestroyed()
 {
+    RefPtr<UserMediaRequest> protect(this);
+
     if (m_controller) {
         m_controller->cancelUserMediaRequest(this);
         m_controller = 0;
diff --git a/Source/WebCore/Modules/networkinfo/NetworkInfoClient.h b/Source/WebCore/Modules/networkinfo/NetworkInfoClient.h
index 729118ec1..a35d1452b 100644
--- a/Source/WebCore/Modules/networkinfo/NetworkInfoClient.h
+++ b/Source/WebCore/Modules/networkinfo/NetworkInfoClient.h
@@ -36,7 +36,7 @@ namespace WebCore {
 class NetworkInfoController;
 class Page;
 
-class NetworkInfoClient : public RefCounted<NetworkInfoClient> {
+class NetworkInfoClient {
 public:
     virtual ~NetworkInfoClient() { }
 
diff --git a/Source/WebCore/Modules/webaudio/AudioContext.cpp b/Source/WebCore/Modules/webaudio/AudioContext.cpp
index f743b11a3..ea2d579eb 100644
--- a/Source/WebCore/Modules/webaudio/AudioContext.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioContext.cpp
@@ -673,8 +673,8 @@ void AudioContext::handlePreRenderTasks()
     // It's OK if the tryLock() fails, we'll just take slightly longer to pick up the changes.
     bool mustReleaseLock;
     if (tryLock(mustReleaseLock)) {
-        // Fixup the state of any dirty AudioNodeInputs and AudioNodeOutputs.
-        handleDirtyAudioNodeInputs();
+        // Fixup the state of any dirty AudioSummingJunctions and AudioNodeOutputs.
+        handleDirtyAudioSummingJunctions();
         handleDirtyAudioNodeOutputs();
 
         updateAutomaticPullNodes();
@@ -703,8 +703,8 @@ void AudioContext::handlePostRenderTasks()
         // Ref-counted objects held by certain AudioNodes may not be thread-safe.
         scheduleNodeDeletion();
 
-        // Fixup the state of any dirty AudioNodeInputs and AudioNodeOutputs.
-        handleDirtyAudioNodeInputs();
+        // Fixup the state of any dirty AudioSummingJunctions and AudioNodeOutputs.
+        handleDirtyAudioSummingJunctions();
         handleDirtyAudioNodeOutputs();
 
         updateAutomaticPullNodes();
@@ -778,10 +778,10 @@ void AudioContext::deleteMarkedNodes()
         AudioNode* node = m_nodesToDelete[n - 1];
         m_nodesToDelete.removeLast();
 
-        // Before deleting the node, clear out any AudioNodeInputs from m_dirtyAudioNodeInputs.
+        // Before deleting the node, clear out any AudioNodeInputs from m_dirtySummingJunctions.
         unsigned numberOfInputs = node->numberOfInputs();
         for (unsigned i = 0; i < numberOfInputs; ++i)
-            m_dirtyAudioNodeInputs.remove(node->input(i));
+            m_dirtySummingJunctions.remove(node->input(i));
 
         // Before deleting the node, clear out any AudioNodeOutputs from m_dirtyAudioNodeOutputs.
         unsigned numberOfOutputs = node->numberOfOutputs();
@@ -795,10 +795,17 @@ void AudioContext::deleteMarkedNodes()
     m_isDeletionScheduled = false;
 }
 
-void AudioContext::markAudioNodeInputDirty(AudioNodeInput* input)
+void AudioContext::markSummingJunctionDirty(AudioSummingJunction* summingJunction)
 {
     ASSERT(isGraphOwner());    
-    m_dirtyAudioNodeInputs.add(input);
+    m_dirtySummingJunctions.add(summingJunction);
+}
+
+void AudioContext::removeMarkedSummingJunction(AudioSummingJunction* summingJunction)
+{
+    ASSERT(isMainThread());
+    AutoLocker locker(this);
+    m_dirtySummingJunctions.remove(summingJunction);
 }
 
 void AudioContext::markAudioNodeOutputDirty(AudioNodeOutput* output)
@@ -807,14 +814,14 @@ void AudioContext::markAudioNodeOutputDirty(AudioNodeOutput* output)
     m_dirtyAudioNodeOutputs.add(output);
 }
 
-void AudioContext::handleDirtyAudioNodeInputs()
+void AudioContext::handleDirtyAudioSummingJunctions()
 {
     ASSERT(isGraphOwner());    
 
-    for (HashSet<AudioNodeInput*>::iterator i = m_dirtyAudioNodeInputs.begin(); i != m_dirtyAudioNodeInputs.end(); ++i)
+    for (HashSet<AudioSummingJunction*>::iterator i = m_dirtySummingJunctions.begin(); i != m_dirtySummingJunctions.end(); ++i)
         (*i)->updateRenderingState();
 
-    m_dirtyAudioNodeInputs.clear();
+    m_dirtySummingJunctions.clear();
 }
 
 void AudioContext::handleDirtyAudioNodeOutputs()
diff --git a/Source/WebCore/Modules/webaudio/AudioContext.h b/Source/WebCore/Modules/webaudio/AudioContext.h
index edb87e7e4..1b742f7d1 100644
--- a/Source/WebCore/Modules/webaudio/AudioContext.h
+++ b/Source/WebCore/Modules/webaudio/AudioContext.h
@@ -55,6 +55,7 @@ class AudioChannelSplitter;
 class AudioGainNode;
 class AudioPannerNode;
 class AudioListener;
+class AudioSummingJunction;
 class BiquadFilterNode;
 class DelayNode;
 class Document;
@@ -218,9 +219,12 @@ public:
     void handleDeferredFinishDerefs();
 
     // Only accessed when the graph lock is held.
-    void markAudioNodeInputDirty(AudioNodeInput*);
+    void markSummingJunctionDirty(AudioSummingJunction*);
     void markAudioNodeOutputDirty(AudioNodeOutput*);
 
+    // Must be called on main thread.
+    void removeMarkedSummingJunction(AudioSummingJunction*);
+
     // EventTarget
     virtual const AtomicString& interfaceName() const;
     virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -284,9 +288,9 @@ private:
     bool m_isDeletionScheduled;
 
     // Only accessed when the graph lock is held.
-    HashSet<AudioNodeInput*> m_dirtyAudioNodeInputs;
+    HashSet<AudioSummingJunction*> m_dirtySummingJunctions;
     HashSet<AudioNodeOutput*> m_dirtyAudioNodeOutputs;
-    void handleDirtyAudioNodeInputs();
+    void handleDirtyAudioSummingJunctions();
     void handleDirtyAudioNodeOutputs();
 
     // For the sake of thread safety, we maintain a seperate Vector of automatic pull nodes for rendering in m_renderingAutomaticPullNodes.
diff --git a/Source/WebCore/Modules/webaudio/AudioNode.cpp b/Source/WebCore/Modules/webaudio/AudioNode.cpp
index 8af9fc734..09438f5e2 100644
--- a/Source/WebCore/Modules/webaudio/AudioNode.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioNode.cpp
@@ -47,7 +47,6 @@ AudioNode::AudioNode(AudioContext* context, float sampleRate)
     , m_lastNonSilentTime(-1)
     , m_normalRefCount(1) // start out with normal refCount == 1 (like WTF::RefCounted class)
     , m_connectionRefCount(0)
-    , m_disabledRefCount(0)
     , m_isMarkedForDeletion(false)
     , m_isDisabled(false)
 {
@@ -63,7 +62,7 @@ AudioNode::~AudioNode()
 {
 #if DEBUG_AUDIONODE_REFERENCES
     --s_nodeCount[nodeType()];
-    printf("%p: %d: AudioNode::~AudioNode() %d %d %d\n", this, nodeType(), m_normalRefCount, m_connectionRefCount, m_disabledRefCount);
+    printf("%p: %d: AudioNode::~AudioNode() %d %d\n", this, nodeType(), m_normalRefCount, m_connectionRefCount);
 #endif
 }
 
@@ -265,6 +264,44 @@ void AudioNode::unsilenceOutputs()
         output(i)->bus()->clearSilentFlag();
 }
 
+void AudioNode::enableOutputsIfNecessary()
+{
+    if (m_isDisabled && m_connectionRefCount > 0) {
+        ASSERT(isMainThread());
+        AudioContext::AutoLocker locker(context());
+
+        m_isDisabled = false;
+        for (unsigned i = 0; i < m_outputs.size(); ++i)
+            output(i)->enable();
+    }
+}
+
+void AudioNode::disableOutputsIfNecessary()
+{
+    // Disable outputs if appropriate. We do this if the number of connections is 0 or 1. The case
+    // of 0 is from finishDeref() where there are no connections left. The case of 1 is from
+    // AudioNodeInput::disable() where we want to disable outputs when there's only one connection
+    // left because we're ready to go away, but can't quite yet.
+    if (m_connectionRefCount <= 1 && !m_isDisabled) {
+        // Still may have JavaScript references, but no more "active" connection references, so put all of our outputs in a "dormant" disabled state.
+        // Garbage collection may take a very long time after this time, so the "dormant" disabled nodes should not bog down the rendering...
+
+        // As far as JavaScript is concerned, our outputs must still appear to be connected.
+        // But internally our outputs should be disabled from the inputs they're connected to.
+        // disable() can recursively deref connections (and call disable()) down a whole chain of connected nodes.
+
+        // FIXME: we special case the convolver and delay since they have a significant tail-time and shouldn't be disconnected simply
+        // because they no longer have any input connections. This needs to be handled more generally where AudioNodes have
+        // a tailTime attribute. Then the AudioNode only needs to remain "active" for tailTime seconds after there are no
+        // longer any active connections.
+        if (nodeType() != NodeTypeConvolver && nodeType() != NodeTypeDelay) {
+            m_isDisabled = true;
+            for (unsigned i = 0; i < m_outputs.size(); ++i)
+                output(i)->disable();
+        }
+    }
+}
+
 void AudioNode::ref(RefType refType)
 {
     switch (refType) {
@@ -274,28 +311,19 @@ void AudioNode::ref(RefType refType)
     case RefTypeConnection:
         atomicIncrement(&m_connectionRefCount);
         break;
-    case RefTypeDisabled:
-        atomicIncrement(&m_disabledRefCount);
-        break;
     default:
         ASSERT_NOT_REACHED();
     }
 
 #if DEBUG_AUDIONODE_REFERENCES
-    printf("%p: %d: AudioNode::ref(%d) %d %d %d\n", this, nodeType(), refType, m_normalRefCount, m_connectionRefCount, m_disabledRefCount);
+    printf("%p: %d: AudioNode::ref(%d) %d %d\n", this, nodeType(), refType, m_normalRefCount, m_connectionRefCount);
 #endif
 
     // See the disabling code in finishDeref() below. This handles the case where a node
     // is being re-connected after being used at least once and disconnected.
     // In this case, we need to re-enable.
-    if (m_isDisabled && m_connectionRefCount > 0 && refType == RefTypeConnection) {
-        ASSERT(isMainThread());
-        AudioContext::AutoLocker locker(context());
-
-        m_isDisabled = false;
-        for (unsigned i = 0; i < m_outputs.size(); ++i)
-            output(i)->enable();
-    }
+    if (refType == RefTypeConnection)
+        enableOutputsIfNecessary();
 }
 
 void AudioNode::deref(RefType refType)
@@ -345,20 +373,16 @@ void AudioNode::finishDeref(RefType refType)
         ASSERT(m_connectionRefCount > 0);
         atomicDecrement(&m_connectionRefCount);
         break;
-    case RefTypeDisabled:
-        ASSERT(m_disabledRefCount > 0);
-        atomicDecrement(&m_disabledRefCount);
-        break;
     default:
         ASSERT_NOT_REACHED();
     }
     
 #if DEBUG_AUDIONODE_REFERENCES
-    printf("%p: %d: AudioNode::deref(%d) %d %d %d\n", this, nodeType(), refType, m_normalRefCount, m_connectionRefCount, m_disabledRefCount);
+    printf("%p: %d: AudioNode::deref(%d) %d %d\n", this, nodeType(), refType, m_normalRefCount, m_connectionRefCount);
 #endif
 
     if (!m_connectionRefCount) {
-        if (!m_normalRefCount && !m_disabledRefCount) {
+        if (!m_normalRefCount) {
             if (!m_isMarkedForDeletion) {
                 // All references are gone - we need to go away.
                 for (unsigned i = 0; i < m_outputs.size(); ++i)
@@ -368,26 +392,8 @@ void AudioNode::finishDeref(RefType refType)
                 context()->markForDeletion(this);
                 m_isMarkedForDeletion = true;
             }
-        } else if (refType == RefTypeConnection) {
-            if (!m_isDisabled) {
-                // Still may have JavaScript references, but no more "active" connection references, so put all of our outputs in a "dormant" disabled state.
-                // Garbage collection may take a very long time after this time, so the "dormant" disabled nodes should not bog down the rendering...
-
-                // As far as JavaScript is concerned, our outputs must still appear to be connected.
-                // But internally our outputs should be disabled from the inputs they're connected to.
-                // disable() can recursively deref connections (and call disable()) down a whole chain of connected nodes.
-
-                // FIXME: we special case the convolver and delay since they have a significant tail-time and shouldn't be disconnected simply
-                // because they no longer have any input connections.  This needs to be handled more generally where AudioNodes have
-                // a tailTime attribute.  Then the AudioNode only needs to remain "active" for tailTime seconds after there are no
-                // longer any active connections.
-                if (nodeType() != NodeTypeConvolver && nodeType() != NodeTypeDelay) {
-                    m_isDisabled = true;
-                    for (unsigned i = 0; i < m_outputs.size(); ++i)
-                        output(i)->disable();
-                }
-            }
-        }
+        } else if (refType == RefTypeConnection)
+            disableOutputsIfNecessary();
     }
 }
 
diff --git a/Source/WebCore/Modules/webaudio/AudioNode.h b/Source/WebCore/Modules/webaudio/AudioNode.h
index 64c5f262e..bee78f7e8 100644
--- a/Source/WebCore/Modules/webaudio/AudioNode.h
+++ b/Source/WebCore/Modules/webaudio/AudioNode.h
@@ -83,7 +83,7 @@ public:
     // We handle our own ref-counting because of the threading issues and subtle nature of
     // how AudioNodes can continue processing (playing one-shot sound) after there are no more
     // JavaScript references to the object.
-    enum RefType { RefTypeNormal, RefTypeConnection, RefTypeDisabled };
+    enum RefType { RefTypeNormal, RefTypeConnection };
 
     // Can be called from main thread or context's audio thread.
     void ref(RefType refType = RefTypeNormal);
@@ -153,6 +153,8 @@ public:
     void silenceOutputs();
     void unsilenceOutputs();
 
+    void enableOutputsIfNecessary();
+    void disableOutputsIfNecessary();
 protected:
     // Inputs and outputs must be created before the AudioNode is initialized.
     void addInput(PassOwnPtr<AudioNodeInput>);
@@ -177,7 +179,6 @@ private:
     // Ref-counting
     volatile int m_normalRefCount;
     volatile int m_connectionRefCount;
-    volatile int m_disabledRefCount;
     
     bool m_isMarkedForDeletion;
     bool m_isDisabled;
diff --git a/Source/WebCore/Modules/webaudio/AudioNodeInput.cpp b/Source/WebCore/Modules/webaudio/AudioNodeInput.cpp
index 374f27a18..f3f48be84 100644
--- a/Source/WebCore/Modules/webaudio/AudioNodeInput.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioNodeInput.cpp
@@ -38,8 +38,8 @@ using namespace std;
 namespace WebCore {
 
 AudioNodeInput::AudioNodeInput(AudioNode* node)
-    : m_node(node)
-    , m_renderingStateNeedUpdating(false)
+    : AudioSummingJunction(node->context())
+    , m_node(node)
 {
     // Set to mono by default.
     m_internalSummingBus = adoptPtr(new AudioBus(1, AudioNode::ProcessingSizeInFrames));
@@ -86,7 +86,7 @@ void AudioNodeInput::disconnect(AudioNodeOutput* output)
     if (m_disabledOutputs.contains(output)) {
         m_disabledOutputs.remove(output);
         output->removeInput(this);
-        node()->deref(AudioNode::RefTypeDisabled); // Note: it's important to return immediately after all deref() calls since the node may be deleted.
+        node()->deref(AudioNode::RefTypeConnection); // Note: it's important to return immediately after all deref() calls since the node may be deleted.
         return;
     }
 
@@ -107,8 +107,8 @@ void AudioNodeInput::disable(AudioNodeOutput* output)
     m_outputs.remove(output);
     changedOutputs();
 
-    node()->ref(AudioNode::RefTypeDisabled);
-    node()->deref(AudioNode::RefTypeConnection); // Note: it's important to return immediately after all deref() calls since the node may be deleted.
+    // Propagate disabled state to outputs.
+    node()->disableOutputsIfNecessary();
 }
 
 void AudioNodeInput::enable(AudioNodeOutput* output)
@@ -126,37 +126,13 @@ void AudioNodeInput::enable(AudioNodeOutput* output)
     m_disabledOutputs.remove(output);
     changedOutputs();
 
-    node()->ref(AudioNode::RefTypeConnection);
-    node()->deref(AudioNode::RefTypeDisabled); // Note: it's important to return immediately after all deref() calls since the node may be deleted.
+    // Propagate enabled state to outputs.
+    node()->enableOutputsIfNecessary();
 }
 
-void AudioNodeInput::changedOutputs()
+void AudioNodeInput::didUpdate()
 {
-    ASSERT(context()->isGraphOwner());
-    if (!m_renderingStateNeedUpdating && !node()->isMarkedForDeletion()) {    
-        context()->markAudioNodeInputDirty(this);
-        m_renderingStateNeedUpdating = true;
-    }
-}
-
-void AudioNodeInput::updateRenderingState()
-{
-    ASSERT(context()->isAudioThread() && context()->isGraphOwner());
-    
-    if (m_renderingStateNeedUpdating && !node()->isMarkedForDeletion()) {
-        // Copy from m_outputs to m_renderingOutputs.
-        m_renderingOutputs.resize(m_outputs.size());
-        unsigned j = 0;
-        for (HashSet<AudioNodeOutput*>::iterator i = m_outputs.begin(); i != m_outputs.end(); ++i, ++j) {
-            AudioNodeOutput* output = *i;
-            m_renderingOutputs[j] = output;
-            output->updateRenderingState();
-        }
-
-        node()->checkNumberOfChannelsForInput(this);
-        
-        m_renderingStateNeedUpdating = false;
-    }
+    node()->checkNumberOfChannelsForInput(this);
 }
 
 void AudioNodeInput::updateInternalBus()
diff --git a/Source/WebCore/Modules/webaudio/AudioNodeInput.h b/Source/WebCore/Modules/webaudio/AudioNodeInput.h
index 98b7f460d..76a416102 100644
--- a/Source/WebCore/Modules/webaudio/AudioNodeInput.h
+++ b/Source/WebCore/Modules/webaudio/AudioNodeInput.h
@@ -27,6 +27,7 @@
 
 #include "AudioBus.h"
 #include "AudioNode.h"
+#include "AudioSummingJunction.h"
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 
@@ -39,13 +40,16 @@ class AudioNodeOutput;
 // In the case of multiple connections, the input will act as a unity-gain summing junction, mixing all the outputs.
 // The number of channels of the input's bus is the maximum of the number of channels of all its connections.
 
-class AudioNodeInput {
+class AudioNodeInput : public AudioSummingJunction {
 public:
     AudioNodeInput(AudioNode*);
 
+    // AudioSummingJunction
+    virtual bool canUpdateState() OVERRIDE { return !node()->isMarkedForDeletion(); }
+    virtual void didUpdate() OVERRIDE;
+
     // Can be called from any thread.
     AudioNode* node() const { return m_node; }
-    AudioContext* context() { return m_node->context(); }
 
     // Must be called with the context's graph lock.
     void connect(AudioNodeOutput*);
@@ -68,46 +72,16 @@ public:
     // Called from context's audio thread.
     AudioBus* bus();
     
-    // This copies m_outputs to m_renderingOutputs.  Please see comments for these lists below.
-    // This must be called when we own the context's graph lock in the audio thread at the very start or end of the render quantum.
-    void updateRenderingState();
-
     // updateInternalBus() updates m_internalSummingBus appropriately for the number of channels.
     // This must be called when we own the context's graph lock in the audio thread at the very start or end of the render quantum.
     void updateInternalBus();
 
-    // Rendering code accesses its version of the current connections here.
-    unsigned numberOfRenderingConnections() const { return m_renderingOutputs.size(); }
-    AudioNodeOutput* renderingOutput(unsigned i) { return m_renderingOutputs[i]; }
-    const AudioNodeOutput* renderingOutput(unsigned i) const { return m_renderingOutputs[i]; }
-    bool isConnected() const { return numberOfRenderingConnections() > 0; }
-
     // The number of channels of the connection with the largest number of channels.
     unsigned numberOfChannels() const;        
     
 private:
     AudioNode* m_node;
 
-    // m_outputs contains the AudioNodeOutputs representing current connections which are not disabled.
-    // The rendering code should never use this directly, but instead uses m_renderingOutputs.
-    HashSet<AudioNodeOutput*> m_outputs;
-
-    // numberOfConnections() should never be called from the audio rendering thread.
-    // Instead numberOfRenderingConnections() and renderingOutput() should be used.
-    unsigned numberOfConnections() const { return m_outputs.size(); }
-
-    // This must be called whenever we modify m_outputs.
-    void changedOutputs();
-    
-    // m_renderingOutputs is a copy of m_outputs which will never be modified during the graph rendering on the audio thread.
-    // This is the list which is used by the rendering code.
-    // Whenever m_outputs is modified, the context is told so it can later update m_renderingOutputs from m_outputs at a safe time.
-    // Most of the time, m_renderingOutputs is identical to m_outputs.
-    Vector<AudioNodeOutput*> m_renderingOutputs;
-
-    // m_renderingStateNeedUpdating keeps track if m_outputs is modified.
-    bool m_renderingStateNeedUpdating;
-
     // The number of channels of the rendering connection with the largest number of channels.
     unsigned numberOfRenderingChannels();
 
diff --git a/Source/WebCore/Modules/webaudio/AudioSummingJunction.cpp b/Source/WebCore/Modules/webaudio/AudioSummingJunction.cpp
new file mode 100644
index 000000000..ad81cada5
--- /dev/null
+++ b/Source/WebCore/Modules/webaudio/AudioSummingJunction.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "AudioSummingJunction.h"
+
+#include "AudioContext.h"
+#include "AudioNodeOutput.h"
+#include <algorithm>
+
+using namespace std;
+
+namespace WebCore {
+
+AudioSummingJunction::AudioSummingJunction(AudioContext* context)
+    : m_context(context)
+    , m_renderingStateNeedUpdating(false)
+{
+}
+
+AudioSummingJunction::~AudioSummingJunction()
+{
+    if (m_renderingStateNeedUpdating && m_context.get())
+        m_context->removeMarkedSummingJunction(this);
+}
+
+void AudioSummingJunction::changedOutputs()
+{
+    ASSERT(context()->isGraphOwner());
+    if (!m_renderingStateNeedUpdating && canUpdateState()) {
+        context()->markSummingJunctionDirty(this);
+        m_renderingStateNeedUpdating = true;
+    }
+}
+
+void AudioSummingJunction::updateRenderingState()
+{
+    ASSERT(context()->isAudioThread() && context()->isGraphOwner());
+
+    if (m_renderingStateNeedUpdating && canUpdateState()) {
+        // Copy from m_outputs to m_renderingOutputs.
+        m_renderingOutputs.resize(m_outputs.size());
+        unsigned j = 0;
+        for (HashSet<AudioNodeOutput*>::iterator i = m_outputs.begin(); i != m_outputs.end(); ++i, ++j) {
+            AudioNodeOutput* output = *i;
+            m_renderingOutputs[j] = output;
+            output->updateRenderingState();
+        }
+
+        didUpdate();
+
+        m_renderingStateNeedUpdating = false;
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/Modules/webaudio/AudioSummingJunction.h b/Source/WebCore/Modules/webaudio/AudioSummingJunction.h
new file mode 100644
index 000000000..dd5e4427d
--- /dev/null
+++ b/Source/WebCore/Modules/webaudio/AudioSummingJunction.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioSummingJunction_h
+#define AudioSummingJunction_h
+
+#include "AudioBus.h"
+#include <wtf/HashSet.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AudioContext;
+class AudioNodeOutput;
+
+// An AudioSummingJunction represents a point where zero, one, or more AudioNodeOutputs connect.
+
+class AudioSummingJunction {
+public:
+    AudioSummingJunction(AudioContext*);
+    virtual ~AudioSummingJunction();
+
+    // Can be called from any thread.
+    AudioContext* context() { return m_context.get(); }
+
+    // This must be called whenever we modify m_outputs.
+    void changedOutputs();
+
+    // This copies m_outputs to m_renderingOutputs. Please see comments for these lists below.
+    // This must be called when we own the context's graph lock in the audio thread at the very start or end of the render quantum.
+    void updateRenderingState();
+
+    // Rendering code accesses its version of the current connections here.
+    unsigned numberOfRenderingConnections() const { return m_renderingOutputs.size(); }
+    AudioNodeOutput* renderingOutput(unsigned i) { return m_renderingOutputs[i]; }
+    const AudioNodeOutput* renderingOutput(unsigned i) const { return m_renderingOutputs[i]; }
+    bool isConnected() const { return numberOfRenderingConnections() > 0; }
+
+    virtual bool canUpdateState() = 0;
+    virtual void didUpdate() = 0;
+
+protected:
+    RefPtr<AudioContext> m_context;
+
+    // m_outputs contains the AudioNodeOutputs representing current connections which are not disabled.
+    // The rendering code should never use this directly, but instead uses m_renderingOutputs.
+    HashSet<AudioNodeOutput*> m_outputs;
+
+    // numberOfConnections() should never be called from the audio rendering thread.
+    // Instead numberOfRenderingConnections() and renderingOutput() should be used.
+    unsigned numberOfConnections() const { return m_outputs.size(); }
+
+    // m_renderingOutputs is a copy of m_outputs which will never be modified during the graph rendering on the audio thread.
+    // This is the list which is used by the rendering code.
+    // Whenever m_outputs is modified, the context is told so it can later update m_renderingOutputs from m_outputs at a safe time.
+    // Most of the time, m_renderingOutputs is identical to m_outputs.
+    Vector<AudioNodeOutput*> m_renderingOutputs;
+
+    // m_renderingStateNeedUpdating keeps track if m_outputs is modified.
+    bool m_renderingStateNeedUpdating;
+};
+
+} // namespace WebCore
+
+#endif // AudioSummingJunction_h
diff --git a/Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.cpp b/Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.cpp
index 8af44230b..dad067a3d 100644
--- a/Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.cpp
+++ b/Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.cpp
@@ -68,9 +68,7 @@ MediaElementAudioSourceNode::~MediaElementAudioSourceNode()
 void MediaElementAudioSourceNode::setFormat(size_t numberOfChannels, float sourceSampleRate)
 {
     if (numberOfChannels != m_sourceNumberOfChannels || sourceSampleRate != m_sourceSampleRate) {
-        // FIXME: implement multi-channel greater than stereo.
-        // https://bugs.webkit.org/show_bug.cgi?id=75119
-        if (!numberOfChannels || numberOfChannels > 2 || sourceSampleRate < minSampleRate || sourceSampleRate > maxSampleRate) {
+        if (!numberOfChannels || numberOfChannels > AudioContext::maxNumberOfChannels() || sourceSampleRate < minSampleRate || sourceSampleRate > maxSampleRate) {
             // process() will generate silence for these uninitialized values.
             LOG(Media, "MediaElementAudioSourceNode::setFormat(%u, %f) - unhandled format change", static_cast<unsigned>(numberOfChannels), sourceSampleRate);
             m_sourceNumberOfChannels = 0;
diff --git a/Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp b/Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp
index e51c24448..c7539c6e1 100644
--- a/Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp
+++ b/Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp
@@ -282,7 +282,7 @@ bool AbstractDatabase::performOpenAndVerify(bool shouldSetVersionInNewDatabase,
         GuidVersionMap::iterator entry = guidToVersionMap().find(m_guid);
         if (entry != guidToVersionMap().end()) {
             // Map null string to empty string (see updateGuidVersionMap()).
-            currentVersion = entry->second.isNull() ? String("") : entry->second.isolatedCopy();
+            currentVersion = entry->second.isNull() ? emptyString() : entry->second.isolatedCopy();
             LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
 
 #if PLATFORM(CHROMIUM)
diff --git a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
index 8ec82577c..1add438e2 100644
--- a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
@@ -109,7 +109,7 @@ bool ThreadableWebSocketChannelClientWrapper::useHixie76Protocol() const
 String ThreadableWebSocketChannelClientWrapper::subprotocol() const
 {
     if (m_subprotocol.isEmpty())
-        return String("");
+        return emptyString();
     return String(m_subprotocol);
 }
 
@@ -124,7 +124,7 @@ void ThreadableWebSocketChannelClientWrapper::setSubprotocol(const String& subpr
 String ThreadableWebSocketChannelClientWrapper::extensions() const
 {
     if (m_extensions.isEmpty())
-        return String("");
+        return emptyString();
     return String(m_extensions);
 }
 
diff --git a/Source/WebCore/Modules/websockets/WebSocket.cpp b/Source/WebCore/Modules/websockets/WebSocket.cpp
index 3f383e7d6..92f1f26ba 100644
--- a/Source/WebCore/Modules/websockets/WebSocket.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocket.cpp
@@ -221,7 +221,7 @@ void WebSocket::connect(const String& url, const Vector<String>& protocols, Exce
         return;
     }
 
-    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectFromSource(m_url)) {
+    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectToSource(m_url)) {
         m_state = CLOSED;
 
         // FIXME: Should this be throwing an exception?
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index f76ae0b9f..c278b6b94 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -467,7 +467,6 @@ SOURCES += \
     css/CSSSelector.cpp \
     css/CSSSelectorList.cpp \
     css/CSSSegmentedFontFace.cpp \
-    css/CSSStyleDeclaration.cpp \
     css/CSSStyleRule.cpp \
     css/CSSStyleSheet.cpp \
     css/CSSTimingFunctionValue.cpp \
@@ -621,7 +620,6 @@ SOURCES += \
     dom/TouchList.cpp \
     dom/Traversal.cpp \
     dom/TreeScope.cpp \
-    dom/TreeScopeAdjuster.cpp \
     dom/TreeScopeAdopter.cpp \
     dom/TreeWalker.cpp \
     dom/UIEvent.cpp \
@@ -872,10 +870,10 @@ SOURCES += \
     html/parser/TextDocumentParser.cpp \
     html/parser/TextViewSourceParser.cpp \
     html/parser/XSSAuditor.cpp \
+    html/shadow/ContentDistributor.cpp \
     html/shadow/ContentSelectorQuery.cpp \
     html/shadow/DetailsMarkerControl.cpp \
     html/shadow/HTMLContentElement.cpp \
-    html/shadow/HTMLContentSelector.cpp \
     html/shadow/HTMLShadowElement.cpp \
     html/shadow/InsertionPoint.cpp \
     html/shadow/MediaControls.cpp \
@@ -984,6 +982,8 @@ SOURCES += \
     loader/PolicyCallback.cpp \
     loader/PolicyChecker.cpp \
     loader/ProgressTracker.cpp \
+    loader/Prerenderer.cpp \
+    loader/PrerendererClient.cpp \
     loader/NavigationScheduler.cpp \
     loader/ResourceLoader.cpp \
     loader/ResourceLoadNotifier.cpp \
@@ -1216,6 +1216,7 @@ SOURCES += \
     platform/text/UnicodeRange.cpp \
     platform/text/transcoder/FontTranscoder.cpp \
     platform/UUID.cpp \
+    platform/VisitedLinks.cpp \
     platform/Widget.cpp \
     platform/PlatformStrategies.cpp \
     plugins/IFrameShimSupport.cpp \
@@ -1773,7 +1774,6 @@ HEADERS += \
     dom/Traversal.h \
     dom/TreeDepthLimit.h \
     dom/TreeScope.h \
-    dom/TreeScopeAdjuster.h \
     dom/TreeScopeAdopter.h \
     dom/TreeWalker.h \
     dom/UIEvent.h \
@@ -1997,9 +1997,9 @@ HEADERS += \
     html/parser/HTMLTreeBuilder.h \
     html/parser/HTMLViewSourceParser.h \
     html/parser/XSSAuditor.h \
+    html/shadow/ContentDistributor.h \
     html/shadow/ContentSelectorQuery.h \
     html/shadow/HTMLContentElement.h \
-    html/shadow/HTMLContentSelector.h \
     html/shadow/HTMLShadowElement.h \
     html/shadow/MediaControlElements.h \
     html/shadow/DetailsMarkerControl.h \
@@ -2106,6 +2106,8 @@ HEADERS += \
     loader/NavigationAction.h \
     loader/NetscapePlugInStreamLoader.h \
     loader/PlaceholderDocument.h \
+    loader/Prerenderer.h \
+    loader/PrerendererClient.h \
     loader/ProgressTracker.h \
     loader/ResourceLoader.h \
     loader/SubresourceLoader.h \
@@ -2391,6 +2393,7 @@ HEADERS += \
     platform/Timer.h \
     platform/Widget.h \
     platform/PlatformStrategies.h \
+    platform/PrerenderHandle.h \
     platform/LocalizedStrings.h \
     plugins/DOMMimeTypeArray.h \
     plugins/DOMMimeType.h \
@@ -2856,6 +2859,9 @@ SOURCES += \
     platform/graphics/qt/FontPlatformDataQt.cpp \
     platform/graphics/qt/FloatPointQt.cpp \
     platform/graphics/qt/FloatRectQt.cpp \
+    platform/graphics/qt/FractionalLayoutPointQt.cpp \
+    platform/graphics/qt/FractionalLayoutRectQt.cpp \
+    platform/graphics/qt/FractionalLayoutSizeQt.cpp \
     platform/graphics/qt/GradientQt.cpp \
     platform/graphics/qt/GraphicsContextQt.cpp \
     platform/graphics/qt/IconQt.cpp \
@@ -3397,7 +3403,6 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/SpotLightSource.cpp \
         platform/graphics/filters/SourceAlpha.cpp \
         platform/graphics/filters/SourceGraphic.cpp \
-        platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp \
         platform/graphics/filters/arm/FELightingNEON.cpp \
         platform/graphics/filters/arm/FEGaussianBlurNEON.cpp \
 }
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index 5c5a1d931..38f68a8a3 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -250,6 +250,7 @@ __ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
 __ZN7WebCore12EventHandler9mouseDownEP7NSEvent
 __ZN7WebCore12GCController17garbageCollectNowEv
 __ZN7WebCore12GCController18garbageCollectSoonEv
+__ZN7WebCore12GCController41setJavaScriptGarbageCollectorTimerEnabledEb
 __ZN7WebCore12GCController43garbageCollectOnAlternateThreadForDebuggingEb
 __ZN7WebCore12PopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore12PrintContext12pagePropertyEPNS_5FrameEPKci
@@ -283,7 +284,7 @@ __ZN7WebCore12SharedBufferD1Ev
 __ZN7WebCore12SpellChecker17didCheckSucceededEiRKN3WTF6VectorINS_18TextCheckingResultELm0EEE
 __ZN7WebCore12TextEncodingC1ERKN3WTF6StringE
 __ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
-__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
+__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_13ContainerNodeEiib
 __ZN7WebCore12TextIterator29getLocationAndLengthFromRangeEPNS_7ElementEPKNS_5RangeERmS6_
 __ZN7WebCore12TextIterator7advanceEv
 __ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
@@ -483,6 +484,7 @@ __ZN7WebCore16FontPlatformDataD1Ev
 __ZN7WebCore16HTMLInputElement13setAutofilledEb
 __ZN7WebCore16HTMLInputElement15setValueForUserERKN3WTF6StringE
 __ZN7WebCore16HTMLInputElement17setSuggestedValueERKN3WTF6StringE
+__ZN7WebCore16HTMLInputElement15setEditingValueERKN3WTF6StringE
 __ZN7WebCore16IconDatabaseBase28synchronousIconURLForPageURLERKN3WTF6StringE
 __ZN7WebCore16IconDatabaseBase4openERKN3WTF6StringES4_
 __ZN7WebCore16LegacyWebArchive19createFromSelectionEPNS_5FrameE
@@ -1692,6 +1694,9 @@ _wkFilterRelease
 _wkFilterWasBlocked
 _wkFilterAddData
 _wkFilterDataComplete
+_wkNSElasticDeltaForTimeDelta
+_wkNSElasticDeltaForReboundDelta
+_wkNSReboundDeltaForElasticDelta
 #endif
 
 #if ENABLE(SVG)
@@ -1882,22 +1887,22 @@ __ZN7WebCore5Frame26sendOrientationChangeEventEi
 
 #if USE(PLUGIN_HOST_PROCESS)
 __ZN3JSC13RuntimeMethod11getCallDataEPNS_6JSCellERNS_8CallDataE
-__ZN3JSC13RuntimeMethod14finishCreationERNS_12JSGlobalDataERKNS_10IdentifierE
-__ZN3JSC13RuntimeMethod18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC13RuntimeMethod24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
+__ZN3JSC13RuntimeMethod14finishCreationERNS_12JSGlobalDataERKNS_7UStringE
+__ZN3JSC13RuntimeMethod18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC13RuntimeMethod24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
 __ZN3JSC13RuntimeMethod6s_infoE
 __ZN3JSC13RuntimeMethod7destroyEPNS_6JSCellE
 __ZN3JSC13RuntimeMethodC2EPNS_14JSGlobalObjectEPNS_9StructureERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
 __ZN3JSC8Bindings10RootObjectD1Ev
 __ZN3JSC8Bindings13RuntimeObject11getCallDataEPNS_6JSCellERNS_8CallDataE
 __ZN3JSC8Bindings13RuntimeObject12defaultValueEPKNS_8JSObjectEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
-__ZN3JSC8Bindings13RuntimeObject14deletePropertyEPNS_6JSCellEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC8Bindings13RuntimeObject14deletePropertyEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameE
 __ZN3JSC8Bindings13RuntimeObject14finishCreationEPNS_14JSGlobalObjectE
 __ZN3JSC8Bindings13RuntimeObject16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
-__ZN3JSC8Bindings13RuntimeObject18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC8Bindings13RuntimeObject18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
 __ZN3JSC8Bindings13RuntimeObject19getOwnPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
-__ZN3JSC8Bindings13RuntimeObject24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
-__ZN3JSC8Bindings13RuntimeObject3putEPNS_6JSCellEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8Bindings13RuntimeObject24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC8Bindings13RuntimeObject3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC8Bindings13RuntimeObject6s_infoE
 __ZN3JSC8Bindings13RuntimeObject7destroyEPNS_6JSCellE
 __ZN3JSC8Bindings13RuntimeObjectC2EPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureEN3WTF10PassRefPtrINS0_8InstanceEEE
@@ -2097,7 +2102,7 @@ __ZN7WebCore8Document25setFullScreenRendererSizeERKNS_7IntSizeE
 __ZN7WebCore8Document36setFullScreenRendererBackgroundColorENS_5ColorE
 __ZN7WebCore8Document22setAnimatingFullScreenEb
 __ZNK7WebCore8Document9domWindowEv
-__ZNK7WebCore4Node16traverseNextNodeEPKS0_
+__ZNK7WebCore4Node27traverseNextAncestorSiblingEv
 #endif
 
 __ZN7WebCore16ApplicationCache18diskUsageForOriginEPNS_14SecurityOriginE
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index 10a281ee1..9425df1dd 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -120,7 +120,6 @@
       '../platform/image-decoders/jpeg',
       '../platform/image-decoders/png',
       '../platform/image-decoders/skia',
-      '../platform/image-decoders/xbm',
       '../platform/image-decoders/webp',
       '../platform/image-encoders/skia',
       '../platform/leveldb',
@@ -329,6 +328,9 @@
           'link_settings': {
             'libraries': [
               '<(adjusted_library_path)',
+
+              # libWebKitSystemInterfaceLeopard.a references _kCIFormatRGBA8.
+              '$(SDKROOT)/System/Library/Frameworks/QuartzCore.framework',
             ],
           },  # link_settings
         },  # target webkit_system_interface
@@ -1019,6 +1021,7 @@
             'generator_include_dirs': [
               '--include', '../Modules/filesystem',
               '--include', '../Modules/indexeddb',
+              '--include', '../Modules/intents',
               '--include', '../Modules/mediastream',
               '--include', '../Modules/webaudio',
               '--include', '../Modules/webdatabase',
@@ -1249,9 +1252,6 @@
           '<(SHARED_INTERMEDIATE_DIR)/webkit',
           '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
         ],
-        'mac_framework_dirs': [
-          '$(SDKROOT)/System/Library/Frameworks/ApplicationServices.framework/Frameworks',
-        ],
         'msvs_disabled_warnings': [
           4138, 4244, 4291, 4305, 4344, 4355, 4521, 4099,
         ],
@@ -1302,17 +1302,6 @@
             '<(chromium_src_dir)/build/linux/system.gyp:gtk',
           ],
         }],
-        ['OS=="linux"', {
-          'direct_dependent_settings': {
-            'defines': [
-              # Mozilla on Linux effectively uses uname -sm, but when running
-              # 32-bit x86 code on an x86_64 processor, it uses
-              # "Linux i686 (x86_64)".  Matching that would require making a
-              # run-time determination.
-              'WEBCORE_NAVIGATOR_PLATFORM="Linux i686"',
-            ],
-          },
-        }],
         ['OS=="mac"', {
           'dependencies': [
             'webkit_system_interface',
@@ -1995,16 +1984,6 @@
         'include_dirs': [
           '<@(webcore_include_dirs)',
         ],
-        'mac_framework_dirs': [
-          '$(SDKROOT)/System/Library/Frameworks/ApplicationServices.framework/Frameworks',
-          '$(SDKROOT)/System/Library/Frameworks/Accelerate.framework',
-          '$(SDKROOT)/System/Library/Frameworks/CoreServices.framework',
-          '$(SDKROOT)/System/Library/Frameworks/Foundation.framework',
-          '$(SDKROOT)/System/Library/Frameworks/CoreFoundation.framework',
-          '$(SDKROOT)/System/Library/Frameworks/AudioToolbox.framework',
-          '$(SDKROOT)/System/Library/Frameworks/AudioUnit.framework',
-          '$(SDKROOT)/System/Library/Frameworks/CoreAudio.framework',
-        ],
       },
       'conditions': [
         ['OS=="mac"', {
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index e7746e647..1b70d0b4c 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -327,6 +327,7 @@
             'platform/Timer.h',
             'platform/TreeShared.h',
             'platform/VisitedLinkStrategy.h',
+            'platform/VisitedLinks.h',
             'platform/Widget.h',
             'platform/WindowsKeyboardCodes.h',
             'platform/animation/Animation.h',
@@ -811,6 +812,7 @@
             'Modules/indexeddb/IDBVersionChangeEvent.idl',
             'Modules/indexeddb/IDBVersionChangeRequest.idl',
             'Modules/indexeddb/WorkerContextIndexedDatabase.idl',
+            'Modules/intents/DeliveredIntent.idl',
             'Modules/intents/DOMWindowIntents.idl',
             'Modules/intents/Intent.idl',
             'Modules/intents/IntentResultCallback.idl',
@@ -1505,6 +1507,10 @@
             'Modules/indexeddb/PageGroupIndexedDatabase.h',
             'Modules/indexeddb/WorkerContextIndexedDatabase.cpp',
             'Modules/indexeddb/WorkerContextIndexedDatabase.h',
+            'Modules/intents/DeliveredIntent.cpp',
+            'Modules/intents/DeliveredIntent.h',
+            'Modules/intents/DOMWindowIntents.cpp',
+            'Modules/intents/DOMWindowIntents.h',
             'Modules/intents/Intent.cpp',
             'Modules/intents/Intent.h',
             'Modules/intents/IntentRequest.cpp',
@@ -1604,6 +1610,8 @@
             'Modules/webaudio/AudioScheduledSourceNode.cpp',
             'Modules/webaudio/AudioScheduledSourceNode.h',
             'Modules/webaudio/AudioSourceNode.h',
+            'Modules/webaudio/AudioSummingJunction.cpp',
+            'Modules/webaudio/AudioSummingJunction.h',
             'Modules/webaudio/AsyncAudioDecoder.cpp',
             'Modules/webaudio/AsyncAudioDecoder.h',
             'Modules/webaudio/BiquadDSPKernel.cpp',
@@ -2473,7 +2481,6 @@
             'css/CSSSelector.cpp',
             'css/CSSSelectorList.cpp',
             'css/CSSSelectorList.h',
-            'css/CSSStyleDeclaration.cpp',
             'css/CSSStyleRule.cpp',
             'css/CSSStyleRule.h',
             'css/CSSStyleSheet.cpp',
@@ -2869,6 +2876,10 @@
             'loader/PlaceholderDocument.h',
             'loader/PolicyCallback.cpp',
             'loader/PolicyChecker.cpp',
+            'loader/Prerenderer.cpp',
+            'loader/Prerenderer.h',
+            'loader/PrerendererClient.cpp',
+            'loader/PrerendererClient.h',
             'loader/ProgressTracker.cpp',
             'loader/ResourceLoadNotifier.cpp',
             'loader/ResourceLoadScheduler.cpp',
@@ -3055,6 +3066,8 @@
             'page/SpeechInputResultList.h',
             'page/SuspendableTimer.cpp',
             'page/SuspendableTimer.h',
+            'page/TouchAdjustment.cpp',
+            'page/TouchAdjustment.h',
             'page/UserContentURLPattern.cpp',
             'page/WebKitAnimation.cpp',
             'page/WebKitAnimation.h',
@@ -3155,6 +3168,7 @@
             'platform/PlatformStrategies.cpp',
             'platform/PlatformTouchEvent.h',
             'platform/PlatformTouchPoint.h',
+            'platform/PrerenderHandle.h',
             'platform/PurgeableBuffer.h',
             'platform/ReferrerPolicy.h',
             'platform/RunLoopTimer.h',
@@ -3334,6 +3348,9 @@
             'platform/chromium/PopupListBox.cpp',
             'platform/chromium/PopupListBox.h',
             'platform/chromium/PopupMenuPrivate.h',
+            'platform/chromium/Prerender.cpp',
+            'platform/chromium/Prerender.h',
+            'platform/chromium/PrerenderHandle.cpp',
             'platform/chromium/SSLKeyGeneratorChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.h',
@@ -3357,6 +3374,7 @@
             'platform/chromium/ThemeChromiumMac.h',
             'platform/chromium/ThemeChromiumMac.mm',
             'platform/chromium/TraceEvent.h',
+            'platform/chromium/VisitedLinksChromium.cpp',
             'platform/chromium/WidgetChromium.cpp',
             'platform/cocoa/KeyEventCocoa.h',
             'platform/cocoa/KeyEventCocoa.mm',
@@ -3814,7 +3832,6 @@
             'platform/graphics/filters/SourceGraphic.h',
             'platform/graphics/filters/SpotLightSource.cpp',
             'platform/graphics/filters/SpotLightSource.h',
-            'platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp',
             'platform/graphics/filters/arm/FECompositeArithmeticNEON.h',
             'platform/graphics/filters/arm/FEGaussianBlurNEON.cpp',
             'platform/graphics/filters/arm/FEGaussianBlurNEON.h',
@@ -4208,7 +4225,6 @@
             'platform/image-decoders/bmp/BMPImageReader.cpp',
             'platform/image-decoders/bmp/BMPImageReader.h',
             'platform/image-decoders/cairo/ImageDecoderCairo.cpp',
-            'platform/image-decoders/cg/ImageDecoderCG.cpp',
             'platform/image-decoders/gif/GIFImageDecoder.cpp',
             'platform/image-decoders/gif/GIFImageDecoder.h',
             'platform/image-decoders/gif/GIFImageReader.cpp',
@@ -5381,8 +5397,6 @@
             'dom/TreeDepthLimit.h',
             'dom/TreeScope.cpp',
             'dom/TreeScope.h',
-            'dom/TreeScopeAdjuster.cpp',
-            'dom/TreeScopeAdjuster.h',
             'dom/TreeScopeAdopter.cpp',
             'dom/TreeScopeAdopter.h',
             'dom/TreeWalker.cpp',
@@ -5790,14 +5804,14 @@
             'html/parser/XSSAuditor.h',
             'html/shadow/CalendarPickerElement.cpp',
             'html/shadow/CalendarPickerElement.h',
+            'html/shadow/ContentDistributor.cpp',
+            'html/shadow/ContentDistributor.h',
             'html/shadow/ContentSelectorQuery.cpp',
             'html/shadow/ContentSelectorQuery.h',
             'html/shadow/DetailsMarkerControl.cpp',
             'html/shadow/DetailsMarkerControl.h',
             'html/shadow/HTMLContentElement.cpp',
             'html/shadow/HTMLContentElement.h',
-            'html/shadow/HTMLContentSelector.cpp',
-            'html/shadow/HTMLContentSelector.h',
             'html/shadow/HTMLShadowElement.cpp',
             'html/shadow/HTMLShadowElement.h',
             'html/shadow/InsertionPoint.cpp',
@@ -6349,6 +6363,7 @@
             'inspector/front-end/CookieItemsView.js',
             'inspector/front-end/CookieParser.js',
             'inspector/front-end/CookiesTable.js',
+            'inspector/front-end/CPUProfileView.js',
             'inspector/front-end/CSSCompletions.js',
             'inspector/front-end/CSSKeywordCompletions.js',
             'inspector/front-end/CSSSelectorProfileView.js',
@@ -6358,7 +6373,8 @@
             'inspector/front-end/DatabaseTableView.js',
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DebuggerModel.js',
-            'inspector/front-end/DebuggerPresentationModel.js',
+            'inspector/front-end/DebuggerResourceBinding.js',
+            'inspector/front-end/DebuggerScriptMapping.js',
             'inspector/front-end/Dialog.js',
             'inspector/front-end/DOMAgent.js',
             'inspector/front-end/DOMBreakpointsSidebarPane.js',
@@ -6423,10 +6439,10 @@
             'inspector/front-end/PanelEnablerView.js',
             'inspector/front-end/Placard.js',
             'inspector/front-end/Popover.js',
+            'inspector/front-end/PresentationConsoleMessageHelper.js',
             'inspector/front-end/ProfileDataGridTree.js',
             'inspector/front-end/ProfileLauncherView.js',
             'inspector/front-end/ProfilesPanel.js',
-            'inspector/front-end/ProfileView.js',
             'inspector/front-end/PropertiesSection.js',
             'inspector/front-end/PropertiesSidebarPane.js',
             'inspector/front-end/RawSourceCode.js',
@@ -6451,7 +6467,7 @@
             'inspector/front-end/Script.js',
             'inspector/front-end/ScriptFormatter.js',
             'inspector/front-end/ScriptFormatterWorker.js',
-            'inspector/front-end/ScriptMapping.js',
+            'inspector/front-end/ScriptSnippetModel.js',
             'inspector/front-end/ScriptsNavigator.js',
             'inspector/front-end/ScriptsPanel.js',
             'inspector/front-end/ScriptsSearchScope.js',
@@ -6464,12 +6480,13 @@
             'inspector/front-end/SidebarOverlay.js',
             'inspector/front-end/SidebarPane.js',
             'inspector/front-end/SidebarTreeElement.js',
-            'inspector/front-end/SnippetsModel.js',
+            'inspector/front-end/SnippetStorage.js',
             'inspector/front-end/SoftContextMenu.js',
             'inspector/front-end/SourceCSSTokenizer.js',
             'inspector/front-end/SourceFrame.js',
             'inspector/front-end/SourceHTMLTokenizer.js',
             'inspector/front-end/SourceJavaScriptTokenizer.js',
+            'inspector/front-end/SourceMapping.js',
             'inspector/front-end/SourceTokenizer.js',
             'inspector/front-end/Spectrum.js',
             'inspector/front-end/SplitView.js',
@@ -6503,7 +6520,6 @@
             'inspector/front-end/WorkerManager.js',
             'inspector/front-end/WorkersSidebarPane.js',
             'inspector/front-end/dialog.css',
-            'inspector/front-end/helpScreen.css',
             'inspector/front-end/inspector.css',
             'inspector/front-end/inspectorSyntaxHighlight.css',
             'inspector/front-end/popover.css',
@@ -6515,6 +6531,7 @@
             'inspector/front-end/elementsPanel.css',
             'inspector/front-end/filteredItemSelectionDialog.css',
             'inspector/front-end/heapProfiler.css',
+            'inspector/front-end/helpScreen.css',
             'inspector/front-end/indexedDBViews.css',
             'inspector/front-end/inspectorCommon.css',
             'inspector/front-end/navigatorView.css',
@@ -6579,7 +6596,6 @@
             'inspector/front-end/Images/indexedDBIndex.png',
             'inspector/front-end/Images/localStorage.png',
             'inspector/front-end/Images/navigatorShowHideButton.png',
-            'inspector/front-end/Images/navigatorPinButton.png',
             'inspector/front-end/Images/paneAddButtons.png',
             'inspector/front-end/Images/paneBottomGrow.png',
             'inspector/front-end/Images/paneBottomGrowActive.png',
@@ -8288,7 +8304,9 @@
             'platform/chromium/support/WebMediaStreamDescriptor.cpp',
             'platform/chromium/support/WebMediaStreamSource.cpp',
             'platform/chromium/support/WebMediaStreamSourcesRequest.cpp',
+            'platform/chromium/support/WebPrerender.cpp',
             'platform/chromium/support/WebThreadSafeData.cpp',
+            'platform/chromium/support/WebTransformationMatrix.cpp',
             'platform/chromium/support/WebURL.cpp',
             'platform/chromium/support/WebURLError.cpp',
             'platform/chromium/support/WebURLRequest.cpp',
diff --git a/Source/WebCore/WebCore.order b/Source/WebCore/WebCore.order
index b27659ac9..2dc3e323a 100644
--- a/Source/WebCore/WebCore.order
+++ b/Source/WebCore/WebCore.order
@@ -4658,7 +4658,7 @@ __ZN7WebCore16VisibleSelection33setBaseAndExtentToDeepEquivalentsEv
 __ZN7WebCore16comparePositionsERKNS_8PositionES2_
 __ZN7WebCore16VisibleSelection52setStartAndEndFromBaseAndExtentRespectingGranularityENS_15TextGranularityE
 __ZN7WebCore16VisibleSelection46adjustSelectionToAvoidCrossingShadowBoundariesEv
-__ZN7WebCore4Node18shadowTreeRootNodeEv
+__ZN7WebCore4Node10shadowRootEv
 __ZN7WebCore16VisibleSelection47adjustSelectionToAvoidCrossingEditingBoundariesEv
 __ZN7WebCore22lowestEditableAncestorEPNS_4NodeE
 __ZN7WebCore16VisibleSelection19updateSelectionTypeEv
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index e8b86c850..05169a785 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -12,7 +12,7 @@ SOURCE_DIR = $${ROOT_WEBKIT_DIR}/Source/WebCore
 # We enable TextureMapper by default; remove this line to enable GraphicsLayerQt.
 CONFIG += texmap
 
-QT *= network sql
+QT *= network sql gui-private
 
 WEBCORE_GENERATED_SOURCES_DIR = $${ROOT_BUILD_DIR}/Source/WebCore/$${GENERATED_SOURCES_DESTDIR}
 
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 3735bc8c0..213d93bfa 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -24221,250 +24221,250 @@
 		<Filter
 			Name="Modules"
 			>
-                        <Filter
-                                Name="filesystem"
-                                >
-			        <File
-				        RelativePath="..\Modules\filesystem\AsyncFileWriter.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\AsyncFileWriterClient.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMFilePath.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMFilePath.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMFileSystem.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMFileSystem.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMFileSystemBase.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMFileSystemBase.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMFileSystemSync.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMFileSystemSync.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMWindowFileSystem.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DOMWindowFileSystem.h"
-				        >
-			        </File>
-        		        <File
-        			        RelativePath="..\Modules\filesystem\DirectoryEntry.cpp"
-	        		        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DirectoryEntry.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DirectoryEntrySync.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DirectoryEntrySync.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DirectoryReader.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DirectoryReader.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DirectoryReaderBase.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DirectoryReaderSync.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\DirectoryReaderSync.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntriesCallback.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntryBase.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\Entry.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\Entry.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntryArray.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntryArray.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntryArraySync.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntryArraySync.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntryBase.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntryCallback.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntrySync.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\EntrySync.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\ErrorCallback.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileCallback.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileEntry.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileEntry.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileEntrySync.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileEntrySync.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileError.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileSystemCallback.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileSystemCallbacks.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileSystemCallbacks.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileSystemType.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileWriter.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileWriter.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileWriterBase.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileWriterBase.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileWriterBaseCallback.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileWriterCallback.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileWriterSync.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\FileWriterSync.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\LocalFileSystem.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\LocalFileSystem.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\Metadata.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\MetadataCallback.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\SyncCallbackHelper.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\WebKitFlags.h"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\WorkerContextFileSystem.cpp"
-				        >
-			        </File>
-			        <File
-				        RelativePath="..\Modules\filesystem\WorkerContextFileSystem.h"
-				        >
-			        </File>
-                        </Filter>
+			<Filter
+				Name="filesystem"
+				>
+				<File
+					RelativePath="..\Modules\filesystem\AsyncFileWriter.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\AsyncFileWriterClient.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DirectoryEntry.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DirectoryEntry.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DirectoryEntrySync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DirectoryEntrySync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DirectoryReader.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DirectoryReader.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DirectoryReaderBase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DirectoryReaderSync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DirectoryReaderSync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMFilePath.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMFilePath.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMFileSystem.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMFileSystem.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMFileSystemBase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMFileSystemBase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMFileSystemSync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMFileSystemSync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMWindowFileSystem.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\DOMWindowFileSystem.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntriesCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\Entry.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\Entry.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntryArray.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntryArray.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntryArraySync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntryArraySync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntryBase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntryBase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntryCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntrySync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\EntrySync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\ErrorCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileEntry.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileEntry.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileEntrySync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileEntrySync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileError.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileSystemCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileSystemCallbacks.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileSystemCallbacks.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileSystemType.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileWriter.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileWriter.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileWriterBase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileWriterBase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileWriterBaseCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileWriterCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileWriterSync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\FileWriterSync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\LocalFileSystem.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\LocalFileSystem.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\Metadata.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\MetadataCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\SyncCallbackHelper.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\WebKitFlags.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\WorkerContextFileSystem.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\filesystem\WorkerContextFileSystem.h"
+					>
+				</File>
+			</Filter>
 			<Filter
 				Name="geolocation"
 				>
@@ -26246,14 +26246,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\page\animation\CSSPropertyAnimation.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\animation\CSSPropertyAnimation.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\BarInfo.cpp"
 				>
 			</File>
@@ -26330,6 +26322,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\animation\CSSPropertyAnimation.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\animation\CSSPropertyAnimation.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\DOMSelection.cpp"
 				>
 			</File>
@@ -27062,6 +27062,22 @@
 				>
 			</File>
 			<File
+				RelativePath="..\loader\Prerenderer.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\loader\Prerenderer.h"
+				>
+			</File>
+			<File
+				RelativePath="..\loader\PrerendererClient.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\loader\PrerendererClient.h"
+				>
+			</File>
+			<File
 				RelativePath="..\loader\ProgressTracker.cpp"
 				>
 			</File>
@@ -27946,6 +27962,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\PrerenderHandle.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\PurgeableBuffer.h"
 				>
 			</File>
@@ -28142,6 +28162,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\VisitedLinks.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\platform\VisitedLinks.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\VisitedLinkStrategy.h"
 				>
 			</File>
@@ -30148,6 +30176,42 @@
 					Name="cairo"
 					>
 					<File
+						RelativePath="..\platform\graphics\cairo\BitmapImageCairo.cpp"
+						>
+						<FileConfiguration
+							Name="Debug|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Debug_All|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Production|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\cairo\CairoPath.h"
 						>
 						<FileConfiguration
@@ -30292,6 +30356,42 @@
 						</FileConfiguration>
 					</File>
 					<File
+						RelativePath="..\platform\graphics\cairo\FloatRectCairo.cpp"
+						>
+						<FileConfiguration
+							Name="Debug|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Debug_All|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Production|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\cairo\FontCairo.cpp"
 						>
 						<FileConfiguration
@@ -30508,6 +30608,78 @@
 						</FileConfiguration>
 					</File>
 					<File
+						RelativePath="..\platform\graphics\cairo\IntRectCairo.cpp"
+						>
+						<FileConfiguration
+							Name="Debug|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Debug_All|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Production|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
+						RelativePath="..\platform\graphics\cairo\NativeImageCairo.cpp"
+						>
+						<FileConfiguration
+							Name="Debug|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Debug_All|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Production|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\cairo\OwnPtrCairo.cpp"
 						>
 						<FileConfiguration
@@ -31056,10 +31228,6 @@
 						>
 					</File>
 					<File
-						RelativePath="..\platform\graphics\filters\arm\FECompositeArithmeticNEON.cpp"
-						>
-					</File>
-					<File
 						RelativePath="..\platform\graphics\filters\arm\FECompositeArithmeticNEON.h"
 						>
 					</File>
@@ -35998,58 +36166,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\css\CSSStyleDeclaration.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
 				RelativePath="..\css\CSSStyleDeclaration.h"
 				>
 			</File>
@@ -40101,7 +40217,7 @@
 				RelativePath="..\rendering\RenderMeter.h"
 				>
 			</File>
-            <File
+			<File
 				RelativePath="..\rendering\RenderMultiColumnBlock.cpp"
 				>
 				<FileConfiguration
@@ -40157,7 +40273,7 @@
 				RelativePath="..\rendering\RenderMultiColumnBlock.h"
 				>
 			</File>
-            <File
+			<File
 				RelativePath="..\rendering\RenderMultiColumnFlowThread.cpp"
 				>
 				<FileConfiguration
@@ -40213,7 +40329,7 @@
 				RelativePath="..\rendering\RenderMultiColumnFlowThread.h"
 				>
 			</File>
-            <File
+			<File
 				RelativePath="..\rendering\RenderMultiColumnSet.cpp"
 				>
 				<FileConfiguration
@@ -40269,7 +40385,7 @@
 				RelativePath="..\rendering\RenderMultiColumnSet.h"
 				>
 			</File>
-            <File
+			<File
 				RelativePath="..\rendering\RenderNamedFlowThread.cpp"
 				>
 			</File>
@@ -40565,7 +40681,7 @@
 				RelativePath="..\rendering\RenderRegion.h"
 				>
 			</File>
-            <File
+			<File
 				RelativePath="..\rendering\RenderRegionSet.cpp"
 				>
 			</File>
@@ -43580,7 +43696,7 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGRenderSupport.cpp"
+				RelativePath="..\rendering\svg\SVGRenderingContext.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -43632,11 +43748,11 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGRenderSupport.h"
+				RelativePath="..\rendering\svg\SVGRenderingContext.h"
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGRenderTreeAsText.cpp"
+				RelativePath="..\rendering\svg\SVGRenderSupport.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -43688,11 +43804,11 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGRenderTreeAsText.h"
+				RelativePath="..\rendering\svg\SVGRenderSupport.h"
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGRenderingContext.cpp"
+				RelativePath="..\rendering\svg\SVGRenderTreeAsText.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -43744,7 +43860,7 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGRenderingContext.h"
+				RelativePath="..\rendering\svg\SVGRenderTreeAsText.h"
 				>
 			</File>
 			<File
@@ -45599,7 +45715,7 @@
 				Name="svg"
 				>
 				<File
-					RelativePath="..\rendering\svg\RenderSVGInline.cpp"
+					RelativePath="..\rendering\svg\RenderSVGEllipse.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -45651,11 +45767,11 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\rendering\svg\RenderSVGInline.h"
+					RelativePath="..\rendering\svg\RenderSVGEllipse.h"
 					>
 				</File>
 				<File
-					RelativePath="..\rendering\svg\RenderSVGInlineText.cpp"
+					RelativePath="..\rendering\svg\RenderSVGInline.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -45707,11 +45823,11 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\rendering\svg\RenderSVGInlineText.h"
+					RelativePath="..\rendering\svg\RenderSVGInline.h"
 					>
 				</File>
 				<File
-					RelativePath="..\rendering\svg\RenderSVGPath.cpp"
+					RelativePath="..\rendering\svg\RenderSVGInlineText.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -45763,11 +45879,11 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\rendering\svg\RenderSVGPath.h"
+					RelativePath="..\rendering\svg\RenderSVGInlineText.h"
 					>
 				</File>
 				<File
-					RelativePath="..\rendering\svg\RenderSVGEllipse.cpp"
+					RelativePath="..\rendering\svg\RenderSVGPath.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -45819,7 +45935,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\rendering\svg\RenderSVGEllipse.h"
+					RelativePath="..\rendering\svg\RenderSVGPath.h"
 					>
 				</File>
 				<File
@@ -53370,62 +53486,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\dom\TreeScopeAdjuster.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\dom\TreeScopeAdjuster.h"
-				>
-			</File>
-			<File
 				RelativePath="..\dom\TreeScopeAdopter.cpp"
 				>
 				<FileConfiguration
@@ -54342,62 +54402,6 @@
 				>
 			</File>
 		</Filter>
-		<File
-				RelativePath="..\editing\AlternativeTextController.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_LTCG|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\editing\AlternativeTextController.h"
-				>
-			</File>
 		<Filter
 			Name="editing"
 			>
@@ -56677,7 +56681,7 @@
 					ExcludedFromBuild="true"
 					>
 					<Tool
-                    Name="VCCLCompilerTool"
+						Name="VCCLCompilerTool"
 					/>
 				</FileConfiguration>
 				<FileConfiguration
@@ -56685,7 +56689,7 @@
 					ExcludedFromBuild="true"
 					>
 					<Tool
-                    Name="VCCLCompilerTool"
+						Name="VCCLCompilerTool"
 					/>
 				</FileConfiguration>
 				<FileConfiguration
@@ -56693,7 +56697,7 @@
 					ExcludedFromBuild="true"
 					>
 					<Tool
-                    Name="VCCLCompilerTool"
+						Name="VCCLCompilerTool"
 					/>
 				</FileConfiguration>
 				<FileConfiguration
@@ -56701,7 +56705,7 @@
 					ExcludedFromBuild="true"
 					>
 					<Tool
-                    Name="VCCLCompilerTool"
+						Name="VCCLCompilerTool"
 					/>
 				</FileConfiguration>
 				<FileConfiguration
@@ -56709,7 +56713,7 @@
 					ExcludedFromBuild="true"
 					>
 					<Tool
-                    Name="VCCLCompilerTool"
+						Name="VCCLCompilerTool"
 					/>
 				</FileConfiguration>
 				<FileConfiguration
@@ -56717,7 +56721,7 @@
 					ExcludedFromBuild="true"
 					>
 					<Tool
-                    Name="VCCLCompilerTool"
+						Name="VCCLCompilerTool"
 					/>
 				</FileConfiguration>
 			</File>
@@ -57232,7 +57236,7 @@
 			<File
 				RelativePath="..\editing\TextInsertionBaseCommand.h"
 				>
-	        </File>
+			</File>
 			<File
 				RelativePath="..\editing\TextIterator.cpp"
 				>
@@ -62661,6 +62665,14 @@
 				Name="shadow"
 				>
 				<File
+					RelativePath="..\html\shadow\ContentDistributor.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\ContentDistributor.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\shadow\ContentSelectorQuery.cpp"
 					>
 				</File>
@@ -62733,14 +62745,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\html\shadow\HTMLContentSelector.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\html\shadow\HTMLContentSelector.h"
-					>
-				</File>
-				<File
 					RelativePath="..\html\shadow\HTMLShadowElement.cpp"
 					>
 					<FileConfiguration
@@ -62981,6 +62985,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\bindings\js\Dictionary.h"
+					>
+				</File>
+				<File
 					RelativePath="..\bindings\js\DOMObjectHashTableMap.cpp"
 					>
 					<FileConfiguration
@@ -69705,10 +69713,6 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\Dictionary.h"
-					>
-				</File>
-				<File
 					RelativePath="..\bindings\js\PageScriptDebugServer.cpp"
 					>
 					<FileConfiguration
@@ -74177,6 +74181,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\CPUProfileView.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\CSSCompletions.js"
 					>
 				</File>
@@ -74217,7 +74225,11 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\DebuggerPresentationModel.js"
+					RelativePath="..\inspector\front-end\DebuggerResourceBinding.js"
+					>
+				</File>
+				<File
+					RelativePath="..\inspector\front-end\DebuggerScriptMapping.js"
 					>
 				</File>
 				<File
@@ -74301,11 +74313,11 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\filteredItemSelectionDialog.css"
+					RelativePath="..\inspector\front-end\FileManager.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\FileManager.js"
+					RelativePath="..\inspector\front-end\filteredItemSelectionDialog.css"
 					>
 				</File>
 				<File
@@ -74433,11 +74445,11 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\UglifyJS\JavaScriptFormatter.js"
+					RelativePath="..\inspector\front-end\JavaScriptFormatter.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\JavaScriptFormatter.js"
+					RelativePath="..\inspector\front-end\UglifyJS\JavaScriptFormatter.js"
 					>
 				</File>
 				<File
@@ -74465,19 +74477,19 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\NavigatorView.js"
+					RelativePath="..\inspector\front-end\navigatorView.css"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\NetworkItemView.js"
+					RelativePath="..\inspector\front-end\NavigatorView.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\NetworkLog.js"
+					RelativePath="..\inspector\front-end\NetworkItemView.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\navigatorView.css"
+					RelativePath="..\inspector\front-end\NetworkLog.js"
 					>
 				</File>
 				<File
@@ -74541,19 +74553,19 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ProfileDataGridTree.js"
+					RelativePath="..\inspector\front-end\PresentationConsoleMessageHelper.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ProfileLauncherView.js"
+					RelativePath="..\inspector\front-end\ProfileDataGridTree.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ProfilesPanel.js"
+					RelativePath="..\inspector\front-end\ProfileLauncherView.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ProfileView.js"
+					RelativePath="..\inspector\front-end\ProfilesPanel.js"
 					>
 				</File>
 				<File
@@ -74609,15 +74621,15 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\resourcesPanel.css"
+					RelativePath="..\inspector\front-end\ResourceScriptMapping.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ResourcesPanel.js"
+					RelativePath="..\inspector\front-end\resourcesPanel.css"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ResourceScriptMapping.js"
+					RelativePath="..\inspector\front-end\ResourcesPanel.js"
 					>
 				</File>
 				<File
@@ -74661,11 +74673,11 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ScriptMapping.js"
+					RelativePath="..\inspector\front-end\ScriptsNavigator.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\ScriptsNavigator.js"
+					RelativePath="..\inspector\front-end\ScriptSnippetModel.js"
 					>
 				</File>
 				<File
@@ -74717,7 +74729,7 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\SnippetsModel.js"
+					RelativePath="..\inspector\front-end\SnippetStorage.js"
 					>
 				</File>
 				<File
@@ -74741,6 +74753,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\SourceMapping.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\SourceTokenizer.js"
 					>
 				</File>
@@ -74813,11 +74829,11 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TimelineGrid.js"
+					RelativePath="..\inspector\front-end\TimelineFrameController.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TimelineFrameController.js"
+					RelativePath="..\inspector\front-end\TimelineGrid.js"
 					>
 				</File>
 				<File
@@ -75027,6 +75043,62 @@
 			</File>
 		</Filter>
 		<File
+			RelativePath="..\editing\AlternativeTextController.cpp"
+			>
+			<FileConfiguration
+				Name="Debug|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+			<FileConfiguration
+				Name="Release|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+			<FileConfiguration
+				Name="Debug_Cairo_CFLite|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+			<FileConfiguration
+				Name="Release_Cairo_CFLite|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+			<FileConfiguration
+				Name="Debug_All|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+			<FileConfiguration
+				Name="Release_LTCG|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+		</File>
+		<File
+			RelativePath="..\editing\AlternativeTextController.h"
+			>
+		</File>
+		<File
 			RelativePath="..\config.h"
 			>
 		</File>
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 85c84a707..91f0c70e3 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -723,6 +723,9 @@
 		293EAE1F1356B2FE0067ACF9 /* RuntimeApplicationChecks.h in Headers */ = {isa = PBXBuildFile; fileRef = 293EAE1E1356B2FE0067ACF9 /* RuntimeApplicationChecks.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		293EAE211356B32E0067ACF9 /* RuntimeApplicationChecks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 293EAE201356B32E0067ACF9 /* RuntimeApplicationChecks.cpp */; };
 		29489FC712C00F0300D83F0F /* AccessibilityScrollView.h in Headers */ = {isa = PBXBuildFile; fileRef = 29489FC512C00F0300D83F0F /* AccessibilityScrollView.h */; };
+		29A309AC1561C99B00BBD8E5 /* RunLoopCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A309AB1561C99B00BBD8E5 /* RunLoopCF.cpp */; };
+		29A309B01561CAC400BBD8E5 /* VisitedLinks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A309AE1561CAC400BBD8E5 /* VisitedLinks.cpp */; };
+		29A309B11561CAC400BBD8E5 /* VisitedLinks.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A309AF1561CAC400BBD8E5 /* VisitedLinks.h */; };
 		29A8122B0FBB9C1D00510293 /* AccessibilityTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */; };
 		29A8122C0FBB9C1D00510293 /* AccessibilityList.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8120E0FBB9C1D00510293 /* AccessibilityList.h */; };
 		29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812100FBB9C1D00510293 /* AccessibilityARIAGridCell.h */; };
@@ -1317,7 +1320,6 @@
 		49E912AC0EFAC906009D0CAF /* AnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49E912A70EFAC906009D0CAF /* AnimationList.cpp */; };
 		49E912AD0EFAC906009D0CAF /* AnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A80EFAC906009D0CAF /* AnimationList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49E912AE0EFAC906009D0CAF /* TimingFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A90EFAC906009D0CAF /* TimingFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		49ECEB671499790D00CDD3A4 /* FECompositeArithmeticNEON.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49ECEB5D1499790D00CDD3A4 /* FECompositeArithmeticNEON.cpp */; };
 		49ECEB681499790D00CDD3A4 /* FECompositeArithmeticNEON.h in Headers */ = {isa = PBXBuildFile; fileRef = 49ECEB5E1499790D00CDD3A4 /* FECompositeArithmeticNEON.h */; };
 		49ECEB691499790D00CDD3A4 /* FEGaussianBlurNEON.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49ECEB5F1499790D00CDD3A4 /* FEGaussianBlurNEON.cpp */; };
 		49ECEB6A1499790D00CDD3A4 /* FEGaussianBlurNEON.h in Headers */ = {isa = PBXBuildFile; fileRef = 49ECEB601499790D00CDD3A4 /* FEGaussianBlurNEON.h */; };
@@ -1580,12 +1582,10 @@
 		550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 550A0BC7085F6039007353D6 /* QualifiedName.cpp */; };
 		550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */ = {isa = PBXBuildFile; fileRef = 550A0BC8085F6039007353D6 /* QualifiedName.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		573D134714CE39FF0057ABCA /* InspectorTypeBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */; };
-		5740E83C1532DE1700760628 /* TreeScopeAdjuster.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5740E83A1532DE1700760628 /* TreeScopeAdjuster.cpp */; };
-		5740E83D1532DE1700760628 /* TreeScopeAdjuster.h in Headers */ = {isa = PBXBuildFile; fileRef = 5740E83B1532DE1700760628 /* TreeScopeAdjuster.h */; };
 		578DA20E1520EB8C006141C1 /* InspectorFrontend.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F4F5FFC11CBD30100A186BF /* InspectorFrontend.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		578DA20F1520EBA3006141C1 /* InspectorTypeBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		57B791A314C6A62900F202D1 /* HTMLContentSelector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */; };
-		57B791A414C6A62900F202D1 /* HTMLContentSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A014C6A62900F202D1 /* HTMLContentSelector.h */; };
+		57B791A314C6A62900F202D1 /* ContentDistributor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B7919F14C6A62900F202D1 /* ContentDistributor.cpp */; };
+		57B791A414C6A62900F202D1 /* ContentDistributor.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A014C6A62900F202D1 /* ContentDistributor.h */; };
 		57B791A514C6A62900F202D1 /* ContentSelectorQuery.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B791A114C6A62900F202D1 /* ContentSelectorQuery.cpp */; };
 		57B791A614C6A62900F202D1 /* ContentSelectorQuery.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A214C6A62900F202D1 /* ContentSelectorQuery.h */; };
 		57B791A914C6A63300F202D1 /* HTMLContentElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B791A714C6A63300F202D1 /* HTMLContentElement.cpp */; };
@@ -3604,6 +3604,11 @@
 		97F8E666151D4A4E00D2D181 /* WorkerContextNotifications.h in Headers */ = {isa = PBXBuildFile; fileRef = 97F8E662151D4A3F00D2D181 /* WorkerContextNotifications.h */; };
 		9831AE4A154225C900FE2644 /* ReferrerPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = 9831AE49154225A200FE2644 /* ReferrerPolicy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		984264F112D5280A000D88A4 /* LinkLoaderClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 984264EF12D5280A000D88A4 /* LinkLoaderClient.h */; };
+		9856F8CC1549E82400B04F3A /* Prerenderer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9856F8C81549E82400B04F3A /* Prerenderer.cpp */; };
+		9856F8CD1549E82400B04F3A /* Prerenderer.h in Headers */ = {isa = PBXBuildFile; fileRef = 9856F8C91549E82400B04F3A /* Prerenderer.h */; };
+		9856F8CE1549E82400B04F3A /* PrerendererClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9856F8CA1549E82400B04F3A /* PrerendererClient.cpp */; };
+		9856F8CF1549E82400B04F3A /* PrerendererClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 9856F8CB1549E82400B04F3A /* PrerendererClient.h */; };
+		9856F8D11549E84F00B04F3A /* PrerenderHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 9856F8D01549E84F00B04F3A /* PrerenderHandle.h */; };
 		985BB96D13A94058007A0B69 /* LinkRelAttribute.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 985BB96B13A94058007A0B69 /* LinkRelAttribute.cpp */; };
 		985BB96E13A94058007A0B69 /* LinkRelAttribute.h in Headers */ = {isa = PBXBuildFile; fileRef = 985BB96C13A94058007A0B69 /* LinkRelAttribute.h */; };
 		98CE4326129E00BD005821DC /* LinkLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 98CE4325129E00BD005821DC /* LinkLoader.cpp */; };
@@ -3829,7 +3834,6 @@
 		A80E6DFB0A199067007FB8C5 /* StylePropertySet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6DF90A199067007FB8C5 /* StylePropertySet.cpp */; };
 		A80E6DFC0A199067007FB8C5 /* StylePropertySet.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6DFA0A199067007FB8C5 /* StylePropertySet.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A80E6E0F0A19911C007FB8C5 /* CSSStyleDeclaration.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6E0D0A19911C007FB8C5 /* CSSStyleDeclaration.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A80E6E100A19911C007FB8C5 /* CSSStyleDeclaration.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6E0E0A19911C007FB8C5 /* CSSStyleDeclaration.cpp */; };
 		A80E734E0A199C77007FB8C5 /* CSSNamespace.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E73470A199C77007FB8C5 /* CSSNamespace.h */; };
 		A80E734F0A199C77007FB8C5 /* CSSSelector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E73480A199C77007FB8C5 /* CSSSelector.cpp */; };
 		A80E73520A199C77007FB8C5 /* CSSSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E734B0A199C77007FB8C5 /* CSSSelector.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -6367,6 +6371,8 @@
 		FDA3E95C134A49EF008D4B5A /* OfflineAudioDestinationNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FDA3E958134A49EF008D4B5A /* OfflineAudioDestinationNode.h */; };
 		FDAF19981513D131008DB0C3 /* DirectConvolver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDAF19961513D131008DB0C3 /* DirectConvolver.cpp */; };
 		FDAF19991513D131008DB0C3 /* DirectConvolver.h in Headers */ = {isa = PBXBuildFile; fileRef = FDAF19971513D131008DB0C3 /* DirectConvolver.h */; };
+		FDB052DF1561A42C00B500D6 /* AudioSummingJunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDB052DD1561A42C00B500D6 /* AudioSummingJunction.cpp */; };
+		FDB052E01561A42C00B500D6 /* AudioSummingJunction.h in Headers */ = {isa = PBXBuildFile; fileRef = FDB052DE1561A42C00B500D6 /* AudioSummingJunction.h */; };
 		FDB1700514A2BAB200A2B5D9 /* MultiChannelResampler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDB1700314A2BAB200A2B5D9 /* MultiChannelResampler.cpp */; };
 		FDB1700614A2BAB200A2B5D9 /* MultiChannelResampler.h in Headers */ = {isa = PBXBuildFile; fileRef = FDB1700414A2BAB200A2B5D9 /* MultiChannelResampler.h */; };
 		FDC54F041399B0DA008D9117 /* BiquadFilterNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDC54F011399B0DA008D9117 /* BiquadFilterNode.cpp */; };
@@ -7650,6 +7656,9 @@
 		2981CAAD131822EC00D12F2A /* AccessibilityTableHeaderContainer.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableHeaderContainer.cpp; sourceTree = "<group>"; };
 		2981CAAE131822EC00D12F2A /* AccessibilityTableRow.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityTableRow.cpp; sourceTree = "<group>"; };
 		2981CAAF131822EC00D12F2A /* AXObjectCache.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = AXObjectCache.cpp; sourceTree = "<group>"; };
+		29A309AB1561C99B00BBD8E5 /* RunLoopCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RunLoopCF.cpp; sourceTree = "<group>"; };
+		29A309AE1561CAC400BBD8E5 /* VisitedLinks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VisitedLinks.cpp; sourceTree = "<group>"; };
+		29A309AF1561CAC400BBD8E5 /* VisitedLinks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VisitedLinks.h; sourceTree = "<group>"; };
 		29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityTable.h; sourceTree = "<group>"; };
 		29A8120E0FBB9C1D00510293 /* AccessibilityList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityList.h; sourceTree = "<group>"; };
 		29A812100FBB9C1D00510293 /* AccessibilityARIAGridCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityARIAGridCell.h; sourceTree = "<group>"; };
@@ -8313,7 +8322,6 @@
 		49E912A70EFAC906009D0CAF /* AnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AnimationList.cpp; path = animation/AnimationList.cpp; sourceTree = "<group>"; };
 		49E912A80EFAC906009D0CAF /* AnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationList.h; path = animation/AnimationList.h; sourceTree = "<group>"; };
 		49E912A90EFAC906009D0CAF /* TimingFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TimingFunction.h; path = animation/TimingFunction.h; sourceTree = "<group>"; };
-		49ECEB5D1499790D00CDD3A4 /* FECompositeArithmeticNEON.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FECompositeArithmeticNEON.cpp; sourceTree = "<group>"; };
 		49ECEB5E1499790D00CDD3A4 /* FECompositeArithmeticNEON.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FECompositeArithmeticNEON.h; sourceTree = "<group>"; };
 		49ECEB5F1499790D00CDD3A4 /* FEGaussianBlurNEON.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FEGaussianBlurNEON.cpp; sourceTree = "<group>"; };
 		49ECEB601499790D00CDD3A4 /* FEGaussianBlurNEON.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FEGaussianBlurNEON.h; sourceTree = "<group>"; };
@@ -8599,10 +8607,8 @@
 		550A0BC8085F6039007353D6 /* QualifiedName.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = QualifiedName.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTypeBuilder.cpp; sourceTree = "<group>"; };
 		573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTypeBuilder.h; sourceTree = "<group>"; };
-		5740E83A1532DE1700760628 /* TreeScopeAdjuster.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TreeScopeAdjuster.cpp; sourceTree = "<group>"; };
-		5740E83B1532DE1700760628 /* TreeScopeAdjuster.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TreeScopeAdjuster.h; sourceTree = "<group>"; };
-		57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLContentSelector.cpp; sourceTree = "<group>"; };
-		57B791A014C6A62900F202D1 /* HTMLContentSelector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLContentSelector.h; sourceTree = "<group>"; };
+		57B7919F14C6A62900F202D1 /* ContentDistributor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentDistributor.cpp; sourceTree = "<group>"; };
+		57B791A014C6A62900F202D1 /* ContentDistributor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentDistributor.h; sourceTree = "<group>"; };
 		57B791A114C6A62900F202D1 /* ContentSelectorQuery.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSelectorQuery.cpp; sourceTree = "<group>"; };
 		57B791A214C6A62900F202D1 /* ContentSelectorQuery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSelectorQuery.h; sourceTree = "<group>"; };
 		57B791A714C6A63300F202D1 /* HTMLContentElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLContentElement.cpp; sourceTree = "<group>"; };
@@ -10653,6 +10659,11 @@
 		97F8E663151D4A3F00D2D181 /* WorkerContextNotifications.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WorkerContextNotifications.idl; path = notifications/WorkerContextNotifications.idl; sourceTree = "<group>"; };
 		9831AE49154225A200FE2644 /* ReferrerPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReferrerPolicy.h; sourceTree = "<group>"; };
 		984264EF12D5280A000D88A4 /* LinkLoaderClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LinkLoaderClient.h; sourceTree = "<group>"; };
+		9856F8C81549E82400B04F3A /* Prerenderer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Prerenderer.cpp; path = loader/Prerenderer.cpp; sourceTree = SOURCE_ROOT; };
+		9856F8C91549E82400B04F3A /* Prerenderer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Prerenderer.h; path = loader/Prerenderer.h; sourceTree = SOURCE_ROOT; };
+		9856F8CA1549E82400B04F3A /* PrerendererClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = PrerendererClient.cpp; path = loader/PrerendererClient.cpp; sourceTree = SOURCE_ROOT; };
+		9856F8CB1549E82400B04F3A /* PrerendererClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PrerendererClient.h; path = loader/PrerendererClient.h; sourceTree = SOURCE_ROOT; };
+		9856F8D01549E84F00B04F3A /* PrerenderHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrerenderHandle.h; sourceTree = "<group>"; };
 		985BB96B13A94058007A0B69 /* LinkRelAttribute.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LinkRelAttribute.cpp; sourceTree = "<group>"; };
 		985BB96C13A94058007A0B69 /* LinkRelAttribute.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LinkRelAttribute.h; sourceTree = "<group>"; };
 		98CE4325129E00BD005821DC /* LinkLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LinkLoader.cpp; sourceTree = "<group>"; };
@@ -10895,7 +10906,6 @@
 		A80E6DF90A199067007FB8C5 /* StylePropertySet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = StylePropertySet.cpp; sourceTree = "<group>"; };
 		A80E6DFA0A199067007FB8C5 /* StylePropertySet.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = StylePropertySet.h; sourceTree = "<group>"; };
 		A80E6E0D0A19911C007FB8C5 /* CSSStyleDeclaration.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSStyleDeclaration.h; sourceTree = "<group>"; };
-		A80E6E0E0A19911C007FB8C5 /* CSSStyleDeclaration.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSStyleDeclaration.cpp; sourceTree = "<group>"; };
 		A80E73470A199C77007FB8C5 /* CSSNamespace.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSNamespace.h; sourceTree = "<group>"; };
 		A80E73480A199C77007FB8C5 /* CSSSelector.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSSelector.cpp; sourceTree = "<group>"; };
 		A80E734B0A199C77007FB8C5 /* CSSSelector.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSSelector.h; sourceTree = "<group>"; };
@@ -13612,6 +13622,8 @@
 		FDA3E95D134A49FF008D4B5A /* OfflineAudioCompletionEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = OfflineAudioCompletionEvent.idl; sourceTree = "<group>"; };
 		FDAF19961513D131008DB0C3 /* DirectConvolver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DirectConvolver.cpp; sourceTree = "<group>"; };
 		FDAF19971513D131008DB0C3 /* DirectConvolver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DirectConvolver.h; sourceTree = "<group>"; };
+		FDB052DD1561A42C00B500D6 /* AudioSummingJunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AudioSummingJunction.cpp; sourceTree = "<group>"; };
+		FDB052DE1561A42C00B500D6 /* AudioSummingJunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AudioSummingJunction.h; sourceTree = "<group>"; };
 		FDB1700314A2BAB200A2B5D9 /* MultiChannelResampler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MultiChannelResampler.cpp; sourceTree = "<group>"; };
 		FDB1700414A2BAB200A2B5D9 /* MultiChannelResampler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MultiChannelResampler.h; sourceTree = "<group>"; };
 		FDC54F011399B0DA008D9117 /* BiquadFilterNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BiquadFilterNode.cpp; sourceTree = "<group>"; };
@@ -14136,6 +14148,10 @@
 				1A8F6BB40DB55CDC001DB794 /* ApplicationCacheGroup.h */,
 				24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */,
 				24F54EAB101FE914000AE741 /* ApplicationCacheHost.h */,
+				9856F8C81549E82400B04F3A /* Prerenderer.cpp */,
+				9856F8C91549E82400B04F3A /* Prerenderer.h */,
+				9856F8CA1549E82400B04F3A /* PrerendererClient.cpp */,
+				9856F8CB1549E82400B04F3A /* PrerendererClient.h */,
 				1A8F6BB50DB55CDC001DB794 /* ApplicationCacheResource.cpp */,
 				1A8F6BB60DB55CDC001DB794 /* ApplicationCacheResource.h */,
 				1A2AAC560DC2A3B100A20D9A /* ApplicationCacheStorage.cpp */,
@@ -14165,6 +14181,7 @@
 				938192040F87E1EC00D5352A /* BinaryPropertyList.h */,
 				5160306B0CC4362300C8AC25 /* FileSystemCF.cpp */,
 				1A98956A0AA78F80005EF5EF /* KURLCFNet.cpp */,
+				29A309AB1561C99B00BBD8E5 /* RunLoopCF.cpp */,
 				1C63A2470F71646600C09D5A /* RunLoopTimerCF.cpp */,
 				1CEFC9B80D78DC8C007D2579 /* SchedulePair.cpp */,
 				1CEFC9B70D78DC8C007D2579 /* SchedulePair.h */,
@@ -14617,6 +14634,8 @@
 		4150F9ED12B6E0990008C860 /* shadow */ = {
 			isa = PBXGroup;
 			children = (
+				57B7919F14C6A62900F202D1 /* ContentDistributor.cpp */,
+				57B791A014C6A62900F202D1 /* ContentDistributor.h */,
 				57B791A114C6A62900F202D1 /* ContentSelectorQuery.cpp */,
 				57B791A214C6A62900F202D1 /* ContentSelectorQuery.h */,
 				A7C9ABF61357A3BF00F5503F /* DetailsMarkerControl.cpp */,
@@ -14624,8 +14643,6 @@
 				57B791A714C6A63300F202D1 /* HTMLContentElement.cpp */,
 				57B791A814C6A63300F202D1 /* HTMLContentElement.h */,
 				A7B7749614CF6353004044BB /* HTMLContentElement.idl */,
-				57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */,
-				57B791A014C6A62900F202D1 /* HTMLContentSelector.h */,
 				4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */,
 				4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */,
 				4ABDFF0914DBE312004D117D /* HTMLShadowElement.idl */,
@@ -14926,6 +14943,7 @@
 				49E912A50EFAC906009D0CAF /* Animation.cpp */,
 				49E912A60EFAC906009D0CAF /* Animation.h */,
 				49E912A70EFAC906009D0CAF /* AnimationList.cpp */,
+				9856F8D01549E84F00B04F3A /* PrerenderHandle.h */,
 				49E912A80EFAC906009D0CAF /* AnimationList.h */,
 				0F580FAE149800D400FB5BD8 /* AnimationUtilities.h */,
 				49E912A90EFAC906009D0CAF /* TimingFunction.h */,
@@ -14936,7 +14954,6 @@
 		49ECEB5C1499790D00CDD3A4 /* arm */ = {
 			isa = PBXGroup;
 			children = (
-				49ECEB5D1499790D00CDD3A4 /* FECompositeArithmeticNEON.cpp */,
 				49ECEB5E1499790D00CDD3A4 /* FECompositeArithmeticNEON.h */,
 				49ECEB5F1499790D00CDD3A4 /* FEGaussianBlurNEON.cpp */,
 				49ECEB601499790D00CDD3A4 /* FEGaussianBlurNEON.h */,
@@ -20395,6 +20412,8 @@
 				2E3BBF051162DA1100B9409A /* UUID.cpp */,
 				2E3BBF061162DA1100B9409A /* UUID.h */,
 				515788C01207852C00A37C4A /* VisitedLinkStrategy.h */,
+				29A309AE1561CAC400BBD8E5 /* VisitedLinks.cpp */,
+				29A309AF1561CAC400BBD8E5 /* VisitedLinks.h */,
 				9380F47109A11AB4001FDB34 /* Widget.cpp */,
 				9380F47209A11AB4001FDB34 /* Widget.h */,
 				E1E1BEFF115FF6FB006F52CA /* WindowsKeyboardCodes.h */,
@@ -21328,8 +21347,6 @@
 				37FD4297118368460093C029 /* TreeDepthLimit.h */,
 				14D64B5A134A5B6B00E58FDA /* TreeScope.cpp */,
 				14D64B5B134A5B6B00E58FDA /* TreeScope.h */,
-				5740E83A1532DE1700760628 /* TreeScopeAdjuster.cpp */,
-				5740E83B1532DE1700760628 /* TreeScopeAdjuster.h */,
 				A77E1FED14AACB6E005B7CB6 /* TreeScopeAdopter.cpp */,
 				A77E1FEE14AACB6E005B7CB6 /* TreeScopeAdopter.h */,
 				854FE72E0A2297BE0058D7AD /* TreeWalker.cpp */,
@@ -21454,6 +21471,8 @@
 				FD315FD712B0267600C1A359 /* AudioProcessingEvent.idl */,
 				FD8C46E9154608E700A5910C /* AudioScheduledSourceNode.cpp */,
 				FD8C46EA154608E700A5910C /* AudioScheduledSourceNode.h */,
+				FDB052DD1561A42C00B500D6 /* AudioSummingJunction.cpp */,
+				FDB052DE1561A42C00B500D6 /* AudioSummingJunction.h */,
 				FD315FD812B0267600C1A359 /* AudioSourceNode.h */,
 				FD315FD912B0267600C1A359 /* AudioSourceNode.idl */,
 				FD315FDA12B0267600C1A359 /* BiquadDSPKernel.cpp */,
@@ -21898,6 +21917,7 @@
 				A818721C0977D3C0005826D9 /* ContainerNode.h in Headers */,
 				E1A1470811102B1500EEC0F3 /* ContainerNodeAlgorithms.h in Headers */,
 				BC5EB9810E82072500B25965 /* ContentData.h in Headers */,
+				57B791A414C6A62900F202D1 /* ContentDistributor.h in Headers */,
 				59102FBC14327D3B003C9D04 /* ContentSearchUtils.h in Headers */,
 				97C471DC12F925BD0086354B /* ContentSecurityPolicy.h in Headers */,
 				57B791A614C6A62900F202D1 /* ContentSelectorQuery.h in Headers */,
@@ -22939,7 +22959,6 @@
 				A8DF3FD0097FA0FC0052981B /* HTMLCollection.h in Headers */,
 				977B3865122883E900B81FF8 /* HTMLConstructionSite.h in Headers */,
 				57B791AA14C6A63300F202D1 /* HTMLContentElement.h in Headers */,
-				57B791A414C6A62900F202D1 /* HTMLContentSelector.h in Headers */,
 				E1A31663134BCAE8007C9A4F /* HTMLConverter.h in Headers */,
 				F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */,
 				D359D78A129CA2710006E5D2 /* HTMLDetailsElement.h in Headers */,
@@ -24686,7 +24705,6 @@
 				854FE7370A2297BE0058D7AD /* Traversal.h in Headers */,
 				37FD4298118368460093C029 /* TreeDepthLimit.h in Headers */,
 				14D64B5D134A5B6B00E58FDA /* TreeScope.h in Headers */,
-				5740E83D1532DE1700760628 /* TreeScopeAdjuster.h in Headers */,
 				A77E1FF014AACB6E005B7CB6 /* TreeScopeAdopter.h in Headers */,
 				1419D2C50CEA6F6100FF507A /* TreeShared.h in Headers */,
 				854FE7390A2297BE0058D7AD /* TreeWalker.h in Headers */,
@@ -24876,6 +24894,9 @@
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */,
 				FD537353137B651800008DCE /* ZeroPole.h in Headers */,
+				9856F8CD1549E82400B04F3A /* Prerenderer.h in Headers */,
+				9856F8CF1549E82400B04F3A /* PrerendererClient.h in Headers */,
+				9856F8D11549E84F00B04F3A /* PrerenderHandle.h in Headers */,
 				FD8C46EC154608E700A5910C /* AudioScheduledSourceNode.h in Headers */,
 				71A57DF2154BE25C0009D120 /* SVGPathUtilities.h in Headers */,
 				78D02BC6154A18DF00B62D05 /* CSSPropertyAnimation.h in Headers */,
@@ -24884,6 +24905,8 @@
 				31FE6DFA15004C2A0004EBC4 /* NotificationPermissionCallback.h in Headers */,
 				B658FFA21522EF3A00DD5595 /* JSRadioNodeList.h in Headers */,
 				B658FFA61522EFAA00DD5595 /* RadioNodeList.h in Headers */,
+				29A309B11561CAC400BBD8E5 /* VisitedLinks.h in Headers */,
+				FDB052E01561A42C00B500D6 /* AudioSummingJunction.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -25404,6 +25427,7 @@
 				A818721F0977D3C0005826D9 /* ContainerNode.cpp in Sources */,
 				A7A78CD51532BA62006C21E4 /* ContainerNodeAlgorithms.cpp in Sources */,
 				BC5EB9800E82072500B25965 /* ContentData.cpp in Sources */,
+				57B791A314C6A62900F202D1 /* ContentDistributor.cpp in Sources */,
 				59102FBB14327D3B003C9D04 /* ContentSearchUtils.cpp in Sources */,
 				97C471DB12F925BD0086354B /* ContentSecurityPolicy.cpp in Sources */,
 				57B791A514C6A62900F202D1 /* ContentSelectorQuery.cpp in Sources */,
@@ -25924,7 +25948,6 @@
 				A75E8B8A0E1DE2D6007F2481 /* FEColorMatrix.cpp in Sources */,
 				A75E8B8C0E1DE2D6007F2481 /* FEComponentTransfer.cpp in Sources */,
 				A75E8B8E0E1DE2D6007F2481 /* FEComposite.cpp in Sources */,
-				49ECEB671499790D00CDD3A4 /* FECompositeArithmeticNEON.cpp in Sources */,
 				84730D781248F0B300D3A9C9 /* FEConvolveMatrix.cpp in Sources */,
 				50D403C714768C9400D30BB5 /* FECustomFilter.cpp in Sources */,
 				84730D7A1248F0B300D3A9C9 /* FEDiffuseLighting.cpp in Sources */,
@@ -26074,7 +26097,6 @@
 				A8DF3FD1097FA0FC0052981B /* HTMLCollection.cpp in Sources */,
 				977B3864122883E900B81FF8 /* HTMLConstructionSite.cpp in Sources */,
 				57B791A914C6A63300F202D1 /* HTMLContentElement.cpp in Sources */,
-				57B791A314C6A62900F202D1 /* HTMLContentSelector.cpp in Sources */,
 				5D4F51DF132725480016F541 /* HTMLConverter.mm in Sources */,
 				F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */,
 				D359D789129CA2710006E5D2 /* HTMLDetailsElement.cpp in Sources */,
@@ -27736,7 +27758,6 @@
 				49E911D10EF86D47009D0CAF /* TranslateTransformOperation.cpp in Sources */,
 				854FE7360A2297BE0058D7AD /* Traversal.cpp in Sources */,
 				14D64B5C134A5B6B00E58FDA /* TreeScope.cpp in Sources */,
-				5740E83C1532DE1700760628 /* TreeScopeAdjuster.cpp in Sources */,
 				A77E1FEF14AACB6E005B7CB6 /* TreeScopeAdopter.cpp in Sources */,
 				854FE7380A2297BE0058D7AD /* TreeWalker.cpp in Sources */,
 				93309E19099E64920056E581 /* TypingCommand.cpp in Sources */,
@@ -27897,6 +27918,8 @@
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSAuditor.cpp in Sources */,
 				FD537352137B651800008DCE /* ZeroPole.cpp in Sources */,
+				9856F8CC1549E82400B04F3A /* Prerenderer.cpp in Sources */,
+				9856F8CE1549E82400B04F3A /* PrerendererClient.cpp in Sources */,
 				FD8C46EB154608E700A5910C /* AudioScheduledSourceNode.cpp in Sources */,
 				71A57DF1154BE25C0009D120 /* SVGPathUtilities.cpp in Sources */,
 				78D02BC5154A18DF00B62D05 /* CSSPropertyAnimation.cpp in Sources */,
@@ -27905,6 +27928,9 @@
 				31FE6E6D1501A3BF0004EBC4 /* JSNotificationCustom.cpp in Sources */,
 				B658FFA11522EF3A00DD5595 /* JSRadioNodeList.cpp in Sources */,
 				B658FFA51522EFAA00DD5595 /* RadioNodeList.cpp in Sources */,
+				29A309AC1561C99B00BBD8E5 /* RunLoopCF.cpp in Sources */,
+				29A309B01561CAC400BBD8E5 /* VisitedLinks.cpp in Sources */,
+				FDB052DF1561A42C00B500D6 /* AudioSummingJunction.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/bindings/gobject/GNUmakefile.am b/Source/WebCore/bindings/gobject/GNUmakefile.am
index a806be67b..c7025286d 100644
--- a/Source/WebCore/bindings/gobject/GNUmakefile.am
+++ b/Source/WebCore/bindings/gobject/GNUmakefile.am
@@ -469,6 +469,6 @@ $(top_builddir)/DerivedSources/webkit/WebKitDOMCustom.h: $(WebCore)/bindings/gob
 	$(AM_V_GEN)cp -f $< $@
 
 # Filter out SVG and IndexedDB for now
-gdom_feature_defines := $(filter-out ENABLE_INDEXED_DATABASE=1, $(filter-out ENABLE_SVG%, $(FEATURE_DEFINES)))
+gdom_feature_defines := $(filter-out ENABLE_INDEXED_DATABASE=1, $(filter-out ENABLE_SVG%, $(FEATURE_DEFINES))) ENABLE_INDEXED_DATABASE=0
 DerivedSources/webkit/WebKitDOM%.cpp DerivedSources/webkit/WebKitDOM%.h DerivedSources/webkit/WebKitDOM%Private.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorGObject.pm $(WebCore)/bindings/gobject/GNUmakefile.am $(supplemental_dependency_file)
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl --include $(WebCore)/dom --include $(WebCore)/html --include $(WebCore)/css --include $(WebCore)/page --include $(WebCore)/xml --include $(WebCore)/svg --outputDir "$(GENSOURCES_WEBKIT)" --defines "LANGUAGE_GOBJECT=1 $(gdom_feature_defines)" --generator GObject --supplementalDependencyFile $(supplemental_dependency_file) $<
diff --git a/Source/WebCore/bindings/js/Dictionary.cpp b/Source/WebCore/bindings/js/Dictionary.cpp
index 2c1b785fe..81b345d48 100644
--- a/Source/WebCore/bindings/js/Dictionary.cpp
+++ b/Source/WebCore/bindings/js/Dictionary.cpp
@@ -35,6 +35,11 @@ using namespace JSC;
 
 namespace WebCore {
 
+Dictionary::Dictionary()
+    : m_dictionary(0, 0)
+{
+}
+
 Dictionary::Dictionary(JSC::ExecState* exec, JSC::JSValue value)
     : m_dictionary(exec, value.isObject() ? value.getObject() : 0)
 {
@@ -49,5 +54,30 @@ JSObject* Dictionary::asJSObject<Notification>(Notification* object) const
 }
 #endif
 
+bool Dictionary::getOwnPropertiesAsStringHashMap(WTF::HashMap<String, String>& map) const
+{
+    if (!m_dictionary.isValid())
+        return false;
+
+    JSObject* object =  m_dictionary.initializerObject();
+    ExecState* exec = m_dictionary.execState();
+
+    PropertyNameArray propertyNames(exec);
+    JSObject::getOwnPropertyNames(object, exec, propertyNames, ExcludeDontEnumProperties);
+    for (PropertyNameArray::const_iterator it = propertyNames.begin(); it != propertyNames.end(); it++) {
+        String stringKey = ustringToString(it->ustring());
+        if (stringKey.isEmpty())
+            continue;
+        JSValue value = object->get(exec, *it);
+        if (exec->hadException())
+            continue;
+        String stringValue = ustringToString(value.toString(exec)->value(exec));
+        if (!exec->hadException())
+            map.set(stringKey, stringValue);
+    }
+
+    return true;
+}
+
 };
 
diff --git a/Source/WebCore/bindings/js/Dictionary.h b/Source/WebCore/bindings/js/Dictionary.h
index d41cb1705..ccceee706 100644
--- a/Source/WebCore/bindings/js/Dictionary.h
+++ b/Source/WebCore/bindings/js/Dictionary.h
@@ -31,6 +31,7 @@
 #include "JSEventListener.h"
 #include "NotImplemented.h"
 #include "ScriptValue.h"
+#include <wtf/HashMap.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
@@ -43,6 +44,7 @@ class EventListener;
 
 class Dictionary {
 public:
+    Dictionary();
     Dictionary(JSC::ExecState*, JSC::JSValue);
 
     // Returns true if a value was found for the provided property.
@@ -58,6 +60,7 @@ public:
 
     bool isObject() const { return m_dictionary.isValid(); }
     bool isUndefinedOrNull() const { return !m_dictionary.isValid(); }
+    bool getOwnPropertiesAsStringHashMap(WTF::HashMap<String, String>&) const;
     bool getWithUndefinedOrNullCheck(const String&, String&) const { notImplemented(); return false; }
 
 private:
diff --git a/Source/WebCore/bindings/js/GCController.cpp b/Source/WebCore/bindings/js/GCController.cpp
index a137c3a03..2e304cb85 100644
--- a/Source/WebCore/bindings/js/GCController.cpp
+++ b/Source/WebCore/bindings/js/GCController.cpp
@@ -97,6 +97,11 @@ void GCController::garbageCollectOnAlternateThreadForDebugging(bool waitUntilDon
     detachThread(threadID);
 }
 
+void GCController::setJavaScriptGarbageCollectorTimerEnabled(bool enable)
+{
+    JSDOMWindow::commonJSGlobalData()->heap.setGarbageCollectionTimerEnabled(enable);
+}
+
 void GCController::discardAllCompiledCode()
 {
     JSLock lock(SilenceAssertionsOnly);
diff --git a/Source/WebCore/bindings/js/GCController.h b/Source/WebCore/bindings/js/GCController.h
index a36737880..40c8a7da9 100644
--- a/Source/WebCore/bindings/js/GCController.h
+++ b/Source/WebCore/bindings/js/GCController.h
@@ -44,7 +44,7 @@ namespace WebCore {
         void garbageCollectNow(); // It's better to call garbageCollectSoon, unless you have a specific reason not to.
 
         void garbageCollectOnAlternateThreadForDebugging(bool waitUntilDone); // Used for stress testing.
-
+        void setJavaScriptGarbageCollectorTimerEnabled(bool);
         void discardAllCompiledCode();
 
     private:
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index bbe3f1cd3..4d936393e 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -28,6 +28,7 @@
 #include "CallbackFunction.cpp"
 #include "DOMObjectHashTableMap.cpp"
 #include "DOMWrapperWorld.cpp"
+#include "Dictionary.cpp"
 #include "GCController.cpp"
 #include "JSArrayBufferCustom.cpp"
 #include "JSAttrCustom.cpp"
diff --git a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 2c72fec41..21f1ef43a 100644
--- a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -176,16 +176,16 @@ static inline void writeEpubPrefix(char*& buffer)
     *buffer++ = '-';
 }
 
-static CSSPropertyInfo cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName)
+static CSSPropertyInfo cssPropertyIDForJSCSSPropertyName(PropertyName propertyName)
 {
     CSSPropertyInfo propertyInfo = {CSSPropertyInvalid, false};
     bool hadPixelOrPosPrefix = false;
 
-    unsigned length = propertyName.length();
+    StringImpl* propertyNameString = propertyName.impl();
+    unsigned length = propertyNameString->length();
     if (!length)
         return propertyInfo;
 
-    StringImpl* propertyNameString = propertyName.impl();
     String stringForCache = String(propertyNameString);
     typedef HashMap<String, CSSPropertyInfo> CSSPropertyInfoMap;
     DEFINE_STATIC_LOCAL(CSSPropertyInfoMap, propertyInfoCache, ());
@@ -320,7 +320,7 @@ static JSValue cssPropertyGetterCallback(ExecState* exec, JSValue slotBase, unsi
     return cssPropertyGetter(exec, jsCast<JSCSSStyleDeclaration*>(asObject(slotBase)), propertyID);
 }
 
-bool JSCSSStyleDeclaration::getOwnPropertySlotDelegate(ExecState*, const Identifier& propertyIdentifier, PropertySlot& slot)
+bool JSCSSStyleDeclaration::getOwnPropertySlotDelegate(ExecState*, PropertyName propertyIdentifier, PropertySlot& slot)
 {
     CSSPropertyInfo propertyInfo = cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
     if (!propertyInfo.propertyID)
@@ -333,7 +333,7 @@ bool JSCSSStyleDeclaration::getOwnPropertySlotDelegate(ExecState*, const Identif
     return true;
 }
 
-bool JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate(JSC::ExecState* exec, const JSC::Identifier& propertyIdentifier, JSC::PropertyDescriptor& descriptor)
+bool JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate(JSC::ExecState* exec, JSC::PropertyName propertyIdentifier, JSC::PropertyDescriptor& descriptor)
 {
     CSSPropertyInfo propertyInfo = cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
     if (!propertyInfo.propertyID)
@@ -348,7 +348,7 @@ bool JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate(JSC::ExecState* exe
     return true;
 }
 
-bool JSCSSStyleDeclaration::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
+bool JSCSSStyleDeclaration::putDelegate(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&)
 {
     CSSPropertyInfo propertyInfo = cssPropertyIDForJSCSSPropertyName(propertyName);
     if (!propertyInfo.propertyID)
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index 5deacb74f..7be4b830a 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -107,11 +107,11 @@ JSValue jsStringOrFalse(ExecState* exec, const KURL& url)
     return jsString(exec, url.string());
 }
 
-AtomicStringImpl* findAtomicString(const Identifier& identifier)
+AtomicStringImpl* findAtomicString(PropertyName propertyName)
 {
-    if (identifier.isNull())
+    StringImpl* impl = propertyName.impl();
+    if (!impl)
         return 0;
-    StringImpl* impl = identifier.impl();
     ASSERT(impl->existingHash());
     return AtomicString::find(impl->characters(), impl->length(), impl->existingHash());
 }
@@ -243,9 +243,9 @@ void printErrorMessageForFrame(Frame* frame, const String& message)
     frame->domWindow()->printErrorMessage(message);
 }
 
-JSValue objectToStringFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
+JSValue objectToStringFunctionGetter(ExecState* exec, JSValue, PropertyName propertyName)
 {
-    return JSFunction::create(exec, exec->lexicalGlobalObject(), 0, propertyName, objectProtoFuncToString);
+    return JSFunction::create(exec, exec->lexicalGlobalObject(), 0, propertyName.impl(), objectProtoFuncToString);
 }
 
 Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInfo* classInfo)
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index 96f03f1db..55b083d92 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -252,13 +252,13 @@ enum ParameterDefaultPolicy {
     // object, to let the engine know that collecting the JSString wrapper is unlikely to save memory.
     JSC::JSValue jsOwnedStringOrNull(JSC::ExecState*, const String&); 
 
-    String identifierToString(const JSC::Identifier&);
+    String propertyNameToString(JSC::PropertyName);
     String ustringToString(const JSC::UString&);
     JSC::UString stringToUString(const String&);
 
-    AtomicString identifierToAtomicString(const JSC::Identifier&);
+    AtomicString propertyNameToAtomicString(JSC::PropertyName);
     AtomicString ustringToAtomicString(const JSC::UString&);
-    AtomicStringImpl* findAtomicString(const JSC::Identifier&);
+    AtomicStringImpl* findAtomicString(JSC::PropertyName);
 
     String valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null
     String valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null or undefined
@@ -337,7 +337,7 @@ enum ParameterDefaultPolicy {
     DOMWindow* firstDOMWindow(JSC::ExecState*);
 
     void printErrorMessageForFrame(Frame*, const String& message);
-    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier& propertyName);
+    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
     inline JSC::JSValue jsString(JSC::ExecState* exec, const String& s)
     {
@@ -371,9 +371,9 @@ enum ParameterDefaultPolicy {
         return JSC::UString(s.impl());
     }
 
-    inline String identifierToString(const JSC::Identifier& i)
+    inline String propertyNameToString(JSC::PropertyName propertyName)
     {
-        return i.impl();
+        return propertyName.impl();
     }
 
     inline AtomicString ustringToAtomicString(const JSC::UString& u)
@@ -381,9 +381,9 @@ enum ParameterDefaultPolicy {
         return AtomicString(u.impl());
     }
 
-    inline AtomicString identifierToAtomicString(const JSC::Identifier& identifier)
+    inline AtomicString propertyNameToAtomicString(JSC::PropertyName propertyName)
     {
-        return AtomicString(identifier.impl());
+        return AtomicString(propertyName.impl());
     }
 
     inline Vector<unsigned long> jsUnsignedLongArrayToVector(JSC::ExecState* exec, JSC::JSValue value)
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.h b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
index 74f35b0b7..bd2773ae4 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -30,6 +30,10 @@
 #include <runtime/JSGlobalObject.h>
 #include <runtime/JSGlobalThis.h>
 
+#ifndef WEBKIT_EXPORTDATA
+#define WEBKIT_EXPORTDATA
+#endif
+
 namespace WebCore {
 
     class Document;
@@ -71,7 +75,7 @@ namespace WebCore {
 
         DOMWrapperWorld* world() { return m_world.get(); }
 
-        static const JSC::ClassInfo s_info;
+        static WEBKIT_EXPORTDATA const JSC::ClassInfo s_info;
 
         static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
diff --git a/Source/WebCore/bindings/js/JSDOMMimeTypeArrayCustom.cpp b/Source/WebCore/bindings/js/JSDOMMimeTypeArrayCustom.cpp
index bd8a3428a..2cb94f971 100644
--- a/Source/WebCore/bindings/js/JSDOMMimeTypeArrayCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMMimeTypeArrayCustom.cpp
@@ -28,15 +28,15 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSDOMMimeTypeArray::canGetItemsForName(ExecState*, DOMMimeTypeArray* mimeTypeArray, const Identifier& propertyName)
+bool JSDOMMimeTypeArray::canGetItemsForName(ExecState*, DOMMimeTypeArray* mimeTypeArray, PropertyName propertyName)
 {
-    return mimeTypeArray->canGetItemsForName(identifierToAtomicString(propertyName));
+    return mimeTypeArray->canGetItemsForName(propertyNameToAtomicString(propertyName));
 }
 
-JSValue JSDOMMimeTypeArray::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSDOMMimeTypeArray::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSDOMMimeTypeArray* thisObj = jsCast<JSDOMMimeTypeArray*>(asObject(slotBase));
-    return toJS(exec, thisObj->globalObject(), thisObj->impl()->namedItem(identifierToAtomicString(propertyName)));
+    return toJS(exec, thisObj->globalObject(), thisObj->impl()->namedItem(propertyNameToAtomicString(propertyName)));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSDOMPluginArrayCustom.cpp b/Source/WebCore/bindings/js/JSDOMPluginArrayCustom.cpp
index 12a2d7a7f..c19d5c7c9 100644
--- a/Source/WebCore/bindings/js/JSDOMPluginArrayCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMPluginArrayCustom.cpp
@@ -28,15 +28,15 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSDOMPluginArray::canGetItemsForName(ExecState*, DOMPluginArray* pluginArray, const Identifier& propertyName)
+bool JSDOMPluginArray::canGetItemsForName(ExecState*, DOMPluginArray* pluginArray, PropertyName propertyName)
 {
-    return pluginArray->canGetItemsForName(identifierToAtomicString(propertyName));
+    return pluginArray->canGetItemsForName(propertyNameToAtomicString(propertyName));
 }
 
-JSValue JSDOMPluginArray::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSDOMPluginArray::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSDOMPluginArray* thisObj = jsCast<JSDOMPluginArray*>(asObject(slotBase));
-    return toJS(exec, thisObj->globalObject(), thisObj->impl()->namedItem(identifierToAtomicString(propertyName)));
+    return toJS(exec, thisObj->globalObject(), thisObj->impl()->namedItem(propertyNameToAtomicString(propertyName)));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSDOMPluginCustom.cpp b/Source/WebCore/bindings/js/JSDOMPluginCustom.cpp
index 061da3ab6..a8b91d293 100644
--- a/Source/WebCore/bindings/js/JSDOMPluginCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMPluginCustom.cpp
@@ -27,15 +27,15 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSDOMPlugin::canGetItemsForName(ExecState*, DOMPlugin* plugin, const Identifier& propertyName)
+bool JSDOMPlugin::canGetItemsForName(ExecState*, DOMPlugin* plugin, PropertyName propertyName)
 {
-    return plugin->canGetItemsForName(identifierToAtomicString(propertyName));
+    return plugin->canGetItemsForName(propertyNameToAtomicString(propertyName));
 }
 
-JSValue JSDOMPlugin::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSDOMPlugin::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSDOMPlugin* thisObj = jsCast<JSDOMPlugin*>(asObject(slotBase));
-    return toJS(exec, thisObj->globalObject(), thisObj->impl()->namedItem(identifierToAtomicString(propertyName)));
+    return toJS(exec, thisObj->globalObject(), thisObj->impl()->namedItem(propertyNameToAtomicString(propertyName)));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSDOMStringMapCustom.cpp b/Source/WebCore/bindings/js/JSDOMStringMapCustom.cpp
index 56871c2cc..891ea6ab4 100644
--- a/Source/WebCore/bindings/js/JSDOMStringMapCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMStringMapCustom.cpp
@@ -35,15 +35,15 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool JSDOMStringMap::canGetItemsForName(ExecState*, DOMStringMap* impl, const Identifier& propertyName)
+bool JSDOMStringMap::canGetItemsForName(ExecState*, DOMStringMap* impl, PropertyName propertyName)
 {
-    return impl->contains(identifierToAtomicString(propertyName));
+    return impl->contains(propertyNameToAtomicString(propertyName));
 }
 
-JSValue JSDOMStringMap::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSDOMStringMap::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSDOMStringMap* thisObj = jsCast<JSDOMStringMap*>(asObject(slotBase));
-    return jsString(exec, thisObj->impl()->item(identifierToAtomicString(propertyName)));
+    return jsString(exec, thisObj->impl()->item(propertyNameToAtomicString(propertyName)));
 }
 
 void JSDOMStringMap::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
@@ -58,10 +58,10 @@ void JSDOMStringMap::getOwnPropertyNames(JSObject* object, ExecState* exec, Prop
     Base::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
 }
 
-bool JSDOMStringMap::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
+bool JSDOMStringMap::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
     JSDOMStringMap* thisObject = jsCast<JSDOMStringMap*>(cell);
-    AtomicString stringName = identifierToAtomicString(propertyName);
+    AtomicString stringName = propertyNameToAtomicString(propertyName);
     if (!thisObject->m_impl->contains(stringName))
         return false;
     ExceptionCode ec = 0;
@@ -70,13 +70,13 @@ bool JSDOMStringMap::deleteProperty(JSCell* cell, ExecState* exec, const Identif
     return !ec;
 }
 
-bool JSDOMStringMap::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
+bool JSDOMStringMap::putDelegate(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&)
 {
     String stringValue = ustringToString(value.toString(exec)->value(exec));
     if (exec->hadException())
         return false;
     ExceptionCode ec = 0;
-    impl()->setItem(identifierToString(propertyName), stringValue, ec);
+    impl()->setItem(propertyNameToString(propertyName), stringValue, ec);
     setDOMException(exec, ec);
     return !ec;
 }
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 758a88a99..d09180fc2 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -92,14 +92,14 @@ void JSDOMWindow::visitChildren(JSCell* cell, SlotVisitor& visitor)
 }
 
 template<NativeFunction nativeFunction, int length>
-JSValue nonCachingStaticFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
+JSValue nonCachingStaticFunctionGetter(ExecState* exec, JSValue, PropertyName propertyName)
 {
-    return JSFunction::create(exec, exec->lexicalGlobalObject(), length, propertyName, nativeFunction);
+    return JSFunction::create(exec, exec->lexicalGlobalObject(), length, propertyName.impl(), nativeFunction);
 }
 
-static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
-    return toJS(exec, jsCast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->scopedChild(identifierToAtomicString(propertyName))->domWindow());
+    return toJS(exec, jsCast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->scopedChild(propertyNameToAtomicString(propertyName))->domWindow());
 }
 
 static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
@@ -107,7 +107,7 @@ static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
     return toJS(exec, jsCast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->scopedChild(index)->domWindow());
 }
 
-static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSDOMWindowBase* thisObj = jsCast<JSDOMWindow*>(asObject(slotBase));
     Document* document = thisObj->impl()->frame()->document();
@@ -116,13 +116,13 @@ static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifi
     ASSERT(document);
     ASSERT(document->isHTMLDocument());
 
-    HTMLCollection* collection = document->windowNamedItems(identifierToAtomicString(propertyName));
+    HTMLCollection* collection = document->windowNamedItems(propertyNameToAtomicString(propertyName));
     if (collection->length() == 1)
         return toJS(exec, thisObj, collection->firstItem());
     return toJS(exec, thisObj, collection);
 }
 
-bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(cell);
     // When accessing a Window cross-domain, functions are always the native built-in ones, and they
@@ -220,7 +220,7 @@ bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identi
     // naming frames things that conflict with window properties that
     // are in Moz but not IE. Since we have some of these, we have to do
     // it the Moz way.
-    if (thisObject->impl()->frame()->tree()->scopedChild(identifierToAtomicString(propertyName))) {
+    if (thisObject->impl()->frame()->tree()->scopedChild(propertyNameToAtomicString(propertyName))) {
         slot.setCustom(thisObject, childFrameGetter);
         return true;
     }
@@ -242,9 +242,9 @@ bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identi
     // We need to test the correct priority order.
 
     // allow window[1] or parent[1] etc. (#56983)
-    bool ok;
-    unsigned i = propertyName.toArrayIndex(ok);
-    if (ok && i < thisObject->impl()->frame()->tree()->scopedChildCount()) {
+    unsigned i = propertyName.asIndex();
+    if (i < thisObject->impl()->frame()->tree()->scopedChildCount()) {
+        ASSERT(i != PropertyName::NotAnIndex);
         slot.setCustomIndex(thisObject, i, indexGetter);
         return true;
     }
@@ -268,7 +268,7 @@ bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identi
     return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
 }
 
-bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(object);
     // Never allow cross-domain getOwnPropertyDescriptor
@@ -310,16 +310,16 @@ bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, co
     // naming frames things that conflict with window properties that
     // are in Moz but not IE. Since we have some of these, we have to do
     // it the Moz way.
-    if (thisObject->impl()->frame()->tree()->scopedChild(identifierToAtomicString(propertyName))) {
+    if (thisObject->impl()->frame()->tree()->scopedChild(propertyNameToAtomicString(propertyName))) {
         PropertySlot slot;
         slot.setCustom(thisObject, childFrameGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
         return true;
     }
     
-    bool ok;
-    unsigned i = propertyName.toArrayIndex(ok);
-    if (ok && i < thisObject->impl()->frame()->tree()->scopedChildCount()) {
+    unsigned i = propertyName.asIndex();
+    if (i < thisObject->impl()->frame()->tree()->scopedChildCount()) {
+        ASSERT(i != PropertyName::NotAnIndex);
         PropertySlot slot;
         slot.setCustomIndex(thisObject, i, indexGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
@@ -341,7 +341,7 @@ bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, co
     return Base::getOwnPropertyDescriptor(thisObject, exec, propertyName, descriptor);
 }
 
-void JSDOMWindow::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void JSDOMWindow::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(cell);
     if (!thisObject->impl()->frame())
@@ -361,7 +361,7 @@ void JSDOMWindow::put(JSCell* cell, ExecState* exec, const Identifier& propertyN
         Base::put(thisObject, exec, propertyName, value, slot);
 }
 
-bool JSDOMWindow::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
+bool JSDOMWindow::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
     JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(cell);
     // Only allow deleting properties by frames in the same origin.
@@ -388,7 +388,7 @@ void JSDOMWindow::getOwnPropertyNames(JSObject* object, ExecState* exec, Propert
     Base::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
 }
 
-bool JSDOMWindow::defineOwnProperty(JSC::JSObject* object, JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+bool JSDOMWindow::defineOwnProperty(JSC::JSObject* object, JSC::ExecState* exec, JSC::PropertyName propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
 {
     JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(object);
     // Only allow defining properties in this way by frames in the same origin, as it allows setters to be introduced.
@@ -396,7 +396,7 @@ bool JSDOMWindow::defineOwnProperty(JSC::JSObject* object, JSC::ExecState* exec,
         return false;
 
     // Don't allow shadowing location using accessor properties.
-    if (descriptor.isAccessorDescriptor() && propertyName == "location")
+    if (descriptor.isAccessorDescriptor() && propertyName == Identifier(exec, "location"))
         return false;
 
     return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
index 1f06713b5..749440177 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -91,37 +91,37 @@ UString JSDOMWindowShell::className(const JSObject* object)
     return thisObject->window()->methodTable()->className(thisObject->window());
 }
 
-bool JSDOMWindowShell::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSDOMWindowShell::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSDOMWindowShell* thisObject = jsCast<JSDOMWindowShell*>(cell);
     return thisObject->window()->methodTable()->getOwnPropertySlot(thisObject->window(), exec, propertyName, slot);
 }
 
-bool JSDOMWindowShell::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSDOMWindowShell::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSDOMWindowShell* thisObject = jsCast<JSDOMWindowShell*>(object);
     return thisObject->window()->methodTable()->getOwnPropertyDescriptor(thisObject->window(), exec, propertyName, descriptor);
 }
 
-void JSDOMWindowShell::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void JSDOMWindowShell::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSDOMWindowShell* thisObject = jsCast<JSDOMWindowShell*>(cell);
     thisObject->window()->methodTable()->put(thisObject->window(), exec, propertyName, value, slot);
 }
 
-void JSDOMWindowShell::putDirectVirtual(JSObject* object, ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
+void JSDOMWindowShell::putDirectVirtual(JSObject* object, ExecState* exec, PropertyName propertyName, JSValue value, unsigned attributes)
 {
     JSDOMWindowShell* thisObject = jsCast<JSDOMWindowShell*>(object);
     thisObject->window()->putDirectVirtual(thisObject->window(), exec, propertyName, value, attributes);
 }
 
-bool JSDOMWindowShell::defineOwnProperty(JSC::JSObject* object, JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+bool JSDOMWindowShell::defineOwnProperty(JSC::JSObject* object, JSC::ExecState* exec, JSC::PropertyName propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
 {
     JSDOMWindowShell* thisObject = jsCast<JSDOMWindowShell*>(object);
     return thisObject->window()->methodTable()->defineOwnProperty(thisObject->window(), exec, propertyName, descriptor, shouldThrow);
 }
 
-bool JSDOMWindowShell::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
+bool JSDOMWindowShell::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
     JSDOMWindowShell* thisObject = jsCast<JSDOMWindowShell*>(cell);
     return thisObject->window()->methodTable()->deleteProperty(thisObject->window(), exec, propertyName);
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.h b/Source/WebCore/bindings/js/JSDOMWindowShell.h
index 8be0fb181..5f22d7b18 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.h
@@ -78,14 +78,14 @@ namespace WebCore {
         static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | Base::StructureFlags;
 
         static JSC::UString className(const JSC::JSObject*);
-        static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-        static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-        static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-        static void putDirectVirtual(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
-        static bool deleteProperty(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName);
+        static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+        static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
+        static void put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);
+        static void putDirectVirtual(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, unsigned attributes);
+        static bool deleteProperty(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName);
         static void getOwnPropertyNames(JSC::JSObject*, JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode);
         static void getPropertyNames(JSC::JSObject*, JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode);
-        static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
+        static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&, bool shouldThrow);
 
         RefPtr<DOMWrapperWorld> m_world;
     };
diff --git a/Source/WebCore/bindings/js/JSDictionary.cpp b/Source/WebCore/bindings/js/JSDictionary.cpp
index ead297a2c..e461c23cb 100644
--- a/Source/WebCore/bindings/js/JSDictionary.cpp
+++ b/Source/WebCore/bindings/js/JSDictionary.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSDictionary.h"
 
+#include "Dictionary.h"
 #include "JSDOMWindow.h"
 #include "JSEventTarget.h"
 #include "JSMessagePortCustom.h"
@@ -91,6 +92,11 @@ void JSDictionary::convertValue(ExecState* exec, JSValue value, double& result)
     result = value.toNumber(exec);
 }
 
+void JSDictionary::convertValue(JSC::ExecState* exec, JSC::JSValue value, Dictionary& result)
+{
+    result = Dictionary(exec, value);
+}
+
 void JSDictionary::convertValue(ExecState* exec, JSValue value, String& result)
 {
     result = ustringToString(value.toString(exec)->value(exec));
diff --git a/Source/WebCore/bindings/js/JSDictionary.h b/Source/WebCore/bindings/js/JSDictionary.h
index 8f6337d6e..e0ba16997 100644
--- a/Source/WebCore/bindings/js/JSDictionary.h
+++ b/Source/WebCore/bindings/js/JSDictionary.h
@@ -32,6 +32,7 @@
 
 namespace WebCore {
 
+class Dictionary;
 class DOMWindow;
 class EventTarget;
 class Node;
@@ -59,6 +60,7 @@ public:
     bool get(const char* propertyName, Result&) const;
 
     JSC::ExecState* execState() const { return m_exec; }
+    JSC::JSObject* initializerObject() const { return m_initializerObject; }
     bool isValid() const { return m_exec && m_initializerObject; }
 
 private:
@@ -86,6 +88,7 @@ private:
     static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned short& result);
     static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned long long& result);
     static void convertValue(JSC::ExecState*, JSC::JSValue, double& result);
+    static void convertValue(JSC::ExecState*, JSC::JSValue, Dictionary& result);
     static void convertValue(JSC::ExecState*, JSC::JSValue, String& result);
     static void convertValue(JSC::ExecState*, JSC::JSValue, ScriptValue& result);
     static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<SerializedScriptValue>& result);
diff --git a/Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp b/Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
index f98c17650..7b106ba9d 100644
--- a/Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
@@ -41,10 +41,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue getNamedItems(ExecState* exec, JSHTMLAllCollection* collection, const Identifier& propertyName)
+static JSValue getNamedItems(ExecState* exec, JSHTMLAllCollection* collection, PropertyName propertyName)
 {
     Vector<RefPtr<Node> > namedItems;
-    collection->impl()->namedItems(identifierToAtomicString(propertyName), namedItems);
+    collection->impl()->namedItems(propertyNameToAtomicString(propertyName), namedItems);
 
     if (namedItems.isEmpty())
         return jsUndefined();
@@ -71,10 +71,9 @@ static EncodedJSValue JSC_HOST_CALL callHTMLAllCollection(ExecState* exec)
 
     if (exec->argumentCount() == 1) {
         // Support for document.all(<index>) etc.
-        bool ok;
         UString string = exec->argument(0).toString(exec)->value(exec);
-        unsigned index = Identifier::toUInt32(string, ok);
-        if (ok)
+        unsigned index = toUInt32FromStringImpl(string.impl());
+        if (index != PropertyName::NotAnIndex)
             return JSValue::encode(toJS(exec, jsCollection->globalObject(), collection->item(index)));
 
         // Support for document.images('<name>') etc.
@@ -82,10 +81,9 @@ static EncodedJSValue JSC_HOST_CALL callHTMLAllCollection(ExecState* exec)
     }
 
     // The second arg, if set, is the index of the item we want
-    bool ok;
     UString string = exec->argument(0).toString(exec)->value(exec);
-    unsigned index = Identifier::toUInt32(exec->argument(1).toString(exec)->value(exec), ok);
-    if (ok) {
+    unsigned index = toUInt32FromStringImpl(exec->argument(1).toString(exec)->value(exec).impl());
+    if (index != PropertyName::NotAnIndex) {
         if (Node* node = collection->namedItemWithIndex(ustringToAtomicString(string), index))
             return JSValue::encode(toJS(exec, jsCollection->globalObject(), node));
     }
@@ -99,12 +97,12 @@ CallType JSHTMLAllCollection::getCallData(JSCell*, CallData& callData)
     return CallTypeHost;
 }
 
-bool JSHTMLAllCollection::canGetItemsForName(ExecState*, HTMLAllCollection* collection, const Identifier& propertyName)
+bool JSHTMLAllCollection::canGetItemsForName(ExecState*, HTMLAllCollection* collection, PropertyName propertyName)
 {
-    return collection->hasNamedItem(identifierToAtomicString(propertyName));
+    return collection->hasNamedItem(propertyNameToAtomicString(propertyName));
 }
 
-JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSHTMLAllCollection* thisObj = jsCast<JSHTMLAllCollection*>(asObject(slotBase));
     return getNamedItems(exec, thisObj, propertyName);
@@ -112,9 +110,8 @@ JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, JSValue slotBase, const
 
 JSValue JSHTMLAllCollection::item(ExecState* exec)
 {
-    bool ok;
-    uint32_t index = Identifier::toUInt32(exec->argument(0).toString(exec)->value(exec), ok);
-    if (ok)
+    uint32_t index = toUInt32FromStringImpl(exec->argument(0).toString(exec)->value(exec).impl());
+    if (index != PropertyName::NotAnIndex)
         return toJS(exec, globalObject(), impl()->item(index));
     return getNamedItems(exec, this, Identifier(exec, exec->argument(0).toString(exec)->value(exec)));
 }
diff --git a/Source/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/Source/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index 8ca2c8792..28713498c 100644
--- a/Source/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -33,17 +33,17 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSHTMLAppletElement::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHTMLAppletElement::getOwnPropertySlotDelegate(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLAppletElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSHTMLAppletElement::getOwnPropertyDescriptorDelegate(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
 }
 
-bool JSHTMLAppletElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+bool JSHTMLAppletElement::putDelegate(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, this, slot);
 }
diff --git a/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index c62a7dd6a..0badc0529 100644
--- a/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -39,10 +39,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue getNamedItems(ExecState* exec, JSHTMLCollection* collection, const Identifier& propertyName)
+static JSValue getNamedItems(ExecState* exec, JSHTMLCollection* collection, PropertyName propertyName)
 {
     Vector<RefPtr<Node> > namedItems;
-    const AtomicString& name = identifierToAtomicString(propertyName);
+    const AtomicString& name = propertyNameToAtomicString(propertyName);
     collection->impl()->namedItems(name, namedItems);
 
     if (namedItems.isEmpty())
@@ -59,12 +59,12 @@ static JSValue getNamedItems(ExecState* exec, JSHTMLCollection* collection, cons
     return toJS(exec, collection->globalObject(), StaticNodeList::adopt(namedItems).get());
 }
 
-bool JSHTMLCollection::canGetItemsForName(ExecState*, HTMLCollection* collection, const Identifier& propertyName)
+bool JSHTMLCollection::canGetItemsForName(ExecState*, HTMLCollection* collection, PropertyName propertyName)
 {
-    return collection->hasNamedItem(identifierToAtomicString(propertyName));
+    return collection->hasNamedItem(propertyNameToAtomicString(propertyName));
 }
 
-JSValue JSHTMLCollection::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSHTMLCollection::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSHTMLCollection* thisObj = jsCast<JSHTMLCollection*>(asObject(slotBase));
     return getNamedItems(exec, thisObj, propertyName);
diff --git a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index 5d2e83ce1..14bc0f085 100644
--- a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -51,18 +51,18 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-bool JSHTMLDocument::canGetItemsForName(ExecState*, HTMLDocument* document, const Identifier& propertyName)
+bool JSHTMLDocument::canGetItemsForName(ExecState*, HTMLDocument* document, PropertyName propertyName)
 {
     AtomicStringImpl* atomicPropertyName = findAtomicString(propertyName);
     return atomicPropertyName && (document->hasNamedItem(atomicPropertyName) || document->hasExtraNamedItem(atomicPropertyName));
 }
 
-JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSHTMLDocument* thisObj = jsCast<JSHTMLDocument*>(asObject(slotBase));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
 
-    HTMLCollection* collection = document->documentNamedItems(identifierToAtomicString(propertyName));
+    HTMLCollection* collection = document->documentNamedItems(propertyNameToAtomicString(propertyName));
 
     unsigned length = collection->length();
     if (!length)
diff --git a/Source/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/Source/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 9c2c2d2a1..878e21301 100644
--- a/Source/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -33,17 +33,17 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSHTMLEmbedElement::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHTMLEmbedElement::getOwnPropertySlotDelegate(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
 }
 
-bool JSHTMLEmbedElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+bool JSHTMLEmbedElement::putDelegate(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, this, slot);
 }
diff --git a/Source/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/Source/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index 3087cd4ab..e47e2046d 100644
--- a/Source/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -37,20 +37,20 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool JSHTMLFormElement::canGetItemsForName(ExecState*, HTMLFormElement* form, const Identifier& propertyName)
+bool JSHTMLFormElement::canGetItemsForName(ExecState*, HTMLFormElement* form, PropertyName propertyName)
 {
     Vector<RefPtr<Node> > namedItems;
-    form->getNamedElements(identifierToAtomicString(propertyName), namedItems);
+    form->getNamedElements(propertyNameToAtomicString(propertyName), namedItems);
     return namedItems.size();
 }
 
-JSValue JSHTMLFormElement::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSHTMLFormElement::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSHTMLElement* jsForm = jsCast<JSHTMLFormElement*>(asObject(slotBase));
     HTMLFormElement* form = static_cast<HTMLFormElement*>(jsForm->impl());
 
     Vector<RefPtr<Node> > namedItems;
-    form->getNamedElements(identifierToAtomicString(propertyName), namedItems);
+    form->getNamedElements(propertyNameToAtomicString(propertyName), namedItems);
     
     if (namedItems.isEmpty())
         return jsUndefined();
diff --git a/Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index 95093c939..642f2f11c 100644
--- a/Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -41,16 +41,16 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement* frameSet, const Identifier& propertyName)
+bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement* frameSet, PropertyName propertyName)
 {
-    Node* frame = frameSet->children()->namedItem(identifierToAtomicString(propertyName));
+    Node* frame = frameSet->children()->namedItem(propertyNameToAtomicString(propertyName));
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     HTMLElement* element = jsCast<JSHTMLElement*>(asObject(slotBase))->impl();
-    Node* frameElement = element->children()->namedItem(identifierToAtomicString(propertyName));
+    Node* frameElement = element->children()->namedItem(propertyNameToAtomicString(propertyName));
     if (Document* document = static_cast<HTMLFrameElement*>(frameElement)->contentDocument()) {
         if (JSDOMWindowShell* window = toJSDOMWindowShell(document->frame(), currentWorld(exec)))
             return window;
diff --git a/Source/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/Source/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index 062eddd9a..f311071b6 100644
--- a/Source/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -33,17 +33,17 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSHTMLObjectElement::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHTMLObjectElement::getOwnPropertySlotDelegate(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLObjectElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSHTMLObjectElement::getOwnPropertyDescriptorDelegate(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
 }
 
-bool JSHTMLObjectElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+bool JSHTMLObjectElement::putDelegate(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, this, slot);
 }
diff --git a/Source/WebCore/bindings/js/JSHistoryCustom.cpp b/Source/WebCore/bindings/js/JSHistoryCustom.cpp
index e72c25889..17695d540 100644
--- a/Source/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -38,22 +38,22 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
+static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, JSValue, PropertyName propertyName)
 {
-    return JSFunction::create(exec, exec->lexicalGlobalObject(), 0, propertyName, jsHistoryPrototypeFunctionBack);
+    return JSFunction::create(exec, exec->lexicalGlobalObject(), 0, propertyName.impl(), jsHistoryPrototypeFunctionBack);
 }
 
-static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
+static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, JSValue, PropertyName propertyName)
 {
-    return JSFunction::create(exec, exec->lexicalGlobalObject(), 0, propertyName, jsHistoryPrototypeFunctionForward);
+    return JSFunction::create(exec, exec->lexicalGlobalObject(), 0, propertyName.impl(), jsHistoryPrototypeFunctionForward);
 }
 
-static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
+static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, JSValue, PropertyName propertyName)
 {
-    return JSFunction::create(exec, exec->lexicalGlobalObject(), 1, propertyName, jsHistoryPrototypeFunctionGo);
+    return JSFunction::create(exec, exec->lexicalGlobalObject(), 1, propertyName.impl(), jsHistoryPrototypeFunctionGo);
 }
 
-bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     // When accessing History cross-domain, functions are always the native built-in ones.
     // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
@@ -93,7 +93,7 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
     return true;
 }
 
-bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     if (!impl()->frame()) {
         descriptor.setUndefined();
@@ -138,7 +138,7 @@ bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifi
     return true;
 }
 
-bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
+bool JSHistory::putDelegate(ExecState* exec, PropertyName, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
     if (!shouldAllowAccessToFrame(exec, impl()->frame()))
@@ -146,7 +146,7 @@ bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutProp
     return false;
 }
 
-bool JSHistory::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
+bool JSHistory::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
     JSHistory* thisObject = jsCast<JSHistory*>(cell);
     // Only allow deleting by frames in the same origin.
diff --git a/Source/WebCore/bindings/js/JSLocationCustom.cpp b/Source/WebCore/bindings/js/JSLocationCustom.cpp
index 7786a988d..af3f8662b 100644
--- a/Source/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/Source/WebCore/bindings/js/JSLocationCustom.cpp
@@ -30,22 +30,22 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
+static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, JSValue, PropertyName propertyName)
 {
-    return JSFunction::create(exec, exec->lexicalGlobalObject(), 1, propertyName, jsLocationPrototypeFunctionReplace);
+    return JSFunction::create(exec, exec->lexicalGlobalObject(), 1, propertyName.impl(), jsLocationPrototypeFunctionReplace);
 }
 
-static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
+static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, JSValue, PropertyName propertyName)
 {
-    return JSFunction::create(exec, exec->lexicalGlobalObject(), 0, propertyName, jsLocationPrototypeFunctionReload);
+    return JSFunction::create(exec, exec->lexicalGlobalObject(), 0, propertyName.impl(), jsLocationPrototypeFunctionReload);
 }
 
-static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
+static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, JSValue, PropertyName propertyName)
 {
-    return JSFunction::create(exec, exec->lexicalGlobalObject(), 1, propertyName, jsLocationPrototypeFunctionAssign);
+    return JSFunction::create(exec, exec->lexicalGlobalObject(), 1, propertyName.impl(), jsLocationPrototypeFunctionAssign);
 }
 
-bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     Frame* frame = impl()->frame();
     if (!frame) {
@@ -86,7 +86,7 @@ bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& p
     return true;
 }
 
-bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     Frame* frame = impl()->frame();
     if (!frame) {
@@ -125,7 +125,7 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
     return true;
 }
 
-bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+bool JSLocation::putDelegate(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
     if (!frame)
@@ -152,7 +152,7 @@ bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JS
     return false;
 }
 
-bool JSLocation::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
+bool JSLocation::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
     JSLocation* thisObject = jsCast<JSLocation*>(cell);
     // Only allow deleting by frames in the same origin.
@@ -170,7 +170,7 @@ void JSLocation::getOwnPropertyNames(JSObject* object, ExecState* exec, Property
     Base::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
 }
 
-bool JSLocation::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool throwException)
+bool JSLocation::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor, bool throwException)
 {
     if (descriptor.isAccessorDescriptor() && (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf))
         return false;
@@ -276,12 +276,12 @@ JSValue JSLocation::toStringFunction(ExecState* exec)
     return jsString(exec, impl()->toString());
 }
 
-bool JSLocationPrototype::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&)
+bool JSLocationPrototype::putDelegate(ExecState* exec, PropertyName propertyName, JSValue, PutPropertySlot&)
 {
     return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
 }
 
-bool JSLocationPrototype::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool throwException)
+bool JSLocationPrototype::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor, bool throwException)
 {
     if (descriptor.isAccessorDescriptor() && (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf))
         return false;
diff --git a/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index b128032ee..39407d165 100644
--- a/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -35,15 +35,15 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Identifier& propertyName)
+bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, PropertyName propertyName)
 {
-    return impl->getNamedItem(identifierToString(propertyName));
+    return impl->getNamedItem(propertyNameToString(propertyName));
 }
 
-JSValue JSNamedNodeMap::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSNamedNodeMap::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSNamedNodeMap* thisObj = jsCast<JSNamedNodeMap*>(asObject(slotBase));
-    return toJS(exec, thisObj->globalObject(), thisObj->impl()->getNamedItem(identifierToString(propertyName)));
+    return toJS(exec, thisObj->globalObject(), thisObj->impl()->getNamedItem(propertyNameToString(propertyName)));
 }
 
 void JSNamedNodeMap::visitChildren(JSCell* cell, SlotVisitor& visitor)
diff --git a/Source/WebCore/bindings/js/JSNodeListCustom.cpp b/Source/WebCore/bindings/js/JSNodeListCustom.cpp
index 725e053a5..ff37978f7 100644
--- a/Source/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -46,15 +46,15 @@ bool JSNodeListOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown> handl
     return visitor.containsOpaqueRoot(root(static_cast<DynamicNodeList*>(jsNodeList->impl())->node()));
 }
 
-bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, const Identifier& propertyName)
+bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, PropertyName propertyName)
 {
-    return impl->itemWithName(identifierToAtomicString(propertyName));
+    return impl->itemWithName(propertyNameToAtomicString(propertyName));
 }
 
-JSValue JSNodeList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSNodeList::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSNodeList* thisObj = jsCast<JSNodeList*>(asObject(slotBase));
-    return toJS(exec, thisObj->globalObject(), thisObj->impl()->itemWithName(identifierToAtomicString(propertyName)));
+    return toJS(exec, thisObj->globalObject(), thisObj->impl()->itemWithName(propertyNameToAtomicString(propertyName)));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp b/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp
index 83819e3dc..6f166ac9d 100644
--- a/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -100,7 +100,7 @@ JSObject* pluginScriptObject(ExecState* exec, JSHTMLElement* jsHTMLElement)
     return instance->createRuntimeObject(exec);
 }
     
-JSValue runtimeObjectPropertyGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue runtimeObjectPropertyGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSHTMLElement* element = jsCast<JSHTMLElement*>(asObject(slotBase));
     JSObject* scriptObject = pluginScriptObject(exec, element);
@@ -110,7 +110,7 @@ JSValue runtimeObjectPropertyGetter(ExecState* exec, JSValue slotBase, const Ide
     return scriptObject->get(exec, propertyName);
 }
 
-bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot, JSHTMLElement* element)
+bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, PropertyName propertyName, PropertySlot& slot, JSHTMLElement* element)
 {
     JSObject* scriptObject = pluginScriptObject(exec, element);
     if (!scriptObject)
@@ -122,7 +122,7 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
     return true;
 }
 
-bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
+bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
 {
     JSObject* scriptObject = pluginScriptObject(exec, element);
     if (!scriptObject)
@@ -138,7 +138,7 @@ bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifi
     return true;
 }
 
-bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, JSHTMLElement* element, PutPropertySlot& slot)
+bool runtimeObjectCustomPut(ExecState* exec, PropertyName propertyName, JSValue value, JSHTMLElement* element, PutPropertySlot& slot)
 {
     JSObject* scriptObject = pluginScriptObject(exec, element);
     if (!scriptObject)
diff --git a/Source/WebCore/bindings/js/JSPluginElementFunctions.h b/Source/WebCore/bindings/js/JSPluginElementFunctions.h
index 15af59a71..8e9be6e89 100644
--- a/Source/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/Source/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -38,10 +38,10 @@ namespace WebCore {
     JSC::Bindings::Instance* pluginInstance(Node*);
     JSC::JSObject* pluginScriptObject(JSC::ExecState* exec, JSHTMLElement* jsHTMLElement);
 
-    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-    bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
-    bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, JSHTMLElement*);
-    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSHTMLElement*, JSC::PutPropertySlot&);
+    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+    bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&, JSHTMLElement*);
+    bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&, JSHTMLElement*);
+    bool runtimeObjectCustomPut(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSHTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(JSHTMLElement*, JSC::CallData&);
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSStorageCustom.cpp b/Source/WebCore/bindings/js/JSStorageCustom.cpp
index 3df221bfa..a7937b014 100644
--- a/Source/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/Source/WebCore/bindings/js/JSStorageCustom.cpp
@@ -34,12 +34,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool JSStorage::canGetItemsForName(ExecState*, Storage* impl, const Identifier& propertyName)
+bool JSStorage::canGetItemsForName(ExecState*, Storage* impl, PropertyName propertyName)
 {
-    return impl->contains(identifierToString(propertyName));
+    return impl->contains(propertyNameToString(propertyName));
 }
 
-JSValue JSStorage::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSStorage::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSStorage* thisObj = jsCast<JSStorage*>(asObject(slotBase));
         
@@ -47,10 +47,10 @@ JSValue JSStorage::nameGetter(ExecState* exec, JSValue slotBase, const Identifie
     if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return asObject(prototype)->get(exec, propertyName);
  
-    return jsStringOrNull(exec, thisObj->impl()->getItem(identifierToString(propertyName)));
+    return jsStringOrNull(exec, thisObj->impl()->getItem(propertyNameToString(propertyName)));
 }
 
-bool JSStorage::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
+bool JSStorage::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
     JSStorage* thisObject = jsCast<JSStorage*>(cell);
     // Only perform the custom delete if the object doesn't have a native property by this name.
@@ -64,7 +64,7 @@ bool JSStorage::deleteProperty(JSCell* cell, ExecState* exec, const Identifier&
     if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return false;
 
-    thisObject->m_impl->removeItem(identifierToString(propertyName));
+    thisObject->m_impl->removeItem(propertyNameToString(propertyName));
     return true;
 }
 
@@ -78,7 +78,7 @@ void JSStorage::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyN
     Base::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
 }
 
-bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
+bool JSStorage::putDelegate(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&)
 {
     // Only perform the custom put if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
@@ -96,7 +96,7 @@ bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSV
         return true;
     
     ExceptionCode ec = 0;
-    impl()->setItem(identifierToString(propertyName), stringValue, ec);
+    impl()->setItem(propertyNameToString(propertyName), stringValue, ec);
     setDOMException(exec, ec);
 
     return true;
diff --git a/Source/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/Source/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index c05eef5b1..7017bce24 100644
--- a/Source/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/Source/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -35,15 +35,15 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheetList, const Identifier& propertyName)
+bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheetList, PropertyName propertyName)
 {
-    return styleSheetList->getNamedItem(identifierToString(propertyName));
+    return styleSheetList->getNamedItem(propertyNameToString(propertyName));
 }
 
-JSValue JSStyleSheetList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue JSStyleSheetList::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     JSStyleSheetList* thisObj = jsCast<JSStyleSheetList*>(asObject(slotBase));
-    HTMLStyleElement* element = thisObj->impl()->getNamedItem(identifierToString(propertyName));
+    HTMLStyleElement* element = thisObj->impl()->getNamedItem(propertyNameToString(propertyName));
     ASSERT(element);
     return toJS(exec, thisObj->globalObject(), element->sheet());
 }
diff --git a/Source/WebCore/bindings/js/JSWorkerContextCustom.cpp b/Source/WebCore/bindings/js/JSWorkerContextCustom.cpp
index e103a8ea6..1fff81ac0 100644
--- a/Source/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -69,7 +69,7 @@ void JSWorkerContext::visitChildren(JSCell* cell, SlotVisitor& visitor)
     thisObject->impl()->visitJSEventListeners(visitor);
 }
 
-bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     // Look for overrides before looking at any of our own properties.
     if (JSGlobalObject::getOwnPropertySlot(this, exec, propertyName, slot))
@@ -77,7 +77,7 @@ bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifi
     return false;
 }
 
-bool JSWorkerContext::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSWorkerContext::getOwnPropertyDescriptorDelegate(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     // Look for overrides before looking at any of our own properties.
     if (JSGlobalObject::getOwnPropertyDescriptor(this, exec, propertyName, descriptor))
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
index efe4b6768..10bb8c8f6 100755
--- a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
@@ -75,7 +75,6 @@ PageScriptDebugServer::PageScriptDebugServer()
 
 PageScriptDebugServer::~PageScriptDebugServer()
 {
-    deleteAllValues(m_pageListenersMap);
 }
 
 void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
@@ -83,11 +82,9 @@ void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* pag
     ASSERT_ARG(listener, listener);
     ASSERT_ARG(page, page);
 
-    PageListenersMap::AddResult result = m_pageListenersMap.add(page, 0);
-    if (result.isNewEntry)
-        result.iterator->second = new ListenerSet;
-
-    ListenerSet* listeners = result.iterator->second;
+    OwnPtr<ListenerSet>& listeners = m_pageListenersMap.add(page, nullptr).iterator->second;
+    if (!listeners)
+        listeners = adoptPtr(new ListenerSet);
     listeners->add(listener);
 
     recompileAllJSFunctionsSoon();
@@ -103,11 +100,10 @@ void PageScriptDebugServer::removeListener(ScriptDebugListener* listener, Page*
     if (it == m_pageListenersMap.end())
         return;
 
-    ListenerSet* listeners = it->second;
+    ListenerSet* listeners = it->second.get();
     listeners->remove(listener);
     if (listeners->isEmpty()) {
         m_pageListenersMap.remove(it);
-        delete listeners;
         didRemoveLastListener(page);
     }
 }
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.h b/Source/WebCore/bindings/js/PageScriptDebugServer.h
index 5563e2695..72a890d7a 100644
--- a/Source/WebCore/bindings/js/PageScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.h
@@ -54,7 +54,7 @@ public:
     virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>*);
 
 private:
-    typedef HashMap<Page*, ListenerSet*> PageListenersMap;
+    typedef HashMap<Page*, OwnPtr<ListenerSet> > PageListenersMap;
 
     PageScriptDebugServer();
     virtual ~PageScriptDebugServer();
diff --git a/Source/WebCore/bindings/js/ScheduledAction.cpp b/Source/WebCore/bindings/js/ScheduledAction.cpp
index 71f7be74a..a13c3a65f 100644
--- a/Source/WebCore/bindings/js/ScheduledAction.cpp
+++ b/Source/WebCore/bindings/js/ScheduledAction.cpp
@@ -106,10 +106,14 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
         args.append(m_args[i].get());
 
     globalObject->globalData().timeoutChecker.start();
+    InspectorInstrumentationCookie cookie = JSMainThreadExecState::instrumentFunctionCall(context, callType, callData);
+
     if (context->isDocument())
         JSMainThreadExecState::call(exec, m_function.get(), callType, callData, thisValue, args);
     else
         JSC::call(exec, m_function.get(), callType, callData, thisValue, args);
+
+    InspectorInstrumentation::didCallFunction(cookie);
     globalObject->globalData().timeoutChecker.stop();
 
     if (exec->hadException())
diff --git a/Source/WebCore/bindings/js/ScriptController.cpp b/Source/WebCore/bindings/js/ScriptController.cpp
index 0a7e09086..7dd34ba15 100644
--- a/Source/WebCore/bindings/js/ScriptController.cpp
+++ b/Source/WebCore/bindings/js/ScriptController.cpp
@@ -326,6 +326,11 @@ PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* native
 void ScriptController::setCaptureCallStackForUncaughtExceptions(bool)
 {
 }
+
+void ScriptController::collectIsolatedContexts(Vector<std::pair<JSC::ExecState*, SecurityOrigin*> >&)
+{
+    // FIXME(85709): support isolated contexts inspection for JSC.
+}
 #endif
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
diff --git a/Source/WebCore/bindings/js/ScriptController.h b/Source/WebCore/bindings/js/ScriptController.h
index 37fb7edcf..9e8c28d6a 100644
--- a/Source/WebCore/bindings/js/ScriptController.h
+++ b/Source/WebCore/bindings/js/ScriptController.h
@@ -40,6 +40,7 @@ struct NPObject;
 
 namespace JSC {
     class JSGlobalObject;
+    class ExecState;
 
     namespace Bindings {
         class RootObject;
@@ -52,6 +53,7 @@ class HTMLPlugInElement;
 class Frame;
 class ScriptSourceCode;
 class ScriptValue;
+class SecurityOrigin;
 class Widget;
 
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
@@ -143,6 +145,7 @@ public:
 
 #if ENABLE(INSPECTOR)
     static void setCaptureCallStackForUncaughtExceptions(bool);
+    void collectIsolatedContexts(Vector<std::pair<JSC::ExecState*, SecurityOrigin*> >&);
 #endif
 
 #if PLATFORM(MAC)
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index 1d6117cfd..1a8bc0db3 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -65,7 +65,6 @@ ScriptDebugServer::ScriptDebugServer()
 
 ScriptDebugServer::~ScriptDebugServer()
 {
-    deleteAllValues(m_pageListenersMap);
 }
 
 String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBreakpoint& scriptBreakpoint, int* actualLineNumber, int* actualColumnNumber)
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index 0ecd5a870..fd0a8bc34 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -133,11 +133,9 @@ protected:
     virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
     virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
 
-    typedef HashMap<Page*, ListenerSet*> PageListenersMap;
     typedef HashMap<long, ScriptBreakpoint> LineToBreakpointMap;
     typedef HashMap<intptr_t, LineToBreakpointMap> SourceIdToBreakpointsMap;
 
-    PageListenersMap m_pageListenersMap;
     bool m_callingListeners;
     PauseOnExceptionsState m_pauseOnExceptionsState;
     bool m_pauseOnNextStatement;
diff --git a/Source/WebCore/bindings/js/ScriptEventListener.cpp b/Source/WebCore/bindings/js/ScriptEventListener.cpp
index c66a7d1fd..390fde117 100644
--- a/Source/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/Source/WebCore/bindings/js/ScriptEventListener.cpp
@@ -52,11 +52,10 @@ static const String& eventParameterName(bool isSVGEvent)
     return isSVGEvent ? evtString : eventString;
 }
 
-PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, const Attribute& attribute)
 {
     ASSERT(node);
-    ASSERT(attr);
-    if (attr->isNull())
+    if (attribute.isNull())
         return 0;
 
     TextPosition position = TextPosition::minimumPosition();
@@ -72,16 +71,15 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
         sourceURL = node->document()->url().string();
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, position, 0, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attribute.localName().string(), eventParameterName(node->isSVGElement()), attribute.value(), node, sourceURL, position, 0, mainThreadNormalWorld());
 }
 
-PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, const Attribute& attribute)
 {
     if (!frame)
         return 0;
 
-    ASSERT(attr);
-    if (attr->isNull())
+    if (attribute.isNull())
         return 0;
 
     ScriptController* scriptController = frame->script();
@@ -91,7 +89,7 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     TextPosition position = scriptController->eventHandlerPosition();
     String sourceURL = frame->document()->url().string();
     JSObject* wrapper = toJSDOMWindow(frame, mainThreadNormalWorld());
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, position, wrapper, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attribute.localName().string(), eventParameterName(frame->document()->isSVGDocument()), attribute.value(), 0, sourceURL, position, wrapper, mainThreadNormalWorld());
 }
 
 String eventListenerHandlerBody(Document* document, EventListener* eventListener)
diff --git a/Source/WebCore/bindings/js/ScriptEventListener.h b/Source/WebCore/bindings/js/ScriptEventListener.h
index f96f31eb7..78a9776a1 100644
--- a/Source/WebCore/bindings/js/ScriptEventListener.h
+++ b/Source/WebCore/bindings/js/ScriptEventListener.h
@@ -43,8 +43,8 @@ namespace WebCore {
     class Frame;
     class Node;
 
-    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node*, Attribute*);
-    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node*, const Attribute&);
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame*, const Attribute&);
     String eventListenerHandlerBody(Document*, EventListener*);
     bool eventListenerHandlerLocation(Document*, EventListener*, String& sourceName, int& lineNumber);
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.cpp b/Source/WebCore/bindings/js/ScriptProfiler.cpp
index c8dddbac3..c4c4d74d1 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/js/ScriptProfiler.cpp
@@ -51,6 +51,11 @@ ScriptObject ScriptProfiler::objectByHeapObjectId(unsigned)
     return ScriptObject();
 }
 
+unsigned ScriptProfiler::getHeapObjectId(ScriptValue)
+{
+    return 0;
+}
+
 void ScriptProfiler::start(ScriptState* state, const String& title)
 {
     JSC::Profiler::profiler()->startProfiling(state, stringToUString(title));
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index efed031a7..ce4468e77 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -39,6 +39,7 @@ namespace WebCore {
 class DOMWrapperVisitor;
 class Page;
 class ScriptObject;
+class ScriptValue;
 class WorkerContext;
 
 class ScriptProfiler {
@@ -55,6 +56,7 @@ public:
 
     static void collectGarbage();
     static ScriptObject objectByHeapObjectId(unsigned id);
+    static unsigned getHeapObjectId(ScriptValue);
     static void start(ScriptState* state, const String& title);
     static void startForPage(Page*, const String& title);
 #if ENABLE(WORKERS)
diff --git a/Source/WebCore/bindings/js/ScriptValue.cpp b/Source/WebCore/bindings/js/ScriptValue.cpp
index dea2a483e..fd32872c7 100644
--- a/Source/WebCore/bindings/js/ScriptValue.cpp
+++ b/Source/WebCore/bindings/js/ScriptValue.cpp
@@ -106,6 +106,14 @@ PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptStat
     return SerializedScriptValue::create(scriptState, jsValue(), 0, 0, throwExceptions);
 }
 
+PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState, MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers, bool& didThrow)
+{
+    JSValueRef exception = 0;
+    RefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(toRef(scriptState), toRef(scriptState, jsValue()), messagePorts, arrayBuffers, &exception);
+    didThrow = exception ? true : false;
+    return serializedValue.release();
+}
+
 ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value, SerializationErrorMode throwExceptions)
 {
     return ScriptValue(scriptState->globalData(), value->deserialize(scriptState, scriptState->lexicalGlobalObject(), 0, throwExceptions));
diff --git a/Source/WebCore/bindings/js/ScriptValue.h b/Source/WebCore/bindings/js/ScriptValue.h
index cfb99e520..1573a4906 100644
--- a/Source/WebCore/bindings/js/ScriptValue.h
+++ b/Source/WebCore/bindings/js/ScriptValue.h
@@ -63,6 +63,7 @@ public:
     bool operator==(const ScriptValue& other) const { return m_value == other.m_value; }
 
     PassRefPtr<SerializedScriptValue> serialize(ScriptState*, SerializationErrorMode = Throwing);
+    PassRefPtr<SerializedScriptValue> serialize(ScriptState*, MessagePortArray*, ArrayBufferArray*, bool&);
     static ScriptValue deserialize(ScriptState*, SerializedScriptValue*, SerializationErrorMode = Throwing);
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index 7c716c0ba..970c8505f 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -1859,10 +1859,9 @@ JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, J
     return deserialize(destinationContext, exception, 0);
 }
 
-SerializedScriptValue* SerializedScriptValue::nullValue()
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::nullValue()
 {
-    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, emptyValue, (SerializedScriptValue::create()));
-    return emptyValue.get();
+    return SerializedScriptValue::create();
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::undefinedValue()
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.h b/Source/WebCore/bindings/js/SerializedScriptValue.h
index 1a2de0068..99ba1c196 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.h
@@ -78,7 +78,7 @@ public:
     }
 
     static PassRefPtr<SerializedScriptValue> create();
-    static SerializedScriptValue* nullValue();
+    static PassRefPtr<SerializedScriptValue> nullValue();
     static PassRefPtr<SerializedScriptValue> undefinedValue();
     static PassRefPtr<SerializedScriptValue> booleanValue(bool value);
 
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index 04898db17..20f757291 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -198,6 +198,11 @@ sub SkipAttribute {
         return 1;
     }
 
+    # Skip indexed database attributes for now, they aren't yet supported for the GObject generator.
+    if ($attribute->signature->name =~ /^webkitIndexedDB/ or $attribute->signature->name =~ /^webkitIDB/) {
+        return 1;
+    }
+
     return 0;
 }
 
@@ -558,8 +563,10 @@ EOF
     push(@txtGetProps, $txtGetProp);
     if (scalar @readableProperties > 0) {
         $txtGetProp = << "EOF";
+$conditionGuardStart
     ${className}* self = WEBKIT_DOM_${clsCaps}(object);
     $privFunction
+$conditionGuardEnd
 EOF
         push(@txtGetProps, $txtGetProp);
     }
@@ -580,8 +587,10 @@ EOF
 
     if (scalar @writeableProperties > 0) {
         $txtSetProps = << "EOF";
+$conditionGuardStart
     ${className}* self = WEBKIT_DOM_${clsCaps}(object);
     $privFunction
+$conditionGuardEnd
 EOF
         push(@txtSetProps, $txtSetProps);
     }
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 9b1f7c489..2969e21ab 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -262,6 +262,8 @@ sub AddIncludesForType
         $includesRef->{"JSDOMStringList.h"} = 1;
     } elsif ($type eq "unsigned long[]") {
         $includesRef->{"<wtf/Vector.h>"} = 1;
+    } elsif ($type eq "SerializedScriptValue") {
+        $includesRef->{"SerializedScriptValue.h"} = 1;
     } elsif ($isCallback) {
         $includesRef->{"JS${type}.h"} = 1;
     } elsif (IsTypedArrayType($type)) {
@@ -412,15 +414,14 @@ sub GenerateGetOwnPropertySlotBody
     }
 
     if ($dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) {
-        push(@getOwnPropertySlotImpl, "    bool ok;\n");
-        push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(ok);\n");
+        push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.asIndex();\n");
 
         # If the item function returns a string then we let the TreatReturnedNullStringAs handle the cases
         # where the index is out of range.
         if (IndexGetterReturnsStrings($implClassName)) {
-            push(@getOwnPropertySlotImpl, "    if (ok) {\n");
+            push(@getOwnPropertySlotImpl, "    if (index != PropertyName::NotAnIndex) {\n");
         } else {
-            push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(thisObject->impl())->length()) {\n");
+            push(@getOwnPropertySlotImpl, "    if (index != PropertyName::NotAnIndex && index < static_cast<$implClassName*>(thisObject->impl())->length()) {\n");
         }
         if ($dataNode->extendedAttributes->{"NumericIndexedGetter"}) {
             push(@getOwnPropertySlotImpl, "        slot.setValue(thisObject->getByIndex(exec, index));\n");
@@ -506,9 +507,8 @@ sub GenerateGetOwnPropertyDescriptorBody
     }
 
     if ($dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) {
-        push(@getOwnPropertyDescriptorImpl, "    bool ok;\n");
-        push(@getOwnPropertyDescriptorImpl, "    unsigned index = propertyName.toUInt32(ok);\n");
-        push(@getOwnPropertyDescriptorImpl, "    if (ok && index < static_cast<$implClassName*>(thisObject->impl())->length()) {\n");
+        push(@getOwnPropertyDescriptorImpl, "    unsigned index = propertyName.asIndex();\n");
+        push(@getOwnPropertyDescriptorImpl, "    if (index != PropertyName::NotAnIndex && index < static_cast<$implClassName*>(thisObject->impl())->length()) {\n");
         if ($dataNode->extendedAttributes->{"NumericIndexedGetter"}) {
             # Assume that if there's a setter, the index will be writable
             if ($dataNode->extendedAttributes->{"CustomIndexedSetter"}) {
@@ -742,11 +742,11 @@ sub GenerateHeader
 
     # Getters
     if ($hasGetter) {
-        push(@headerContent, "    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);\n");
-        push(@headerContent, "    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);\n");
+        push(@headerContent, "    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);\n");
+        push(@headerContent, "    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);\n");
         push(@headerContent, "    static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) && !$dataNode->extendedAttributes->{"CustomNamedGetter"};
-        push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"};
-        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"};
+        push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"};
+        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"};
         $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
     }
 
@@ -765,9 +765,9 @@ sub GenerateHeader
 
     # Getters
     if ($hasSetter) {
-        push(@headerContent, "    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
+        push(@headerContent, "    static void put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
         push(@headerContent, "    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"CustomIndexedSetter"};
-        push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomNamedSetter"};
+        push(@headerContent, "    bool putDelegate(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomNamedSetter"};
     }
 
     if (!$hasParent) {
@@ -776,8 +776,11 @@ sub GenerateHeader
     }
 
     # Class info
-    push(@headerContent, "    static const JSC::ClassInfo s_info;\n\n");
-
+    if ($interfaceName eq "Node") {
+        push(@headerContent, "    static WEBKIT_EXPORTDATA const JSC::ClassInfo s_info;\n\n");
+    } else {
+        push(@headerContent, "    static const JSC::ClassInfo s_info;\n\n");
+    }
     # Structure ID
     if ($interfaceName eq "DOMWindow") {
         $structureFlags{"JSC::ImplementsHasInstance"} = 1;
@@ -798,7 +801,7 @@ sub GenerateHeader
     push(@headerContent, "    static JSC::CallType getCallData(JSC::JSCell*, JSC::CallData&);\n\n") if $dataNode->extendedAttributes->{"CustomCall"};
 
     # Custom deleteProperty function
-    push(@headerContent, "    static bool deleteProperty(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&);\n") if $dataNode->extendedAttributes->{"CustomDeleteProperty"};
+    push(@headerContent, "    static bool deleteProperty(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName);\n") if $dataNode->extendedAttributes->{"CustomDeleteProperty"};
 
     # Custom getPropertyNames function exists on DOMWindow
     if ($interfaceName eq "DOMWindow") {
@@ -813,7 +816,7 @@ sub GenerateHeader
     }
 
     # Custom defineOwnProperty function
-    push(@headerContent, "    static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"JSCustomDefineOwnProperty"};
+    push(@headerContent, "    static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"JSCustomDefineOwnProperty"};
 
     # Override toBoolean to return false for objects that want to 'MasqueradesAsUndefined'.
     if ($dataNode->extendedAttributes->{"MasqueradesAsUndefined"}) {
@@ -948,20 +951,20 @@ sub GenerateHeader
     # Name getter
     if ($dataNode->extendedAttributes->{"NamedGetter"} || $dataNode->extendedAttributes->{"CustomNamedGetter"}) {
         push(@headerContent, "private:\n");
-        push(@headerContent, "    static bool canGetItemsForName(JSC::ExecState*, $implClassName*, const JSC::Identifier&);\n");
-        push(@headerContent, "    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
+        push(@headerContent, "    static bool canGetItemsForName(JSC::ExecState*, $implClassName*, JSC::PropertyName);\n");
+        push(@headerContent, "    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);\n");
     }
 
     push(@headerContent, "};\n\n");
 
     if ($dataNode->extendedAttributes->{"JSInlineGetOwnPropertySlot"} && !$dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}) {
-        push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertySlot(JSC::JSCell* cell, JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)\n");
+        push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertySlot(JSC::JSCell* cell, JSC::ExecState* exec, JSC::PropertyName propertyName, JSC::PropertySlot& slot)\n");
         push(@headerContent, "{\n");
         push(@headerContent, "    ${className}* thisObject = JSC::jsCast<${className}*>(cell);\n");
         push(@headerContent, "    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\n");
         push(@headerContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
         push(@headerContent, "}\n\n");
-        push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertyDescriptor(JSC::JSObject* object, JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor)\n");
+        push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertyDescriptor(JSC::JSObject* object, JSC::ExecState* exec, JSC::PropertyName propertyName, JSC::PropertyDescriptor& descriptor)\n");
         push(@headerContent, "{\n");
         push(@headerContent, "    ${className}* thisObject = JSC::jsCast<${className}*>(object);\n");
         push(@headerContent, "    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\n");
@@ -1026,8 +1029,8 @@ sub GenerateHeader
 
     push(@headerContent, "    static const JSC::ClassInfo s_info;\n");
     if ($numFunctions > 0 || $numConstants > 0) {
-        push(@headerContent, "    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n");
-        push(@headerContent, "    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
+        push(@headerContent, "    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);\n");
+        push(@headerContent, "    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);\n");
         $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
     }
     if ($dataNode->extendedAttributes->{"JSCustomMarkFunction"} or $needsMarkChildren) {
@@ -1039,12 +1042,12 @@ sub GenerateHeader
         "        return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);\n" .
         "    }\n");
     if ($dataNode->extendedAttributes->{"JSCustomNamedGetterOnPrototype"}) {
-        push(@headerContent, "    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
-        push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n");
+        push(@headerContent, "    static void put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
+        push(@headerContent, "    bool putDelegate(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
     }
 
     # Custom defineOwnProperty function
-    push(@headerContent, "    static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"JSCustomDefineOwnPropertyOnPrototype"};
+    push(@headerContent, "    static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"JSCustomDefineOwnPropertyOnPrototype"};
 
     push(@headerContent, "\nprivate:\n");
     push(@headerContent, "    ${className}Prototype(JSC::JSGlobalData& globalData, JSC::JSGlobalObject*, JSC::Structure* structure) : JSC::JSNonFinalObject(globalData, structure) { }\n");
@@ -1082,7 +1085,7 @@ sub GenerateHeader
             my $conditionalString = $codeGenerator->GenerateConditionalString($attribute->signature);
             push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
-            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);\n");
             unless ($attribute->type =~ /readonly/) {
                 my $setter = "setJS" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                 push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);\n");
@@ -1092,7 +1095,7 @@ sub GenerateHeader
         
         if (!$dataNode->extendedAttributes->{"OmitConstructor"}) {
             my $getter = "js" . $interfaceName . "Constructor";
-            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);\n");
         }
 
         if ($dataNode->extendedAttributes->{"ReplaceableConstructor"}) {
@@ -1107,7 +1110,7 @@ sub GenerateHeader
             my $conditionalString = $codeGenerator->GenerateConditionalString($constant);
             push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
-            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);\n");
             push(@headerContent, "#endif\n") if $conditionalString;
         }
     }
@@ -1480,7 +1483,7 @@ sub GenerateImplementation
     }
 
     if ($numConstants > 0 || $numFunctions > 0) {
-        push(@implContent, "bool ${className}Prototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
+        push(@implContent, "bool ${className}Prototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}Prototype* thisObject = jsCast<${className}Prototype*>(cell);\n");
 
@@ -1495,7 +1498,7 @@ sub GenerateImplementation
         }
         push(@implContent, "}\n\n");
 
-        push(@implContent, "bool ${className}Prototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
+        push(@implContent, "bool ${className}Prototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}Prototype* thisObject = jsCast<${className}Prototype*>(object);\n");
 
@@ -1512,7 +1515,7 @@ sub GenerateImplementation
     }
 
     if ($dataNode->extendedAttributes->{"JSCustomNamedGetterOnPrototype"}) {
-        push(@implContent, "void ${className}Prototype::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
+        push(@implContent, "void ${className}Prototype::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}Prototype* thisObject = jsCast<${className}Prototype*>(cell);\n");
         push(@implContent, "    if (thisObject->putDelegate(exec, propertyName, value, slot))\n");
@@ -1632,13 +1635,13 @@ sub GenerateImplementation
     # Attributes
     if ($hasGetter) {
         if (!$dataNode->extendedAttributes->{"JSInlineGetOwnPropertySlot"} && !$dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}) {
-            push(@implContent, "bool ${className}::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
+            push(@implContent, "bool ${className}::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)\n");
             push(@implContent, "{\n");
             push(@implContent, "    ${className}* thisObject = jsCast<${className}*>(cell);\n");
             push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\n");
             push(@implContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
             push(@implContent, "}\n\n");
-            push(@implContent, "bool ${className}::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
+            push(@implContent, "bool ${className}::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)\n");
             push(@implContent, "{\n");
             push(@implContent, "    ${className}* thisObject = jsCast<${className}*>(object);\n");
             push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\n");
@@ -1674,7 +1677,7 @@ sub GenerateImplementation
                 my $attributeConditionalString = $codeGenerator->GenerateConditionalString($attribute->signature);
                 push(@implContent, "#if ${attributeConditionalString}\n") if $attributeConditionalString;
 
-                push(@implContent, "JSValue ${getFunctionName}(ExecState* exec, JSValue slotBase, const Identifier&)\n");
+                push(@implContent, "JSValue ${getFunctionName}(ExecState* exec, JSValue slotBase, PropertyName)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    ${className}* castedThis = jsCast<$className*>(asObject(slotBase));\n");
 
@@ -1793,7 +1796,7 @@ sub GenerateImplementation
             if (!$dataNode->extendedAttributes->{"OmitConstructor"}) {
                 my $constructorFunctionName = "js" . $interfaceName . "Constructor";
 
-                push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, JSValue slotBase, const Identifier&)\n");
+                push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, JSValue slotBase, PropertyName)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    ${className}* domObject = jsCast<$className*>(asObject(slotBase));\n");
 
@@ -1819,14 +1822,13 @@ sub GenerateImplementation
 
         if ($hasSetter) {
             if (!$dataNode->extendedAttributes->{"CustomPutFunction"}) {
-                push(@implContent, "void ${className}::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
+                push(@implContent, "void ${className}::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    ${className}* thisObject = jsCast<${className}*>(cell);\n");
                 push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\n");
                 if ($dataNode->extendedAttributes->{"CustomIndexedSetter"}) {
-                    push(@implContent, "    bool ok;\n");
-                    push(@implContent, "    unsigned index = propertyName.toUInt32(ok);\n");
-                    push(@implContent, "    if (ok) {\n");
+                    push(@implContent, "    unsigned index = propertyName.asIndex();\n");
+                    push(@implContent, "    if (index != PropertyName::NotAnIndex) {\n");
                     push(@implContent, "        thisObject->indexSetter(exec, index, value);\n");
                     push(@implContent, "        return;\n");
                     push(@implContent, "    }\n");
@@ -2198,7 +2200,7 @@ sub GenerateImplementation
             }
 
             # FIXME: this casts into int to match our previous behavior which turned 0xFFFFFFFF in -1 for NodeFilter.SHOW_ALL
-            push(@implContent, "JSValue ${getter}(ExecState* exec, JSValue, const Identifier&)\n");
+            push(@implContent, "JSValue ${getter}(ExecState* exec, JSValue, PropertyName)\n");
             push(@implContent, "{\n");
             if ($constant->type eq "DOMString") {
                 push(@implContent, "    return jsStringOrNull(exec, String(" . $constant->value . "));\n");
@@ -2247,14 +2249,14 @@ sub GenerateImplementation
 
     if ($interfaceName eq "HTMLPropertiesCollection") {
         if ($dataNode->extendedAttributes->{"NamedGetter"}) {
-            push(@implContent, "bool ${className}::canGetItemsForName(ExecState*, $implClassName* collection, const Identifier& propertyName)\n");
+            push(@implContent, "bool ${className}::canGetItemsForName(ExecState*, $implClassName* collection, PropertyName propertyName)\n");
             push(@implContent, "{\n");
-            push(@implContent, "    return collection->hasNamedItem(identifierToAtomicString(propertyName));\n");
+            push(@implContent, "    return collection->hasNamedItem(propertyNameToAtomicString(propertyName));\n");
             push(@implContent, "}\n\n");
-            push(@implContent, "JSValue ${className}::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)\n");
+            push(@implContent, "JSValue ${className}::nameGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)\n");
             push(@implContent, "{\n");
             push(@implContent, "    ${className}* thisObj = jsCast<$className*>(asObject(slotBase));\n");
-            push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->namedItem(identifierToAtomicString(propertyName)));\n");
+            push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->namedItem(propertyNameToAtomicString(propertyName)));\n");
             push(@implContent, "}\n\n");
         }
     }
@@ -2604,11 +2606,11 @@ sub GenerateCallbackHeader
                 push(@headerContent, "    COMPILE_ASSERT(false)");
             }
 
-            push(@headerContent, "    virtual " . GetNativeType($function->signature->type) . " " . $function->signature->name . "(");
+            push(@headerContent, "    virtual " . GetNativeTypeForCallbacks($function->signature->type) . " " . $function->signature->name . "(");
 
             my @args = ();
             foreach my $param (@params) {
-                push(@args, GetNativeType($param->type) . " " . $param->name);
+                push(@args, GetNativeTypeForCallbacks($param->type) . " " . $param->name);
             }
             push(@headerContent, join(", ", @args));
 
@@ -2683,7 +2685,7 @@ sub GenerateCallbackImplementation
             }
 
             AddIncludesForTypeInImpl($function->signature->type);
-            push(@implContent, "\n" . GetNativeType($function->signature->type) . " ${className}::" . $function->signature->name . "(");
+            push(@implContent, "\n" . GetNativeTypeForCallbacks($function->signature->type) . " ${className}::" . $function->signature->name . "(");
 
             my @args = ();
             my @argsCheck = ();
@@ -2691,7 +2693,7 @@ sub GenerateCallbackImplementation
             foreach my $param (@params) {
                 my $paramName = $param->name;
                 AddIncludesForTypeInImpl($param->type, 1);
-                push(@args, GetNativeType($param->type) . " " . $paramName);
+                push(@args, GetNativeTypeForCallbacks($param->type) . " " . $paramName);
                 if ($thisType and $thisType eq $param->type) {
                     push(@argsCheck, <<END);
     ASSERT(${paramName});
@@ -2717,6 +2719,8 @@ END
                     push(@implContent, "    args.append(jsString(exec, ${paramName}));\n");
                 } elsif ($param->type eq "boolean") {
                     push(@implContent, "    args.append(jsBoolean(${paramName}));\n");
+                } elsif ($param->type eq "SerializedScriptValue") {
+                    push(@implContent, "    args.append($paramName ? $paramName->deserialize(exec, m_data->globalObject(), 0) : jsNull());\n");
                 } else {
                     push(@implContent, "    args.append(toJS(exec, m_data->globalObject(), ${paramName}));\n");
                 }
@@ -2832,6 +2836,14 @@ sub GetNativeType
     return "${type}*";
 }
 
+sub GetNativeTypeForCallbacks
+{
+    my $type = shift;
+    return "SerializedScriptValue*" if $type eq "SerializedScriptValue";
+
+    return GetNativeType($type);
+}
+
 sub GetSVGPropertyTypes
 {
     my $implType = shift;
@@ -3387,8 +3399,8 @@ sub GenerateConstructorDeclaration
     push(@$outputArray, "        return ptr;\n");
     push(@$outputArray, "    }\n\n");
 
-    push(@$outputArray, "    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n");
-    push(@$outputArray, "    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
+    push(@$outputArray, "    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);\n");
+    push(@$outputArray, "    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);\n");
     push(@$outputArray, "    static const JSC::ClassInfo s_info;\n");
 
     push(@$outputArray, "    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)\n");
@@ -3504,12 +3516,12 @@ sub GenerateConstructorDefinition
 
         my $kind = $hasStaticFunctions ? "Property" : "Value";
 
-        push(@$outputArray, "bool ${constructorClassName}::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
+        push(@$outputArray, "bool ${constructorClassName}::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)\n");
         push(@$outputArray, "{\n");
         push(@$outputArray, "    return getStatic${kind}Slot<${constructorClassName}, JSDOMWrapper>(exec, &${constructorClassName}Table, jsCast<${constructorClassName}*>(cell), propertyName, slot);\n");
         push(@$outputArray, "}\n\n");
 
-        push(@$outputArray, "bool ${constructorClassName}::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
+        push(@$outputArray, "bool ${constructorClassName}::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)\n");
         push(@$outputArray, "{\n");
         push(@$outputArray, "    return getStatic${kind}Descriptor<${constructorClassName}, JSDOMWrapper>(exec, &${constructorClassName}Table, jsCast<${constructorClassName}*>(object), propertyName, descriptor);\n");
         push(@$outputArray, "}\n\n");
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 702ab440c..d66f84e0c 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -988,8 +988,8 @@ END
             push(@implContentDecls, "    return toV8(WTF::getPtr(${tearOffType}::create($result)), info.GetIsolate());\n");
         }
     } elsif ($attribute->signature->type eq "MessagePortArray") {
-        AddToImplIncludes("V8Array.h");
         AddToImplIncludes("MessagePort.h");
+        AddToImplIncludes("V8MessagePort.h");
         my $getterFunc = $codeGenerator->WK_lcfirst($attribute->signature->name);
         push(@implContentDecls, <<END);
     MessagePortArray* ports = imp->${getterFunc}();
@@ -1623,7 +1623,7 @@ sub GenerateParametersCheck
                 $parameterCheckString .= "    ArrayBufferArray arrayBufferArray$TransferListName;\n";
                 $parameterCheckString .= "    if (args.Length() > $transferListIndex) {\n";
                 $parameterCheckString .= "        if (!extractTransferables(args[$transferListIndex], messagePortArray$TransferListName, arrayBufferArray$TransferListName))\n";
-                $parameterCheckString .= "            return throwError(\"Could not extract transferables\", V8Proxy::TypeError);\n";
+                $parameterCheckString .= "            return V8Proxy::throwTypeError(\"Could not extract transferables\");\n";
                 $parameterCheckString .= "    }\n";
                 $useTransferList = 1;
             }
@@ -1671,7 +1671,7 @@ sub GenerateParametersCheck
                    $parameterCheckString .= "        ec = TYPE_MISMATCH_ERR;\n";
                    $parameterCheckString .= "        V8Proxy::setDOMException(ec, args.GetIsolate());\n";
                }
-               $parameterCheckString .= "        return throwError(\"Not an object.\", V8Proxy::TypeError);\n";
+               $parameterCheckString .= "        return V8Proxy::throwTypeError(\"Not an object.\");\n";
                $parameterCheckString .= "    }\n";
             }
         }
@@ -1714,7 +1714,7 @@ v8::Handle<v8::Value> V8${implClassName}::constructorCallback(const v8::Argument
     INC_STATS("DOM.${implClassName}.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -1739,7 +1739,7 @@ END
 
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
-        return throwError("${implClassName} constructor's associated context is not available", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "${implClassName} constructor's associated context is not available");
 END
     }
 
@@ -1799,7 +1799,7 @@ v8::Handle<v8::Value> V8${implClassName}::constructorCallback(const v8::Argument
     INC_STATS("DOM.${implClassName}.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -1888,14 +1888,14 @@ static v8::Handle<v8::Value> V8${implClassName}ConstructorCallback(const v8::Arg
     INC_STATS("DOM.${implClassName}.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
 
     Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
     if (!frame)
-        return throwError("${implClassName} constructor associated frame is unavailable", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "${implClassName} constructor associated frame is unavailable");
 
     Document* document = frame->document();
 
@@ -3827,7 +3827,7 @@ sub NativeToJSValue
     }
 
     if ($type eq "EventTarget") {
-        return "V8DOMWrapper::convertEventTargetToV8Object($value)";
+        return "V8DOMWrapper::convertEventTargetToV8Object($value, $getIsolate)";
     }
 
     if ($type eq "EventListener") {
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestActiveDOMObject.cpp
index cd6ade536..3110d4fe3 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestActiveDOMObject.cpp
@@ -111,8 +111,10 @@ static void webkit_dom_test_active_dom_object_set_property(GObject* object, guin
 static void webkit_dom_test_active_dom_object_get_property(GObject* object, guint propertyId, GValue* value, GParamSpec* pspec)
 {
     WebCore::JSMainThreadNullState state;
+
     WebKitDOMTestActiveDOMObject* self = WEBKIT_DOM_TEST_ACTIVE_DOM_OBJECT(object);
     WebCore::TestActiveDOMObject* coreSelf = WebKit::core(self);
+
     switch (propertyId) {
     case PROP_EXCITING_ATTR: {
         g_value_set_long(value, coreSelf->excitingAttr());
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestEventConstructor.cpp
index 8b3e98000..9ed7456f3 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestEventConstructor.cpp
@@ -110,8 +110,10 @@ static void webkit_dom_test_event_constructor_set_property(GObject* object, guin
 static void webkit_dom_test_event_constructor_get_property(GObject* object, guint propertyId, GValue* value, GParamSpec* pspec)
 {
     WebCore::JSMainThreadNullState state;
+
     WebKitDOMTestEventConstructor* self = WEBKIT_DOM_TEST_EVENT_CONSTRUCTOR(object);
     WebCore::TestEventConstructor* coreSelf = WebKit::core(self);
+
     switch (propertyId) {
     case PROP_ATTR1: {
         g_value_take_string(value, convertToUTF8String(coreSelf->attr1()));
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestException.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestException.cpp
index 74fe6a672..089e91f8a 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestException.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestException.cpp
@@ -109,8 +109,10 @@ static void webkit_dom_test_exception_set_property(GObject* object, guint proper
 static void webkit_dom_test_exception_get_property(GObject* object, guint propertyId, GValue* value, GParamSpec* pspec)
 {
     WebCore::JSMainThreadNullState state;
+
     WebKitDOMTestException* self = WEBKIT_DOM_TEST_EXCEPTION(object);
     WebCore::TestException* coreSelf = WebKit::core(self);
+
     switch (propertyId) {
     case PROP_NAME: {
         g_value_take_string(value, convertToUTF8String(coreSelf->name()));
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
index fb4734fc9..45253dfdd 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
@@ -111,8 +111,10 @@ static void webkit_dom_test_interface_finalize(GObject* object)
 static void webkit_dom_test_interface_set_property(GObject* object, guint propertyId, const GValue* value, GParamSpec* pspec)
 {
     WebCore::JSMainThreadNullState state;
+#if ENABLE(Condition1) || ENABLE(Condition2)
     WebKitDOMTestInterface* self = WEBKIT_DOM_TEST_INTERFACE(object);
     WebCore::TestInterface* coreSelf = WebKit::core(self);
+#endif // ENABLE(Condition1) || ENABLE(Condition2)
     switch (propertyId) {
     case PROP_SUPPLEMENTAL_STR2: {
 #if ENABLE(Condition1) || ENABLE(Condition2)
@@ -138,8 +140,10 @@ static void webkit_dom_test_interface_set_property(GObject* object, guint proper
 static void webkit_dom_test_interface_get_property(GObject* object, guint propertyId, GValue* value, GParamSpec* pspec)
 {
     WebCore::JSMainThreadNullState state;
+#if ENABLE(Condition1) || ENABLE(Condition2)
     WebKitDOMTestInterface* self = WEBKIT_DOM_TEST_INTERFACE(object);
     WebCore::TestInterface* coreSelf = WebKit::core(self);
+#endif // ENABLE(Condition1) || ENABLE(Condition2)
     switch (propertyId) {
     case PROP_SUPPLEMENTAL_STR1: {
 #if ENABLE(Condition1) || ENABLE(Condition2)
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
index ef72eab44..34a807551 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
@@ -167,8 +167,10 @@ static void webkit_dom_test_obj_finalize(GObject* object)
 static void webkit_dom_test_obj_set_property(GObject* object, guint propertyId, const GValue* value, GParamSpec* pspec)
 {
     WebCore::JSMainThreadNullState state;
+
     WebKitDOMTestObj* self = WEBKIT_DOM_TEST_OBJ(object);
     WebCore::TestObj* coreSelf = WebKit::core(self);
+
     switch (propertyId) {
     case PROP_UNSIGNED_SHORT_ATTR: {
         coreSelf->setUnsignedShortAttr((g_value_get_uint(value)));
@@ -298,8 +300,10 @@ static void webkit_dom_test_obj_set_property(GObject* object, guint propertyId,
 static void webkit_dom_test_obj_get_property(GObject* object, guint propertyId, GValue* value, GParamSpec* pspec)
 {
     WebCore::JSMainThreadNullState state;
+
     WebKitDOMTestObj* self = WEBKIT_DOM_TEST_OBJ(object);
     WebCore::TestObj* coreSelf = WebKit::core(self);
+
     switch (propertyId) {
     case PROP_READ_ONLY_INT_ATTR: {
         g_value_set_long(value, coreSelf->readOnlyIntAttr());
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp
index fe5724e81..cf9fd3a14 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp
@@ -125,8 +125,10 @@ static void webkit_dom_test_serialized_script_value_interface_set_property(GObje
 static void webkit_dom_test_serialized_script_value_interface_get_property(GObject* object, guint propertyId, GValue* value, GParamSpec* pspec)
 {
     WebCore::JSMainThreadNullState state;
+#if ENABLE(Condition1) || ENABLE(Condition2)
     WebKitDOMTestSerializedScriptValueInterface* self = WEBKIT_DOM_TEST_SERIALIZED_SCRIPT_VALUE_INTERFACE(object);
     WebCore::TestSerializedScriptValueInterface* coreSelf = WebKit::core(self);
+#endif // ENABLE(Condition1) || ENABLE(Condition2)
     switch (propertyId) {
     case PROP_VALUE: {
 #if ENABLE(Condition1) || ENABLE(Condition2)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
index 3b533f59d..1b4663101 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
@@ -68,12 +68,12 @@ void JSFloat64ArrayConstructor::finishCreation(ExecState* exec, JSDOMGlobalObjec
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(123), ReadOnly | DontDelete | DontEnum);
 }
 
-bool JSFloat64ArrayConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSFloat64ArrayConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSFloat64ArrayConstructor, JSDOMWrapper>(exec, &JSFloat64ArrayConstructorTable, jsCast<JSFloat64ArrayConstructor*>(cell), propertyName, slot);
 }
 
-bool JSFloat64ArrayConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSFloat64ArrayConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSFloat64ArrayConstructor, JSDOMWrapper>(exec, &JSFloat64ArrayConstructorTable, jsCast<JSFloat64ArrayConstructor*>(object), propertyName, descriptor);
 }
@@ -105,13 +105,13 @@ JSObject* JSFloat64ArrayPrototype::self(ExecState* exec, JSGlobalObject* globalO
     return getDOMPrototype<JSFloat64Array>(exec, globalObject);
 }
 
-bool JSFloat64ArrayPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSFloat64ArrayPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSFloat64ArrayPrototype* thisObject = jsCast<JSFloat64ArrayPrototype*>(cell);
     return getStaticFunctionSlot<JSObject>(exec, getJSFloat64ArrayPrototypeTable(exec), thisObject, propertyName, slot);
 }
 
-bool JSFloat64ArrayPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSFloat64ArrayPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSFloat64ArrayPrototype* thisObject = jsCast<JSFloat64ArrayPrototype*>(object);
     return getStaticFunctionDescriptor<JSObject>(exec, getJSFloat64ArrayPrototypeTable(exec), thisObject, propertyName, descriptor);
@@ -144,26 +144,24 @@ JSObject* JSFloat64Array::createPrototype(ExecState* exec, JSGlobalObject* globa
     return JSFloat64ArrayPrototype::create(exec->globalData(), globalObject, JSFloat64ArrayPrototype::createStructure(exec->globalData(), globalObject, JSArrayBufferViewPrototype::self(exec, globalObject)));
 }
 
-bool JSFloat64Array::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSFloat64Array::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSFloat64Array* thisObject = jsCast<JSFloat64Array*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
-    bool ok;
-    unsigned index = propertyName.toUInt32(ok);
-    if (ok && index < static_cast<Float64Array*>(thisObject->impl())->length()) {
+    unsigned index = propertyName.asIndex();
+    if (index != PropertyName::NotAnIndex && index < static_cast<Float64Array*>(thisObject->impl())->length()) {
         slot.setValue(thisObject->getByIndex(exec, index));
         return true;
     }
     return getStaticValueSlot<JSFloat64Array, Base>(exec, getJSFloat64ArrayTable(exec), thisObject, propertyName, slot);
 }
 
-bool JSFloat64Array::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSFloat64Array::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSFloat64Array* thisObject = jsCast<JSFloat64Array*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
-    bool ok;
-    unsigned index = propertyName.toUInt32(ok);
-    if (ok && index < static_cast<Float64Array*>(thisObject->impl())->length()) {
+    unsigned index = propertyName.asIndex();
+    if (index != PropertyName::NotAnIndex && index < static_cast<Float64Array*>(thisObject->impl())->length()) {
         descriptor.setDescriptor(thisObject->getByIndex(exec, index), DontDelete);
         return true;
     }
@@ -181,19 +179,18 @@ bool JSFloat64Array::getOwnPropertySlotByIndex(JSCell* cell, ExecState* exec, un
     return thisObject->methodTable()->getOwnPropertySlot(thisObject, exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsFloat64ArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsFloat64ArrayConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSFloat64Array* domObject = jsCast<JSFloat64Array*>(asObject(slotBase));
     return JSFloat64Array::getConstructor(exec, domObject->globalObject());
 }
 
-void JSFloat64Array::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void JSFloat64Array::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSFloat64Array* thisObject = jsCast<JSFloat64Array*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
-    bool ok;
-    unsigned index = propertyName.toUInt32(ok);
-    if (ok) {
+    unsigned index = propertyName.asIndex();
+    if (index != PropertyName::NotAnIndex) {
         thisObject->indexSetter(exec, index, value);
         return;
     }
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
index 3a3b7cd8b..06919d16b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
@@ -39,10 +39,10 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    static void put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue, bool shouldThrow);
     static const JSC::ClassInfo s_info;
 
@@ -83,8 +83,8 @@ public:
     }
 
     static const JSC::ClassInfo s_info;
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);
@@ -110,8 +110,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -128,7 +128,7 @@ protected:
 JSC::EncodedJSValue JSC_HOST_CALL jsFloat64ArrayPrototypeFunctionFoo(JSC::ExecState*);
 // Attributes
 
-JSC::JSValue jsFloat64ArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsFloat64ArrayConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
index ce8e623b9..5c23e1aea 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
@@ -65,12 +65,12 @@ void JSTestActiveDOMObjectConstructor::finishCreation(ExecState* exec, JSDOMGlob
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestActiveDOMObjectPrototype::self(exec, globalObject), DontDelete | ReadOnly);
 }
 
-bool JSTestActiveDOMObjectConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestActiveDOMObjectConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSTestActiveDOMObjectConstructor, JSDOMWrapper>(exec, &JSTestActiveDOMObjectConstructorTable, jsCast<JSTestActiveDOMObjectConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestActiveDOMObjectConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestActiveDOMObjectConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSTestActiveDOMObjectConstructor, JSDOMWrapper>(exec, &JSTestActiveDOMObjectConstructorTable, jsCast<JSTestActiveDOMObjectConstructor*>(object), propertyName, descriptor);
 }
@@ -92,13 +92,13 @@ JSObject* JSTestActiveDOMObjectPrototype::self(ExecState* exec, JSGlobalObject*
     return getDOMPrototype<JSTestActiveDOMObject>(exec, globalObject);
 }
 
-bool JSTestActiveDOMObjectPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestActiveDOMObjectPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestActiveDOMObjectPrototype* thisObject = jsCast<JSTestActiveDOMObjectPrototype*>(cell);
     return getStaticFunctionSlot<JSObject>(exec, &JSTestActiveDOMObjectPrototypeTable, thisObject, propertyName, slot);
 }
 
-bool JSTestActiveDOMObjectPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestActiveDOMObjectPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestActiveDOMObjectPrototype* thisObject = jsCast<JSTestActiveDOMObjectPrototype*>(object);
     return getStaticFunctionDescriptor<JSObject>(exec, &JSTestActiveDOMObjectPrototypeTable, thisObject, propertyName, descriptor);
@@ -134,14 +134,14 @@ JSTestActiveDOMObject::~JSTestActiveDOMObject()
     releaseImplIfNotNull();
 }
 
-bool JSTestActiveDOMObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestActiveDOMObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestActiveDOMObject* thisObject = jsCast<JSTestActiveDOMObject*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueSlot<JSTestActiveDOMObject, Base>(exec, &JSTestActiveDOMObjectTable, thisObject, propertyName, slot);
 }
 
-bool JSTestActiveDOMObject::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestActiveDOMObject::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestActiveDOMObject* thisObject = jsCast<JSTestActiveDOMObject*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
@@ -150,7 +150,7 @@ bool JSTestActiveDOMObject::getOwnPropertyDescriptor(JSObject* object, ExecState
     return getStaticValueDescriptor<JSTestActiveDOMObject, Base>(exec, &JSTestActiveDOMObjectTable, thisObject, propertyName, descriptor);
 }
 
-JSValue jsTestActiveDOMObjectExcitingAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestActiveDOMObjectExcitingAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestActiveDOMObject* castedThis = jsCast<JSTestActiveDOMObject*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
@@ -162,7 +162,7 @@ JSValue jsTestActiveDOMObjectExcitingAttr(ExecState* exec, JSValue slotBase, con
 }
 
 
-JSValue jsTestActiveDOMObjectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestActiveDOMObjectConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestActiveDOMObject* domObject = jsCast<JSTestActiveDOMObject*>(asObject(slotBase));
     if (!domObject->allowsAccessFrom(exec))
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
index 2a42407a0..7b1b4c15e 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
@@ -40,8 +40,8 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
     ~JSTestActiveDOMObject();
     static const JSC::ClassInfo s_info;
@@ -96,8 +96,8 @@ public:
     }
 
     static const JSC::ClassInfo s_info;
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);
@@ -123,8 +123,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -140,8 +140,8 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestActiveDOMObjectPrototypeFunctionExciting
 JSC::EncodedJSValue JSC_HOST_CALL jsTestActiveDOMObjectPrototypeFunctionPostMessage(JSC::ExecState*);
 // Attributes
 
-JSC::JSValue jsTestActiveDOMObjectExcitingAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestActiveDOMObjectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestActiveDOMObjectExcitingAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestActiveDOMObjectConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
index 180f09e85..6867905cc 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
@@ -64,12 +64,12 @@ void JSTestCustomNamedGetterConstructor::finishCreation(ExecState* exec, JSDOMGl
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestCustomNamedGetterPrototype::self(exec, globalObject), DontDelete | ReadOnly);
 }
 
-bool JSTestCustomNamedGetterConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestCustomNamedGetterConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSTestCustomNamedGetterConstructor, JSDOMWrapper>(exec, &JSTestCustomNamedGetterConstructorTable, jsCast<JSTestCustomNamedGetterConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestCustomNamedGetterConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestCustomNamedGetterConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSTestCustomNamedGetterConstructor, JSDOMWrapper>(exec, &JSTestCustomNamedGetterConstructorTable, jsCast<JSTestCustomNamedGetterConstructor*>(object), propertyName, descriptor);
 }
@@ -90,13 +90,13 @@ JSObject* JSTestCustomNamedGetterPrototype::self(ExecState* exec, JSGlobalObject
     return getDOMPrototype<JSTestCustomNamedGetter>(exec, globalObject);
 }
 
-bool JSTestCustomNamedGetterPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestCustomNamedGetterPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestCustomNamedGetterPrototype* thisObject = jsCast<JSTestCustomNamedGetterPrototype*>(cell);
     return getStaticFunctionSlot<JSObject>(exec, &JSTestCustomNamedGetterPrototypeTable, thisObject, propertyName, slot);
 }
 
-bool JSTestCustomNamedGetterPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestCustomNamedGetterPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestCustomNamedGetterPrototype* thisObject = jsCast<JSTestCustomNamedGetterPrototype*>(object);
     return getStaticFunctionDescriptor<JSObject>(exec, &JSTestCustomNamedGetterPrototypeTable, thisObject, propertyName, descriptor);
@@ -132,7 +132,7 @@ JSTestCustomNamedGetter::~JSTestCustomNamedGetter()
     releaseImplIfNotNull();
 }
 
-bool JSTestCustomNamedGetter::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestCustomNamedGetter::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestCustomNamedGetter* thisObject = jsCast<JSTestCustomNamedGetter*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
@@ -143,7 +143,7 @@ bool JSTestCustomNamedGetter::getOwnPropertySlot(JSCell* cell, ExecState* exec,
     return getStaticValueSlot<JSTestCustomNamedGetter, Base>(exec, &JSTestCustomNamedGetterTable, thisObject, propertyName, slot);
 }
 
-bool JSTestCustomNamedGetter::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestCustomNamedGetter::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestCustomNamedGetter* thisObject = jsCast<JSTestCustomNamedGetter*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
@@ -156,7 +156,7 @@ bool JSTestCustomNamedGetter::getOwnPropertyDescriptor(JSObject* object, ExecSta
     return getStaticValueDescriptor<JSTestCustomNamedGetter, Base>(exec, &JSTestCustomNamedGetterTable, thisObject, propertyName, descriptor);
 }
 
-JSValue jsTestCustomNamedGetterConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestCustomNamedGetterConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestCustomNamedGetter* domObject = jsCast<JSTestCustomNamedGetter*>(asObject(slotBase));
     return JSTestCustomNamedGetter::getConstructor(exec, domObject->globalObject());
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
index 83b8b4f75..f1e7592ab 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
@@ -40,8 +40,8 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
     ~JSTestCustomNamedGetter();
     static const JSC::ClassInfo s_info;
@@ -64,8 +64,8 @@ protected:
     void finishCreation(JSC::JSGlobalData&);
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 private:
-    static bool canGetItemsForName(JSC::ExecState*, TestCustomNamedGetter*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+    static bool canGetItemsForName(JSC::ExecState*, TestCustomNamedGetter*, JSC::PropertyName);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 };
 
 class JSTestCustomNamedGetterOwner : public JSC::WeakHandleOwner {
@@ -99,8 +99,8 @@ public:
     }
 
     static const JSC::ClassInfo s_info;
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);
@@ -126,8 +126,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -142,7 +142,7 @@ protected:
 JSC::EncodedJSValue JSC_HOST_CALL jsTestCustomNamedGetterPrototypeFunctionAnotherFunction(JSC::ExecState*);
 // Attributes
 
-JSC::JSValue jsTestCustomNamedGetterConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestCustomNamedGetterConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
index 315e157a0..7ab3ff2b6 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
@@ -67,12 +67,12 @@ void JSTestEventConstructorConstructor::finishCreation(ExecState* exec, JSDOMGlo
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
-bool JSTestEventConstructorConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestEventConstructorConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSTestEventConstructorConstructor, JSDOMWrapper>(exec, &JSTestEventConstructorConstructorTable, jsCast<JSTestEventConstructorConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestEventConstructorConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestEventConstructorConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSTestEventConstructorConstructor, JSDOMWrapper>(exec, &JSTestEventConstructorConstructorTable, jsCast<JSTestEventConstructorConstructor*>(object), propertyName, descriptor);
 }
@@ -166,21 +166,21 @@ JSTestEventConstructor::~JSTestEventConstructor()
     releaseImplIfNotNull();
 }
 
-bool JSTestEventConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestEventConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestEventConstructor* thisObject = jsCast<JSTestEventConstructor*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueSlot<JSTestEventConstructor, Base>(exec, &JSTestEventConstructorTable, thisObject, propertyName, slot);
 }
 
-bool JSTestEventConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestEventConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestEventConstructor* thisObject = jsCast<JSTestEventConstructor*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueDescriptor<JSTestEventConstructor, Base>(exec, &JSTestEventConstructorTable, thisObject, propertyName, descriptor);
 }
 
-JSValue jsTestEventConstructorAttr1(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestEventConstructorAttr1(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestEventConstructor* castedThis = jsCast<JSTestEventConstructor*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -190,7 +190,7 @@ JSValue jsTestEventConstructorAttr1(ExecState* exec, JSValue slotBase, const Ide
 }
 
 
-JSValue jsTestEventConstructorAttr2(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestEventConstructorAttr2(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestEventConstructor* castedThis = jsCast<JSTestEventConstructor*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -200,7 +200,7 @@ JSValue jsTestEventConstructorAttr2(ExecState* exec, JSValue slotBase, const Ide
 }
 
 
-JSValue jsTestEventConstructorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestEventConstructorConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestEventConstructor* domObject = jsCast<JSTestEventConstructor*>(asObject(slotBase));
     return JSTestEventConstructor::getConstructor(exec, domObject->globalObject());
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
index 260bdeb3b..6519e9fb6 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
@@ -42,8 +42,8 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
     ~JSTestEventConstructor();
     static const JSC::ClassInfo s_info;
@@ -123,8 +123,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -140,9 +140,9 @@ bool fillTestEventConstructorInit(TestEventConstructorInit&, JSDictionary&);
 
 // Attributes
 
-JSC::JSValue jsTestEventConstructorAttr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestEventConstructorAttr2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestEventConstructorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestEventConstructorAttr1(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestEventConstructorAttr2(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestEventConstructorConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
index 2385a79ff..174b70e94 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
@@ -70,12 +70,12 @@ void JSTestEventTargetConstructor::finishCreation(ExecState* exec, JSDOMGlobalOb
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestEventTargetPrototype::self(exec, globalObject), DontDelete | ReadOnly);
 }
 
-bool JSTestEventTargetConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestEventTargetConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSTestEventTargetConstructor, JSDOMWrapper>(exec, &JSTestEventTargetConstructorTable, jsCast<JSTestEventTargetConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestEventTargetConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestEventTargetConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSTestEventTargetConstructor, JSDOMWrapper>(exec, &JSTestEventTargetConstructorTable, jsCast<JSTestEventTargetConstructor*>(object), propertyName, descriptor);
 }
@@ -99,13 +99,13 @@ JSObject* JSTestEventTargetPrototype::self(ExecState* exec, JSGlobalObject* glob
     return getDOMPrototype<JSTestEventTarget>(exec, globalObject);
 }
 
-bool JSTestEventTargetPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestEventTargetPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestEventTargetPrototype* thisObject = jsCast<JSTestEventTargetPrototype*>(cell);
     return getStaticFunctionSlot<JSObject>(exec, &JSTestEventTargetPrototypeTable, thisObject, propertyName, slot);
 }
 
-bool JSTestEventTargetPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestEventTargetPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestEventTargetPrototype* thisObject = jsCast<JSTestEventTargetPrototype*>(object);
     return getStaticFunctionDescriptor<JSObject>(exec, &JSTestEventTargetPrototypeTable, thisObject, propertyName, descriptor);
@@ -141,7 +141,7 @@ JSTestEventTarget::~JSTestEventTarget()
     releaseImplIfNotNull();
 }
 
-bool JSTestEventTarget::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestEventTarget::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestEventTarget* thisObject = jsCast<JSTestEventTarget*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
@@ -150,9 +150,8 @@ bool JSTestEventTarget::getOwnPropertySlot(JSCell* cell, ExecState* exec, const
         slot.setCustom(thisObject, entry->propertyGetter());
         return true;
     }
-    bool ok;
-    unsigned index = propertyName.toUInt32(ok);
-    if (ok && index < static_cast<TestEventTarget*>(thisObject->impl())->length()) {
+    unsigned index = propertyName.asIndex();
+    if (index != PropertyName::NotAnIndex && index < static_cast<TestEventTarget*>(thisObject->impl())->length()) {
         slot.setCustomIndex(thisObject, index, indexGetter);
         return true;
     }
@@ -163,7 +162,7 @@ bool JSTestEventTarget::getOwnPropertySlot(JSCell* cell, ExecState* exec, const
     return getStaticValueSlot<JSTestEventTarget, Base>(exec, &JSTestEventTargetTable, thisObject, propertyName, slot);
 }
 
-bool JSTestEventTarget::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestEventTarget::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestEventTarget* thisObject = jsCast<JSTestEventTarget*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
@@ -174,9 +173,8 @@ bool JSTestEventTarget::getOwnPropertyDescriptor(JSObject* object, ExecState* ex
         descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
         return true;
     }
-    bool ok;
-    unsigned index = propertyName.toUInt32(ok);
-    if (ok && index < static_cast<TestEventTarget*>(thisObject->impl())->length()) {
+    unsigned index = propertyName.asIndex();
+    if (index != PropertyName::NotAnIndex && index < static_cast<TestEventTarget*>(thisObject->impl())->length()) {
         PropertySlot slot;
         slot.setCustomIndex(thisObject, index, indexGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
@@ -202,7 +200,7 @@ bool JSTestEventTarget::getOwnPropertySlotByIndex(JSCell* cell, ExecState* exec,
     return thisObject->methodTable()->getOwnPropertySlot(thisObject, exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsTestEventTargetConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestEventTargetConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestEventTarget* domObject = jsCast<JSTestEventTarget*>(asObject(slotBase));
     return JSTestEventTarget::getConstructor(exec, domObject->globalObject());
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
index 48edd5707..c3aa1f0cd 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
@@ -40,8 +40,8 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     static void destroy(JSC::JSCell*);
     ~JSTestEventTarget();
@@ -69,8 +69,8 @@ protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::OverridesVisitChildren | JSC::MasqueradesAsUndefined | Base::StructureFlags;
     static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
-    static bool canGetItemsForName(JSC::ExecState*, TestEventTarget*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+    static bool canGetItemsForName(JSC::ExecState*, TestEventTarget*, JSC::PropertyName);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 };
 
 class JSTestEventTargetOwner : public JSC::WeakHandleOwner {
@@ -104,8 +104,8 @@ public:
     }
 
     static const JSC::ClassInfo s_info;
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);
@@ -131,8 +131,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -150,7 +150,7 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestEventTargetPrototypeFunctionRemoveEventL
 JSC::EncodedJSValue JSC_HOST_CALL jsTestEventTargetPrototypeFunctionDispatchEvent(JSC::ExecState*);
 // Attributes
 
-JSC::JSValue jsTestEventTargetConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestEventTargetConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp
index f66e6b96d..f6de9e05d 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp
@@ -63,12 +63,12 @@ void JSTestExceptionConstructor::finishCreation(ExecState* exec, JSDOMGlobalObje
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestExceptionPrototype::self(exec, globalObject), DontDelete | ReadOnly);
 }
 
-bool JSTestExceptionConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestExceptionConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSTestExceptionConstructor, JSDOMWrapper>(exec, &JSTestExceptionConstructorTable, jsCast<JSTestExceptionConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestExceptionConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestExceptionConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSTestExceptionConstructor, JSDOMWrapper>(exec, &JSTestExceptionConstructorTable, jsCast<JSTestExceptionConstructor*>(object), propertyName, descriptor);
 }
@@ -118,21 +118,21 @@ JSTestException::~JSTestException()
     releaseImplIfNotNull();
 }
 
-bool JSTestException::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestException::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestException* thisObject = jsCast<JSTestException*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueSlot<JSTestException, Base>(exec, &JSTestExceptionTable, thisObject, propertyName, slot);
 }
 
-bool JSTestException::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestException::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestException* thisObject = jsCast<JSTestException*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueDescriptor<JSTestException, Base>(exec, &JSTestExceptionTable, thisObject, propertyName, descriptor);
 }
 
-JSValue jsTestExceptionName(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestExceptionName(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestException* castedThis = jsCast<JSTestException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -142,7 +142,7 @@ JSValue jsTestExceptionName(ExecState* exec, JSValue slotBase, const Identifier&
 }
 
 
-JSValue jsTestExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestExceptionConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestException* domObject = jsCast<JSTestException*>(asObject(slotBase));
     return JSTestException::getConstructor(exec, domObject->globalObject());
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestException.h b/Source/WebCore/bindings/scripts/test/JS/JSTestException.h
index 5f1fa8ac1..175e6cbfd 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestException.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestException.h
@@ -40,8 +40,8 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
     ~JSTestException();
     static const JSC::ClassInfo s_info;
@@ -121,8 +121,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -134,8 +134,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsTestExceptionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestExceptionName(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestExceptionConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
index ea2efa707..9b94ae52c 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
@@ -110,12 +110,12 @@ void JSTestInterfaceConstructor::finishCreation(ExecState* exec, JSDOMGlobalObje
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
-bool JSTestInterfaceConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestInterfaceConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticPropertySlot<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, jsCast<JSTestInterfaceConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestInterfaceConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestInterfaceConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticPropertyDescriptor<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, jsCast<JSTestInterfaceConstructor*>(object), propertyName, descriptor);
 }
@@ -179,13 +179,13 @@ JSObject* JSTestInterfacePrototype::self(ExecState* exec, JSGlobalObject* global
     return getDOMPrototype<JSTestInterface>(exec, globalObject);
 }
 
-bool JSTestInterfacePrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestInterfacePrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestInterfacePrototype* thisObject = jsCast<JSTestInterfacePrototype*>(cell);
     return getStaticPropertySlot<JSTestInterfacePrototype, JSObject>(exec, &JSTestInterfacePrototypeTable, thisObject, propertyName, slot);
 }
 
-bool JSTestInterfacePrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestInterfacePrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestInterfacePrototype* thisObject = jsCast<JSTestInterfacePrototype*>(object);
     return getStaticPropertyDescriptor<JSTestInterfacePrototype, JSObject>(exec, &JSTestInterfacePrototypeTable, thisObject, propertyName, descriptor);
@@ -221,14 +221,14 @@ JSTestInterface::~JSTestInterface()
     releaseImplIfNotNull();
 }
 
-bool JSTestInterface::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestInterface::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestInterface* thisObject = jsCast<JSTestInterface*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueSlot<JSTestInterface, Base>(exec, &JSTestInterfaceTable, thisObject, propertyName, slot);
 }
 
-bool JSTestInterface::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestInterface::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestInterface* thisObject = jsCast<JSTestInterface*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
@@ -236,7 +236,7 @@ bool JSTestInterface::getOwnPropertyDescriptor(JSObject* object, ExecState* exec
 }
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSValue jsTestInterfaceSupplementalStr1(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestInterfaceSupplementalStr1(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestInterface* castedThis = jsCast<JSTestInterface*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -248,7 +248,7 @@ JSValue jsTestInterfaceSupplementalStr1(ExecState* exec, JSValue slotBase, const
 #endif
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSValue jsTestInterfaceSupplementalStr2(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestInterfaceSupplementalStr2(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestInterface* castedThis = jsCast<JSTestInterface*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -260,7 +260,7 @@ JSValue jsTestInterfaceSupplementalStr2(ExecState* exec, JSValue slotBase, const
 #endif
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSValue jsTestInterfaceSupplementalStr3(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestInterfaceSupplementalStr3(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestInterface* castedThis = jsCast<JSTestInterface*>(asObject(slotBase));
     return castedThis->supplementalStr3(exec);
@@ -269,7 +269,7 @@ JSValue jsTestInterfaceSupplementalStr3(ExecState* exec, JSValue slotBase, const
 #endif
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSValue jsTestInterfaceSupplementalNode(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestInterfaceSupplementalNode(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestInterface* castedThis = jsCast<JSTestInterface*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -280,13 +280,13 @@ JSValue jsTestInterfaceSupplementalNode(ExecState* exec, JSValue slotBase, const
 
 #endif
 
-JSValue jsTestInterfaceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestInterfaceConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestInterface* domObject = jsCast<JSTestInterface*>(asObject(slotBase));
     return JSTestInterface::getConstructor(exec, domObject->globalObject());
 }
 
-void JSTestInterface::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void JSTestInterface::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSTestInterface* thisObject = jsCast<JSTestInterface*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
@@ -397,7 +397,7 @@ EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionSupplementalMetho
 // Constant getters
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSValue jsTestInterfaceSUPPLEMENTALCONSTANT1(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestInterfaceSUPPLEMENTALCONSTANT1(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(1));
@@ -405,7 +405,7 @@ JSValue jsTestInterfaceSUPPLEMENTALCONSTANT1(ExecState* exec, JSValue, const Ide
 
 #endif
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSValue jsTestInterfaceSUPPLEMENTALCONSTANT2(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestInterfaceSUPPLEMENTALCONSTANT2(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(2));
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
index d16bcbd29..d7963a2e9 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
@@ -42,10 +42,10 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
+    static void put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool putDelegate(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static void destroy(JSC::JSCell*);
     ~JSTestInterface();
     static const JSC::ClassInfo s_info;
@@ -113,8 +113,8 @@ public:
     }
 
     static const JSC::ClassInfo s_info;
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);
@@ -140,8 +140,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -170,28 +170,28 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionSupplemental
 // Attributes
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSC::JSValue jsTestInterfaceSupplementalStr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestInterfaceSupplementalStr1(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 #endif
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSC::JSValue jsTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #endif
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSC::JSValue jsTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #endif
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSC::JSValue jsTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #endif
-JSC::JSValue jsTestInterfaceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestInterfaceConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 // Constants
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSC::JSValue jsTestInterfaceSUPPLEMENTALCONSTANT1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestInterfaceSUPPLEMENTALCONSTANT1(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 #endif
 #if ENABLE(Condition11) || ENABLE(Condition12)
-JSC::JSValue jsTestInterfaceSUPPLEMENTALCONSTANT2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestInterfaceSUPPLEMENTALCONSTANT2(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 #endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
index 75121f192..9d589baaa 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
@@ -64,12 +64,12 @@ void JSTestMediaQueryListListenerConstructor::finishCreation(ExecState* exec, JS
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestMediaQueryListListenerPrototype::self(exec, globalObject), DontDelete | ReadOnly);
 }
 
-bool JSTestMediaQueryListListenerConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestMediaQueryListListenerConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSTestMediaQueryListListenerConstructor, JSDOMWrapper>(exec, &JSTestMediaQueryListListenerConstructorTable, jsCast<JSTestMediaQueryListListenerConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestMediaQueryListListenerConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestMediaQueryListListenerConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSTestMediaQueryListListenerConstructor, JSDOMWrapper>(exec, &JSTestMediaQueryListListenerConstructorTable, jsCast<JSTestMediaQueryListListenerConstructor*>(object), propertyName, descriptor);
 }
@@ -90,13 +90,13 @@ JSObject* JSTestMediaQueryListListenerPrototype::self(ExecState* exec, JSGlobalO
     return getDOMPrototype<JSTestMediaQueryListListener>(exec, globalObject);
 }
 
-bool JSTestMediaQueryListListenerPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestMediaQueryListListenerPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestMediaQueryListListenerPrototype* thisObject = jsCast<JSTestMediaQueryListListenerPrototype*>(cell);
     return getStaticFunctionSlot<JSObject>(exec, &JSTestMediaQueryListListenerPrototypeTable, thisObject, propertyName, slot);
 }
 
-bool JSTestMediaQueryListListenerPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestMediaQueryListListenerPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestMediaQueryListListenerPrototype* thisObject = jsCast<JSTestMediaQueryListListenerPrototype*>(object);
     return getStaticFunctionDescriptor<JSObject>(exec, &JSTestMediaQueryListListenerPrototypeTable, thisObject, propertyName, descriptor);
@@ -132,21 +132,21 @@ JSTestMediaQueryListListener::~JSTestMediaQueryListListener()
     releaseImplIfNotNull();
 }
 
-bool JSTestMediaQueryListListener::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestMediaQueryListListener::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestMediaQueryListListener* thisObject = jsCast<JSTestMediaQueryListListener*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueSlot<JSTestMediaQueryListListener, Base>(exec, &JSTestMediaQueryListListenerTable, thisObject, propertyName, slot);
 }
 
-bool JSTestMediaQueryListListener::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestMediaQueryListListener::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestMediaQueryListListener* thisObject = jsCast<JSTestMediaQueryListListener*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueDescriptor<JSTestMediaQueryListListener, Base>(exec, &JSTestMediaQueryListListenerTable, thisObject, propertyName, descriptor);
 }
 
-JSValue jsTestMediaQueryListListenerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestMediaQueryListListenerConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestMediaQueryListListener* domObject = jsCast<JSTestMediaQueryListListener*>(asObject(slotBase));
     return JSTestMediaQueryListListener::getConstructor(exec, domObject->globalObject());
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
index af5bb5800..f548c3134 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
@@ -40,8 +40,8 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
     ~JSTestMediaQueryListListener();
     static const JSC::ClassInfo s_info;
@@ -96,8 +96,8 @@ public:
     }
 
     static const JSC::ClassInfo s_info;
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);
@@ -123,8 +123,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -139,7 +139,7 @@ protected:
 JSC::EncodedJSValue JSC_HOST_CALL jsTestMediaQueryListListenerPrototypeFunctionMethod(JSC::ExecState*);
 // Attributes
 
-JSC::JSValue jsTestMediaQueryListListenerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestMediaQueryListListenerConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
index 4b654e0e2..9c7686790 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
@@ -63,12 +63,12 @@ void JSTestNamedConstructorConstructor::finishCreation(ExecState* exec, JSDOMGlo
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestNamedConstructorPrototype::self(exec, globalObject), DontDelete | ReadOnly);
 }
 
-bool JSTestNamedConstructorConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestNamedConstructorConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSTestNamedConstructorConstructor, JSDOMWrapper>(exec, &JSTestNamedConstructorConstructorTable, jsCast<JSTestNamedConstructorConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestNamedConstructorConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestNamedConstructorConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSTestNamedConstructorConstructor, JSDOMWrapper>(exec, &JSTestNamedConstructorConstructorTable, jsCast<JSTestNamedConstructorConstructor*>(object), propertyName, descriptor);
 }
@@ -161,21 +161,21 @@ JSTestNamedConstructor::~JSTestNamedConstructor()
     releaseImplIfNotNull();
 }
 
-bool JSTestNamedConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestNamedConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestNamedConstructor* thisObject = jsCast<JSTestNamedConstructor*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueSlot<JSTestNamedConstructor, Base>(exec, &JSTestNamedConstructorTable, thisObject, propertyName, slot);
 }
 
-bool JSTestNamedConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestNamedConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestNamedConstructor* thisObject = jsCast<JSTestNamedConstructor*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueDescriptor<JSTestNamedConstructor, Base>(exec, &JSTestNamedConstructorTable, thisObject, propertyName, descriptor);
 }
 
-JSValue jsTestNamedConstructorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestNamedConstructorConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestNamedConstructor* domObject = jsCast<JSTestNamedConstructor*>(asObject(slotBase));
     return JSTestNamedConstructor::getConstructor(exec, domObject->globalObject());
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
index f93f97f2f..c6628fbf5 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
@@ -40,8 +40,8 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
     ~JSTestNamedConstructor();
     static const JSC::ClassInfo s_info;
@@ -121,8 +121,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -159,7 +159,7 @@ private:
 
 // Attributes
 
-JSC::JSValue jsTestNamedConstructorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestNamedConstructorConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp
index 4399661c5..e05ac08ab 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp
@@ -64,12 +64,12 @@ void JSTestNodeConstructor::finishCreation(ExecState* exec, JSDOMGlobalObject* g
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
 }
 
-bool JSTestNodeConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestNodeConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSTestNodeConstructor, JSDOMWrapper>(exec, &JSTestNodeConstructorTable, jsCast<JSTestNodeConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestNodeConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestNodeConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSTestNodeConstructor, JSDOMWrapper>(exec, &JSTestNodeConstructorTable, jsCast<JSTestNodeConstructor*>(object), propertyName, descriptor);
 }
@@ -120,21 +120,21 @@ JSObject* JSTestNode::createPrototype(ExecState* exec, JSGlobalObject* globalObj
     return JSTestNodePrototype::create(exec->globalData(), globalObject, JSTestNodePrototype::createStructure(exec->globalData(), globalObject, JSNodePrototype::self(exec, globalObject)));
 }
 
-bool JSTestNode::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestNode::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestNode* thisObject = jsCast<JSTestNode*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueSlot<JSTestNode, Base>(exec, &JSTestNodeTable, thisObject, propertyName, slot);
 }
 
-bool JSTestNode::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestNode::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestNode* thisObject = jsCast<JSTestNode*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueDescriptor<JSTestNode, Base>(exec, &JSTestNodeTable, thisObject, propertyName, descriptor);
 }
 
-JSValue jsTestNodeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestNodeConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestNode* domObject = jsCast<JSTestNode*>(asObject(slotBase));
     return JSTestNode::getConstructor(exec, domObject->globalObject());
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestNode.h b/Source/WebCore/bindings/scripts/test/JS/JSTestNode.h
index 5f8706fd3..30cb8181c 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestNode.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestNode.h
@@ -39,8 +39,8 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
@@ -95,8 +95,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -110,7 +110,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsTestNodeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestNodeConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index 6a39cf415..1f79123f5 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -221,12 +221,12 @@ void JSTestObjConstructor::finishCreation(ExecState* exec, JSDOMGlobalObject* gl
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
 }
 
-bool JSTestObjConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestObjConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticPropertySlot<JSTestObjConstructor, JSDOMWrapper>(exec, &JSTestObjConstructorTable, jsCast<JSTestObjConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestObjConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestObjConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticPropertyDescriptor<JSTestObjConstructor, JSDOMWrapper>(exec, &JSTestObjConstructorTable, jsCast<JSTestObjConstructor*>(object), propertyName, descriptor);
 }
@@ -337,13 +337,13 @@ JSObject* JSTestObjPrototype::self(ExecState* exec, JSGlobalObject* globalObject
     return getDOMPrototype<JSTestObj>(exec, globalObject);
 }
 
-bool JSTestObjPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestObjPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestObjPrototype* thisObject = jsCast<JSTestObjPrototype*>(cell);
     return getStaticPropertySlot<JSTestObjPrototype, JSObject>(exec, &JSTestObjPrototypeTable, thisObject, propertyName, slot);
 }
 
-bool JSTestObjPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestObjPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestObjPrototype* thisObject = jsCast<JSTestObjPrototype*>(object);
     return getStaticPropertyDescriptor<JSTestObjPrototype, JSObject>(exec, &JSTestObjPrototypeTable, thisObject, propertyName, descriptor);
@@ -379,21 +379,21 @@ JSTestObj::~JSTestObj()
     releaseImplIfNotNull();
 }
 
-bool JSTestObj::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestObj::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestObj* thisObject = jsCast<JSTestObj*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueSlot<JSTestObj, Base>(exec, &JSTestObjTable, thisObject, propertyName, slot);
 }
 
-bool JSTestObj::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestObj::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestObj* thisObject = jsCast<JSTestObj*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueDescriptor<JSTestObj, Base>(exec, &JSTestObjTable, thisObject, propertyName, descriptor);
 }
 
-JSValue jsTestObjReadOnlyIntAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReadOnlyIntAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -403,7 +403,7 @@ JSValue jsTestObjReadOnlyIntAttr(ExecState* exec, JSValue slotBase, const Identi
 }
 
 
-JSValue jsTestObjReadOnlyStringAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReadOnlyStringAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -413,7 +413,7 @@ JSValue jsTestObjReadOnlyStringAttr(ExecState* exec, JSValue slotBase, const Ide
 }
 
 
-JSValue jsTestObjReadOnlyTestObjAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReadOnlyTestObjAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -423,7 +423,7 @@ JSValue jsTestObjReadOnlyTestObjAttr(ExecState* exec, JSValue slotBase, const Id
 }
 
 
-JSValue jsTestObjShortAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjShortAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -433,7 +433,7 @@ JSValue jsTestObjShortAttr(ExecState* exec, JSValue slotBase, const Identifier&)
 }
 
 
-JSValue jsTestObjUnsignedShortAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjUnsignedShortAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -443,7 +443,7 @@ JSValue jsTestObjUnsignedShortAttr(ExecState* exec, JSValue slotBase, const Iden
 }
 
 
-JSValue jsTestObjIntAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjIntAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -453,7 +453,7 @@ JSValue jsTestObjIntAttr(ExecState* exec, JSValue slotBase, const Identifier&)
 }
 
 
-JSValue jsTestObjLongLongAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjLongLongAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -463,7 +463,7 @@ JSValue jsTestObjLongLongAttr(ExecState* exec, JSValue slotBase, const Identifie
 }
 
 
-JSValue jsTestObjUnsignedLongLongAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjUnsignedLongLongAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -473,7 +473,7 @@ JSValue jsTestObjUnsignedLongLongAttr(ExecState* exec, JSValue slotBase, const I
 }
 
 
-JSValue jsTestObjStringAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjStringAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -483,7 +483,7 @@ JSValue jsTestObjStringAttr(ExecState* exec, JSValue slotBase, const Identifier&
 }
 
 
-JSValue jsTestObjTestObjAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjTestObjAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -493,7 +493,7 @@ JSValue jsTestObjTestObjAttr(ExecState* exec, JSValue slotBase, const Identifier
 }
 
 
-JSValue jsTestObjSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -503,7 +503,7 @@ JSValue jsTestObjSequenceAttr(ExecState* exec, JSValue slotBase, const Identifie
 }
 
 
-JSValue jsTestObjIntSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjIntSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -513,7 +513,7 @@ JSValue jsTestObjIntSequenceAttr(ExecState* exec, JSValue slotBase, const Identi
 }
 
 
-JSValue jsTestObjShortSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjShortSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -523,7 +523,7 @@ JSValue jsTestObjShortSequenceAttr(ExecState* exec, JSValue slotBase, const Iden
 }
 
 
-JSValue jsTestObjLongSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjLongSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -533,7 +533,7 @@ JSValue jsTestObjLongSequenceAttr(ExecState* exec, JSValue slotBase, const Ident
 }
 
 
-JSValue jsTestObjLongLongSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjLongLongSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -543,7 +543,7 @@ JSValue jsTestObjLongLongSequenceAttr(ExecState* exec, JSValue slotBase, const I
 }
 
 
-JSValue jsTestObjUnsignedIntSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjUnsignedIntSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -553,7 +553,7 @@ JSValue jsTestObjUnsignedIntSequenceAttr(ExecState* exec, JSValue slotBase, cons
 }
 
 
-JSValue jsTestObjUnsignedShortSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjUnsignedShortSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -563,7 +563,7 @@ JSValue jsTestObjUnsignedShortSequenceAttr(ExecState* exec, JSValue slotBase, co
 }
 
 
-JSValue jsTestObjUnsignedLongSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjUnsignedLongSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -573,7 +573,7 @@ JSValue jsTestObjUnsignedLongSequenceAttr(ExecState* exec, JSValue slotBase, con
 }
 
 
-JSValue jsTestObjUnsignedLongLongSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjUnsignedLongLongSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -583,7 +583,7 @@ JSValue jsTestObjUnsignedLongLongSequenceAttr(ExecState* exec, JSValue slotBase,
 }
 
 
-JSValue jsTestObjFloatSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjFloatSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -593,7 +593,7 @@ JSValue jsTestObjFloatSequenceAttr(ExecState* exec, JSValue slotBase, const Iden
 }
 
 
-JSValue jsTestObjDoubleSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjDoubleSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -603,7 +603,7 @@ JSValue jsTestObjDoubleSequenceAttr(ExecState* exec, JSValue slotBase, const Ide
 }
 
 
-JSValue jsTestObjBooleanSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjBooleanSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -613,7 +613,7 @@ JSValue jsTestObjBooleanSequenceAttr(ExecState* exec, JSValue slotBase, const Id
 }
 
 
-JSValue jsTestObjVoidSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjVoidSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -623,7 +623,7 @@ JSValue jsTestObjVoidSequenceAttr(ExecState* exec, JSValue slotBase, const Ident
 }
 
 
-JSValue jsTestObjDateSequenceAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjDateSequenceAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -633,7 +633,7 @@ JSValue jsTestObjDateSequenceAttr(ExecState* exec, JSValue slotBase, const Ident
 }
 
 
-JSValue jsTestObjXMLObjAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjXMLObjAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -643,7 +643,7 @@ JSValue jsTestObjXMLObjAttr(ExecState* exec, JSValue slotBase, const Identifier&
 }
 
 
-JSValue jsTestObjCreate(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjCreate(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -653,7 +653,7 @@ JSValue jsTestObjCreate(ExecState* exec, JSValue slotBase, const Identifier&)
 }
 
 
-JSValue jsTestObjReflectedStringAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReflectedStringAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -663,7 +663,7 @@ JSValue jsTestObjReflectedStringAttr(ExecState* exec, JSValue slotBase, const Id
 }
 
 
-JSValue jsTestObjReflectedIntegralAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReflectedIntegralAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -673,7 +673,7 @@ JSValue jsTestObjReflectedIntegralAttr(ExecState* exec, JSValue slotBase, const
 }
 
 
-JSValue jsTestObjReflectedUnsignedIntegralAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReflectedUnsignedIntegralAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -683,7 +683,7 @@ JSValue jsTestObjReflectedUnsignedIntegralAttr(ExecState* exec, JSValue slotBase
 }
 
 
-JSValue jsTestObjReflectedBooleanAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReflectedBooleanAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -693,7 +693,7 @@ JSValue jsTestObjReflectedBooleanAttr(ExecState* exec, JSValue slotBase, const I
 }
 
 
-JSValue jsTestObjReflectedURLAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReflectedURLAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -703,7 +703,7 @@ JSValue jsTestObjReflectedURLAttr(ExecState* exec, JSValue slotBase, const Ident
 }
 
 
-JSValue jsTestObjReflectedStringAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReflectedStringAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -713,7 +713,7 @@ JSValue jsTestObjReflectedStringAttr(ExecState* exec, JSValue slotBase, const Id
 }
 
 
-JSValue jsTestObjReflectedCustomIntegralAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReflectedCustomIntegralAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -723,7 +723,7 @@ JSValue jsTestObjReflectedCustomIntegralAttr(ExecState* exec, JSValue slotBase,
 }
 
 
-JSValue jsTestObjReflectedCustomBooleanAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReflectedCustomBooleanAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -733,7 +733,7 @@ JSValue jsTestObjReflectedCustomBooleanAttr(ExecState* exec, JSValue slotBase, c
 }
 
 
-JSValue jsTestObjReflectedCustomURLAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjReflectedCustomURLAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -743,7 +743,7 @@ JSValue jsTestObjReflectedCustomURLAttr(ExecState* exec, JSValue slotBase, const
 }
 
 
-JSValue jsTestObjAttrWithGetterException(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjAttrWithGetterException(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     ExceptionCode ec = 0;
@@ -754,7 +754,7 @@ JSValue jsTestObjAttrWithGetterException(ExecState* exec, JSValue slotBase, cons
 }
 
 
-JSValue jsTestObjAttrWithSetterException(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjAttrWithSetterException(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -764,7 +764,7 @@ JSValue jsTestObjAttrWithSetterException(ExecState* exec, JSValue slotBase, cons
 }
 
 
-JSValue jsTestObjStringAttrWithGetterException(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjStringAttrWithGetterException(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     ExceptionCode ec = 0;
@@ -775,7 +775,7 @@ JSValue jsTestObjStringAttrWithGetterException(ExecState* exec, JSValue slotBase
 }
 
 
-JSValue jsTestObjStringAttrWithSetterException(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjStringAttrWithSetterException(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -785,14 +785,14 @@ JSValue jsTestObjStringAttrWithSetterException(ExecState* exec, JSValue slotBase
 }
 
 
-JSValue jsTestObjCustomAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjCustomAttr(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     return castedThis->customAttr(exec);
 }
 
 
-JSValue jsTestObjWithScriptStateAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptStateAttribute(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
@@ -801,7 +801,7 @@ JSValue jsTestObjWithScriptStateAttribute(ExecState* exec, JSValue slotBase, con
 }
 
 
-JSValue jsTestObjWithScriptExecutionContextAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptExecutionContextAttribute(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
@@ -813,7 +813,7 @@ JSValue jsTestObjWithScriptExecutionContextAttribute(ExecState* exec, JSValue sl
 }
 
 
-JSValue jsTestObjWithScriptStateAttributeRaises(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptStateAttributeRaises(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     ExceptionCode ec = 0;
@@ -824,7 +824,7 @@ JSValue jsTestObjWithScriptStateAttributeRaises(ExecState* exec, JSValue slotBas
 }
 
 
-JSValue jsTestObjWithScriptExecutionContextAttributeRaises(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptExecutionContextAttributeRaises(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     ExceptionCode ec = 0;
@@ -838,7 +838,7 @@ JSValue jsTestObjWithScriptExecutionContextAttributeRaises(ExecState* exec, JSVa
 }
 
 
-JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
@@ -850,7 +850,7 @@ JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* ex
 }
 
 
-JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     ExceptionCode ec = 0;
@@ -864,7 +864,7 @@ JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecSta
 }
 
 
-JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
@@ -876,7 +876,7 @@ JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(Exe
 }
 
 
-JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
@@ -887,7 +887,7 @@ JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* exec, JSVal
 
 
 #if ENABLE(Condition1)
-JSValue jsTestObjConditionalAttr1(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjConditionalAttr1(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -899,7 +899,7 @@ JSValue jsTestObjConditionalAttr1(ExecState* exec, JSValue slotBase, const Ident
 #endif
 
 #if ENABLE(Condition1) && ENABLE(Condition2)
-JSValue jsTestObjConditionalAttr2(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjConditionalAttr2(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -911,7 +911,7 @@ JSValue jsTestObjConditionalAttr2(ExecState* exec, JSValue slotBase, const Ident
 #endif
 
 #if ENABLE(Condition1) || ENABLE(Condition2)
-JSValue jsTestObjConditionalAttr3(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjConditionalAttr3(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -923,7 +923,7 @@ JSValue jsTestObjConditionalAttr3(ExecState* exec, JSValue slotBase, const Ident
 #endif
 
 #if ENABLE(Condition1)
-JSValue jsTestObjConditionalAttr4Constructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjConditionalAttr4Constructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     return JSTestObjectA::getConstructor(exec, castedThis);
@@ -932,7 +932,7 @@ JSValue jsTestObjConditionalAttr4Constructor(ExecState* exec, JSValue slotBase,
 #endif
 
 #if ENABLE(Condition1) && ENABLE(Condition2)
-JSValue jsTestObjConditionalAttr5Constructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjConditionalAttr5Constructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     return JSTestObjectB::getConstructor(exec, castedThis);
@@ -941,7 +941,7 @@ JSValue jsTestObjConditionalAttr5Constructor(ExecState* exec, JSValue slotBase,
 #endif
 
 #if ENABLE(Condition1) || ENABLE(Condition2)
-JSValue jsTestObjConditionalAttr6Constructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjConditionalAttr6Constructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     return JSTestObjectC::getConstructor(exec, castedThis);
@@ -949,7 +949,7 @@ JSValue jsTestObjConditionalAttr6Constructor(ExecState* exec, JSValue slotBase,
 
 #endif
 
-JSValue jsTestObjCachedAttribute1(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjCachedAttribute1(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -962,7 +962,7 @@ JSValue jsTestObjCachedAttribute1(ExecState* exec, JSValue slotBase, const Ident
 }
 
 
-JSValue jsTestObjCachedAttribute2(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjCachedAttribute2(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -975,7 +975,7 @@ JSValue jsTestObjCachedAttribute2(ExecState* exec, JSValue slotBase, const Ident
 }
 
 
-JSValue jsTestObjContentDocument(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjContentDocument(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
@@ -983,7 +983,7 @@ JSValue jsTestObjContentDocument(ExecState* exec, JSValue slotBase, const Identi
 }
 
 
-JSValue jsTestObjMutablePoint(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjMutablePoint(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -993,7 +993,7 @@ JSValue jsTestObjMutablePoint(ExecState* exec, JSValue slotBase, const Identifie
 }
 
 
-JSValue jsTestObjImmutablePoint(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjImmutablePoint(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -1003,7 +1003,7 @@ JSValue jsTestObjImmutablePoint(ExecState* exec, JSValue slotBase, const Identif
 }
 
 
-JSValue jsTestObjStrawberry(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjStrawberry(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -1013,7 +1013,7 @@ JSValue jsTestObjStrawberry(ExecState* exec, JSValue slotBase, const Identifier&
 }
 
 
-JSValue jsTestObjStrictFloat(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjStrictFloat(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -1023,7 +1023,7 @@ JSValue jsTestObjStrictFloat(ExecState* exec, JSValue slotBase, const Identifier
 }
 
 
-JSValue jsTestObjDescription(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjDescription(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -1033,7 +1033,7 @@ JSValue jsTestObjDescription(ExecState* exec, JSValue slotBase, const Identifier
 }
 
 
-JSValue jsTestObjId(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjId(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -1043,7 +1043,7 @@ JSValue jsTestObjId(ExecState* exec, JSValue slotBase, const Identifier&)
 }
 
 
-JSValue jsTestObjHash(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjHash(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -1053,13 +1053,13 @@ JSValue jsTestObjHash(ExecState* exec, JSValue slotBase, const Identifier&)
 }
 
 
-JSValue jsTestObjConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestObj* domObject = jsCast<JSTestObj*>(asObject(slotBase));
     return JSTestObj::getConstructor(exec, domObject->globalObject());
 }
 
-void JSTestObj::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void JSTestObj::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSTestObj* thisObject = jsCast<JSTestObj*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
@@ -2658,79 +2658,79 @@ void JSTestObj::visitChildren(JSCell* cell, SlotVisitor& visitor)
 // Constant getters
 
 #if ENABLE(Condition1)
-JSValue jsTestObjCONDITIONAL_CONST(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONDITIONAL_CONST(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(0));
 }
 
 #endif
-JSValue jsTestObjCONST_VALUE_0(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_0(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(0));
 }
 
-JSValue jsTestObjCONST_VALUE_1(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_1(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(1));
 }
 
-JSValue jsTestObjCONST_VALUE_2(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_2(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(2));
 }
 
-JSValue jsTestObjCONST_VALUE_4(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_4(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(4));
 }
 
-JSValue jsTestObjCONST_VALUE_8(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_8(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(8));
 }
 
-JSValue jsTestObjCONST_VALUE_9(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_9(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(-1));
 }
 
-JSValue jsTestObjCONST_VALUE_10(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_10(ExecState* exec, JSValue, PropertyName)
 {
     return jsStringOrNull(exec, String("my constant string"));
 }
 
-JSValue jsTestObjCONST_VALUE_11(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_11(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(0xffffffff));
 }
 
-JSValue jsTestObjCONST_VALUE_12(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_12(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(0x01));
 }
 
-JSValue jsTestObjCONST_VALUE_13(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_13(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(0X20));
 }
 
-JSValue jsTestObjCONST_VALUE_14(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_VALUE_14(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(0x1abc));
 }
 
-JSValue jsTestObjCONST_JAVASCRIPT(ExecState* exec, JSValue, const Identifier&)
+JSValue jsTestObjCONST_JAVASCRIPT(ExecState* exec, JSValue, PropertyName)
 {
     UNUSED_PARAM(exec);
     return jsNumber(static_cast<int>(15));
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
index b8dca2e02..2f7086d6a 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -40,9 +40,9 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
+    static void put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static void destroy(JSC::JSCell*);
     ~JSTestObj();
     static const JSC::ClassInfo s_info;
@@ -110,8 +110,8 @@ public:
     }
 
     static const JSC::ClassInfo s_info;
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);
@@ -137,8 +137,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -216,156 +216,156 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOrange(JSC::ExecStat
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionStrictFunction(JSC::ExecState*);
 // Attributes
 
-JSC::JSValue jsTestObjReadOnlyIntAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjReadOnlyStringAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjReadOnlyTestObjAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjShortAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReadOnlyIntAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjReadOnlyStringAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjReadOnlyTestObjAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjShortAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjShortAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjUnsignedShortAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjUnsignedShortAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjUnsignedShortAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjIntAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjIntAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjIntAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjLongLongAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjLongLongAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjLongLongAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjUnsignedLongLongAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjUnsignedLongLongAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjUnsignedLongLongAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjStringAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjStringAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjStringAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjTestObjAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjTestObjAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjTestObjAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjIntSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjIntSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjIntSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjShortSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjShortSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjShortSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjLongSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjLongSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjLongSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjLongLongSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjLongLongSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjLongLongSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjUnsignedIntSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjUnsignedIntSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjUnsignedIntSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjUnsignedShortSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjUnsignedShortSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjUnsignedShortSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjUnsignedLongSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjUnsignedLongSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjUnsignedLongSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjUnsignedLongLongSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjUnsignedLongLongSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjUnsignedLongLongSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjFloatSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjFloatSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjFloatSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjDoubleSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjDoubleSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjDoubleSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjBooleanSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjBooleanSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjBooleanSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjVoidSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjVoidSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjVoidSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjDateSequenceAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjDateSequenceAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjDateSequenceAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjXMLObjAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjXMLObjAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjXMLObjAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjCreate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjCreate(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjCreate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjReflectedStringAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReflectedStringAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedStringAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjReflectedIntegralAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReflectedIntegralAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedIntegralAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjReflectedUnsignedIntegralAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReflectedUnsignedIntegralAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedUnsignedIntegralAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjReflectedBooleanAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReflectedBooleanAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedBooleanAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjReflectedURLAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReflectedURLAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedURLAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjReflectedStringAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReflectedStringAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedStringAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjReflectedCustomIntegralAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReflectedCustomIntegralAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedCustomIntegralAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjReflectedCustomBooleanAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReflectedCustomBooleanAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedCustomBooleanAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjReflectedCustomURLAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjReflectedCustomURLAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjReflectedCustomURLAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjAttrWithGetterException(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjAttrWithGetterException(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjAttrWithGetterException(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjAttrWithSetterException(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjAttrWithSetterException(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjAttrWithSetterException(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjStringAttrWithGetterException(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjStringAttrWithGetterException(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjStringAttrWithGetterException(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjStringAttrWithSetterException(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjStringAttrWithSetterException(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjStringAttrWithSetterException(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjCustomAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjCustomAttr(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjCustomAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjWithScriptStateAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptStateAttribute(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjWithScriptStateAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjWithScriptExecutionContextAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptExecutionContextAttribute(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjWithScriptExecutionContextAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjWithScriptStateAttributeRaises(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptStateAttributeRaises(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjWithScriptStateAttributeRaises(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjWithScriptExecutionContextAttributeRaises(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptExecutionContextAttributeRaises(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjWithScriptExecutionContextAttributeRaises(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjWithScriptExecutionContextAndScriptStateAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #if ENABLE(Condition1)
-JSC::JSValue jsTestObjConditionalAttr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjConditionalAttr1(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjConditionalAttr1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #endif
 #if ENABLE(Condition1) && ENABLE(Condition2)
-JSC::JSValue jsTestObjConditionalAttr2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjConditionalAttr2(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjConditionalAttr2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #endif
 #if ENABLE(Condition1) || ENABLE(Condition2)
-JSC::JSValue jsTestObjConditionalAttr3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjConditionalAttr3(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjConditionalAttr3(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #endif
 #if ENABLE(Condition1)
-JSC::JSValue jsTestObjConditionalAttr4Constructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjConditionalAttr4Constructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjConditionalAttr4Constructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #endif
 #if ENABLE(Condition1) && ENABLE(Condition2)
-JSC::JSValue jsTestObjConditionalAttr5Constructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjConditionalAttr5Constructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjConditionalAttr5Constructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #endif
 #if ENABLE(Condition1) || ENABLE(Condition2)
-JSC::JSValue jsTestObjConditionalAttr6Constructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjConditionalAttr6Constructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjConditionalAttr6Constructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 #endif
-JSC::JSValue jsTestObjCachedAttribute1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCachedAttribute2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjContentDocument(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjMutablePoint(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjCachedAttribute1(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCachedAttribute2(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjContentDocument(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjMutablePoint(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjMutablePoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjImmutablePoint(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjImmutablePoint(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjImmutablePoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjStrawberry(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjStrawberry(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjStrawberry(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjStrictFloat(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjStrictFloat(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjStrictFloat(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjDescription(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjDescription(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjId(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestObjId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjHash(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjHash(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 // Constants
 
 #if ENABLE(Condition1)
-JSC::JSValue jsTestObjCONDITIONAL_CONST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjCONDITIONAL_CONST(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 #endif
-JSC::JSValue jsTestObjCONST_VALUE_0(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_4(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_8(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_9(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_10(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_11(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_12(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_13(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_VALUE_14(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestObjCONST_JAVASCRIPT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjCONST_VALUE_0(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_1(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_2(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_4(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_8(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_9(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_10(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_11(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_12(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_13(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_VALUE_14(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestObjCONST_JAVASCRIPT(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
index db5304973..90332ec56 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
@@ -76,12 +76,12 @@ void JSTestSerializedScriptValueInterfaceConstructor::finishCreation(ExecState*
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(3), ReadOnly | DontDelete | DontEnum);
 }
 
-bool JSTestSerializedScriptValueInterfaceConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestSerializedScriptValueInterfaceConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<JSTestSerializedScriptValueInterfaceConstructor, JSDOMWrapper>(exec, &JSTestSerializedScriptValueInterfaceConstructorTable, jsCast<JSTestSerializedScriptValueInterfaceConstructor*>(cell), propertyName, slot);
 }
 
-bool JSTestSerializedScriptValueInterfaceConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestSerializedScriptValueInterfaceConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     return getStaticValueDescriptor<JSTestSerializedScriptValueInterfaceConstructor, JSDOMWrapper>(exec, &JSTestSerializedScriptValueInterfaceConstructorTable, jsCast<JSTestSerializedScriptValueInterfaceConstructor*>(object), propertyName, descriptor);
 }
@@ -127,13 +127,13 @@ JSObject* JSTestSerializedScriptValueInterfacePrototype::self(ExecState* exec, J
     return getDOMPrototype<JSTestSerializedScriptValueInterface>(exec, globalObject);
 }
 
-bool JSTestSerializedScriptValueInterfacePrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestSerializedScriptValueInterfacePrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestSerializedScriptValueInterfacePrototype* thisObject = jsCast<JSTestSerializedScriptValueInterfacePrototype*>(cell);
     return getStaticFunctionSlot<JSObject>(exec, &JSTestSerializedScriptValueInterfacePrototypeTable, thisObject, propertyName, slot);
 }
 
-bool JSTestSerializedScriptValueInterfacePrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestSerializedScriptValueInterfacePrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestSerializedScriptValueInterfacePrototype* thisObject = jsCast<JSTestSerializedScriptValueInterfacePrototype*>(object);
     return getStaticFunctionDescriptor<JSObject>(exec, &JSTestSerializedScriptValueInterfacePrototypeTable, thisObject, propertyName, descriptor);
@@ -169,21 +169,21 @@ JSTestSerializedScriptValueInterface::~JSTestSerializedScriptValueInterface()
     releaseImplIfNotNull();
 }
 
-bool JSTestSerializedScriptValueInterface::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSTestSerializedScriptValueInterface::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSTestSerializedScriptValueInterface* thisObject = jsCast<JSTestSerializedScriptValueInterface*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueSlot<JSTestSerializedScriptValueInterface, Base>(exec, &JSTestSerializedScriptValueInterfaceTable, thisObject, propertyName, slot);
 }
 
-bool JSTestSerializedScriptValueInterface::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSTestSerializedScriptValueInterface::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSTestSerializedScriptValueInterface* thisObject = jsCast<JSTestSerializedScriptValueInterface*>(object);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     return getStaticValueDescriptor<JSTestSerializedScriptValueInterface, Base>(exec, &JSTestSerializedScriptValueInterfaceTable, thisObject, propertyName, descriptor);
 }
 
-JSValue jsTestSerializedScriptValueInterfaceValue(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestSerializedScriptValueInterfaceValue(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestSerializedScriptValueInterface* castedThis = jsCast<JSTestSerializedScriptValueInterface*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -193,7 +193,7 @@ JSValue jsTestSerializedScriptValueInterfaceValue(ExecState* exec, JSValue slotB
 }
 
 
-JSValue jsTestSerializedScriptValueInterfaceReadonlyValue(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestSerializedScriptValueInterfaceReadonlyValue(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestSerializedScriptValueInterface* castedThis = jsCast<JSTestSerializedScriptValueInterface*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -203,7 +203,7 @@ JSValue jsTestSerializedScriptValueInterfaceReadonlyValue(ExecState* exec, JSVal
 }
 
 
-JSValue jsTestSerializedScriptValueInterfaceCachedValue(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestSerializedScriptValueInterfaceCachedValue(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestSerializedScriptValueInterface* castedThis = jsCast<JSTestSerializedScriptValueInterface*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -216,7 +216,7 @@ JSValue jsTestSerializedScriptValueInterfaceCachedValue(ExecState* exec, JSValue
 }
 
 
-JSValue jsTestSerializedScriptValueInterfacePorts(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestSerializedScriptValueInterfacePorts(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestSerializedScriptValueInterface* castedThis = jsCast<JSTestSerializedScriptValueInterface*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -226,7 +226,7 @@ JSValue jsTestSerializedScriptValueInterfacePorts(ExecState* exec, JSValue slotB
 }
 
 
-JSValue jsTestSerializedScriptValueInterfaceCachedReadonlyValue(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestSerializedScriptValueInterfaceCachedReadonlyValue(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestSerializedScriptValueInterface* castedThis = jsCast<JSTestSerializedScriptValueInterface*>(asObject(slotBase));
     UNUSED_PARAM(exec);
@@ -239,13 +239,13 @@ JSValue jsTestSerializedScriptValueInterfaceCachedReadonlyValue(ExecState* exec,
 }
 
 
-JSValue jsTestSerializedScriptValueInterfaceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestSerializedScriptValueInterfaceConstructor(ExecState* exec, JSValue slotBase, PropertyName)
 {
     JSTestSerializedScriptValueInterface* domObject = jsCast<JSTestSerializedScriptValueInterface*>(asObject(slotBase));
     return JSTestSerializedScriptValueInterface::getConstructor(exec, domObject->globalObject());
 }
 
-void JSTestSerializedScriptValueInterface::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void JSTestSerializedScriptValueInterface::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSTestSerializedScriptValueInterface* thisObject = jsCast<JSTestSerializedScriptValueInterface*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
index 80df1e0b7..af29259eb 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
@@ -42,9 +42,9 @@ public:
     }
 
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
+    static void put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static void destroy(JSC::JSCell*);
     ~JSTestSerializedScriptValueInterface();
     static const JSC::ClassInfo s_info;
@@ -103,8 +103,8 @@ public:
     }
 
     static const JSC::ClassInfo s_info;
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);
@@ -130,8 +130,8 @@ public:
         return ptr;
     }
 
-    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
     {
@@ -149,14 +149,14 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestSerializedScriptValueInterfacePrototypeF
 JSC::EncodedJSValue JSC_HOST_CALL jsTestSerializedScriptValueInterfacePrototypeFunctionMultiTransferList(JSC::ExecState*);
 // Attributes
 
-JSC::JSValue jsTestSerializedScriptValueInterfaceValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestSerializedScriptValueInterfaceValue(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestSerializedScriptValueInterfaceValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestSerializedScriptValueInterfaceReadonlyValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestSerializedScriptValueInterfaceCachedValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestSerializedScriptValueInterfaceReadonlyValue(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestSerializedScriptValueInterfaceCachedValue(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 void setJSTestSerializedScriptValueInterfaceCachedValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestSerializedScriptValueInterfacePorts(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestSerializedScriptValueInterfaceCachedReadonlyValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsTestSerializedScriptValueInterfaceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestSerializedScriptValueInterfacePorts(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestSerializedScriptValueInterfaceCachedReadonlyValue(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
+JSC::JSValue jsTestSerializedScriptValueInterfaceConstructor(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
index feb22aee9..a227269b9 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
@@ -67,7 +67,7 @@ v8::Handle<v8::Value> V8TestEventConstructor::constructorCallback(const v8::Argu
     INC_STATS("DOM.TestEventConstructor.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index 263b425eb..20e098c81 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -208,7 +208,7 @@ v8::Handle<v8::Value> V8TestInterface::constructorCallback(const v8::Arguments&
     INC_STATS("DOM.TestInterface.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -221,7 +221,7 @@ v8::Handle<v8::Value> V8TestInterface::constructorCallback(const v8::Arguments&
 
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
-        return throwError("TestInterface constructor's associated context is not available", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "TestInterface constructor's associated context is not available");
 
     RefPtr<TestInterface> impl = TestInterface::create(context, str1, str2, ec);
     v8::Handle<v8::Object> wrapper = args.Holder();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
index 53c3c4b64..f1e8c367b 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
@@ -48,14 +48,14 @@ static v8::Handle<v8::Value> V8TestNamedConstructorConstructorCallback(const v8:
     INC_STATS("DOM.TestNamedConstructor.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
 
     Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
     if (!frame)
-        return throwError("TestNamedConstructor constructor associated frame is unavailable", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "TestNamedConstructor constructor associated frame is unavailable");
 
     Document* document = frame->document();
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
index dc4943c41..af7131b1b 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
@@ -45,7 +45,7 @@ v8::Handle<v8::Value> V8TestNode::constructorCallback(const v8::Arguments& args)
     INC_STATS("DOM.TestNode.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 39c13b6f2..e2d10cfbc 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -1351,7 +1351,7 @@ static v8::Handle<v8::Value> optionsObjectCallback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     EXCEPTION_BLOCK(Dictionary, oo, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     if (args.Length() > 0 && !oo.isUndefinedOrNull() && !oo.isObject()) {
-        return throwError("Not an object.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("Not an object.");
     }
     if (args.Length() <= 1) {
         imp->optionsObject(oo);
@@ -1359,7 +1359,7 @@ static v8::Handle<v8::Value> optionsObjectCallback(const v8::Arguments& args)
     }
     EXCEPTION_BLOCK(Dictionary, ooo, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
     if (args.Length() > 1 && !ooo.isUndefinedOrNull() && !ooo.isObject()) {
-        return throwError("Not an object.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("Not an object.");
     }
     imp->optionsObject(oo, ooo);
     return v8::Handle<v8::Value>();
@@ -2234,7 +2234,7 @@ v8::Handle<v8::Value> V8TestObj::constructorCallback(const v8::Arguments& args)
     INC_STATS("DOM.TestObj.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index a99a0cf54..bc5bf7a83 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -27,12 +27,12 @@
 #include "MessagePort.h"
 #include "RuntimeEnabledFeatures.h"
 #include "SerializedScriptValue.h"
-#include "V8Array.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
 #include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
+#include "V8MessagePort.h"
 #include "V8Proxy.h"
 #include <wtf/ArrayBuffer.h>
 #include <wtf/UnusedParam.h>
@@ -130,7 +130,7 @@ static v8::Handle<v8::Value> acceptTransferListCallback(const v8::Arguments& arg
     ArrayBufferArray arrayBufferArrayTransferList;
     if (args.Length() > 1) {
         if (!extractTransferables(args[1], messagePortArrayTransferList, arrayBufferArrayTransferList))
-            return throwError("Could not extract transferables", V8Proxy::TypeError);
+            return V8Proxy::throwTypeError("Could not extract transferables");
     }
     bool dataDidThrow = false;
     RefPtr<SerializedScriptValue> data = SerializedScriptValue::create(args[0], &messagePortArrayTransferList, &arrayBufferArrayTransferList, dataDidThrow, args.GetIsolate());
@@ -156,7 +156,7 @@ static v8::Handle<v8::Value> multiTransferListCallback(const v8::Arguments& args
     ArrayBufferArray arrayBufferArrayTx;
     if (args.Length() > 1) {
         if (!extractTransferables(args[1], messagePortArrayTx, arrayBufferArrayTx))
-            return throwError("Could not extract transferables", V8Proxy::TypeError);
+            return V8Proxy::throwTypeError("Could not extract transferables");
     }
     bool firstDidThrow = false;
     RefPtr<SerializedScriptValue> first = SerializedScriptValue::create(args[0], &messagePortArrayTx, &arrayBufferArrayTx, firstDidThrow, args.GetIsolate());
@@ -174,7 +174,7 @@ static v8::Handle<v8::Value> multiTransferListCallback(const v8::Arguments& args
     ArrayBufferArray arrayBufferArrayTxx;
     if (args.Length() > 3) {
         if (!extractTransferables(args[3], messagePortArrayTxx, arrayBufferArrayTxx))
-            return throwError("Could not extract transferables", V8Proxy::TypeError);
+            return V8Proxy::throwTypeError("Could not extract transferables");
     }
     bool secondDidThrow = false;
     RefPtr<SerializedScriptValue> second = SerializedScriptValue::create(args[2], &messagePortArrayTxx, &arrayBufferArrayTxx, secondDidThrow, args.GetIsolate());
@@ -213,7 +213,7 @@ v8::Handle<v8::Value> V8TestSerializedScriptValueInterface::constructorCallback(
     INC_STATS("DOM.TestSerializedScriptValueInterface.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -224,7 +224,7 @@ v8::Handle<v8::Value> V8TestSerializedScriptValueInterface::constructorCallback(
     ArrayBufferArray arrayBufferArrayTransferList;
     if (args.Length() > 2) {
         if (!extractTransferables(args[2], messagePortArrayTransferList, arrayBufferArrayTransferList))
-            return throwError("Could not extract transferables", V8Proxy::TypeError);
+            return V8Proxy::throwTypeError("Could not extract transferables");
     }
     bool dataDidThrow = false;
     RefPtr<SerializedScriptValue> data = SerializedScriptValue::create(args[1], &messagePortArrayTransferList, &arrayBufferArrayTransferList, dataDidThrow, args.GetIsolate());
diff --git a/Source/WebCore/bindings/v8/NPV8Object.cpp b/Source/WebCore/bindings/v8/NPV8Object.cpp
index 5c3359377..0d7cff6a8 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.cpp
+++ b/Source/WebCore/bindings/v8/NPV8Object.cpp
@@ -336,7 +336,8 @@ bool _NPN_EvaluateHelper(NPP npp, bool popupsAllowed, NPObject* npObject, NPStri
     if (v8result.IsEmpty())
         return false;
 
-    convertV8ObjectToNPVariant(v8result, npObject, result);
+    if (_NPN_IsAlive(npObject))
+        convertV8ObjectToNPVariant(v8result, npObject, result);
     return true;
 }
 
diff --git a/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
index 6097eca5c..b12969fc7 100644
--- a/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
+++ b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "RetainedDOMInfo.h"
 
-#include "Node.h"
+#include "ContainerNode.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/ScriptController.cpp b/Source/WebCore/bindings/v8/ScriptController.cpp
index e80e6c7a6..1bcb7e444 100644
--- a/Source/WebCore/bindings/v8/ScriptController.cpp
+++ b/Source/WebCore/bindings/v8/ScriptController.cpp
@@ -467,6 +467,11 @@ void ScriptController::setCaptureCallStackForUncaughtExceptions(bool value)
 {
     v8::V8::SetCaptureStackTraceForUncaughtExceptions(value, ScriptCallStack::maxCallStackSizeToCapture, stackTraceOptions);
 }
+
+void ScriptController::collectIsolatedContexts(Vector<std::pair<ScriptState*, SecurityOrigin*> >& result)
+{
+    m_proxy->collectIsolatedContexts(result);
+}
 #endif
 
 void ScriptController::attachDebugger(void*)
diff --git a/Source/WebCore/bindings/v8/ScriptController.h b/Source/WebCore/bindings/v8/ScriptController.h
index e8477ce29..d75fb9e1a 100644
--- a/Source/WebCore/bindings/v8/ScriptController.h
+++ b/Source/WebCore/bindings/v8/ScriptController.h
@@ -61,6 +61,7 @@ class Frame;
 class HTMLPlugInElement;
 class PagePopupClient;
 class ScriptSourceCode;
+class ScriptState;
 class Widget;
 
 class ScriptController {
@@ -134,6 +135,7 @@ public:
 
 #if ENABLE(INSPECTOR)
     static void setCaptureCallStackForUncaughtExceptions(bool);
+    void collectIsolatedContexts(Vector<std::pair<ScriptState*, SecurityOrigin*> >&);
 #endif
 
     bool canExecuteScripts(ReasonForCallingCanExecuteScripts);
diff --git a/Source/WebCore/bindings/v8/ScriptEventListener.cpp b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
index d5b50839a..08fa0ea4f 100644
--- a/Source/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -49,11 +49,10 @@ static const String& eventParameterName(bool isSVGEvent)
     return isSVGEvent ? evtString : eventString;
 }
 
-PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
+PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, const Attribute& attribute)
 {
     ASSERT(node);
-    ASSERT(attr);
-    if (attr->isNull())
+    if (attribute.isNull())
         return 0;
 
     // FIXME: Very strange: we initialize zero-based number with '1'.
@@ -68,16 +67,15 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribu
         sourceURL = node->document()->url().string();
     }
 
-    return V8LazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), sourceURL, position, node, WorldContextHandle(UseMainWorld));
+    return V8LazyEventListener::create(attribute.localName().string(), eventParameterName(node->isSVGElement()), attribute.value(), sourceURL, position, node, WorldContextHandle(UseMainWorld));
 }
 
-PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
+PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, const Attribute& attribute)
 {
     if (!frame)
         return 0;
 
-    ASSERT(attr);
-    if (attr->isNull())
+    if (attribute.isNull())
         return 0;
 
     ScriptController* scriptController = frame->script();
@@ -87,7 +85,7 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
     TextPosition position = scriptController->eventHandlerPosition();
     String sourceURL = frame->document()->url().string();
 
-    return V8LazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), sourceURL, position, 0, WorldContextHandle(UseMainWorld));
+    return V8LazyEventListener::create(attribute.localName().string(), eventParameterName(frame->document()->isSVGDocument()), attribute.value(), sourceURL, position, 0, WorldContextHandle(UseMainWorld));
 }
 
 String eventListenerHandlerBody(Document* document, EventListener* listener)
diff --git a/Source/WebCore/bindings/v8/ScriptEventListener.h b/Source/WebCore/bindings/v8/ScriptEventListener.h
index 0fce088ec..81157b2a0 100644
--- a/Source/WebCore/bindings/v8/ScriptEventListener.h
+++ b/Source/WebCore/bindings/v8/ScriptEventListener.h
@@ -43,8 +43,8 @@ namespace WebCore {
     class Frame;
     class Node;
 
-    PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node*, Attribute*);
-    PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+    PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node*, const Attribute&);
+    PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame*, const Attribute&);
     String eventListenerHandlerBody(Document*, EventListener*);
     bool eventListenerHandlerLocation(Document*, EventListener*, String& sourceName, int& lineNumber);
 
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index 056d92e30..f2feb92a7 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -121,6 +121,12 @@ ScriptObject ScriptProfiler::objectByHeapObjectId(unsigned id)
     return ScriptObject(scriptState, object);
 }
 
+unsigned ScriptProfiler::getHeapObjectId(ScriptValue value)
+{
+    v8::SnapshotObjectId id = v8::HeapProfiler::GetSnapshotObjectId(value.v8Value());
+    return id;
+}
+
 namespace {
 
 class ActivityControlAdapter : public v8::ActivityControl {
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index 5d3b968a2..87e926f87 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -43,6 +43,7 @@ namespace WebCore {
 class DOMWrapperVisitor;
 class Page;
 class ScriptObject;
+class ScriptValue;
 class WorkerContext;
 
 class ScriptProfiler {
@@ -59,6 +60,7 @@ public:
 
     static void collectGarbage();
     static ScriptObject objectByHeapObjectId(unsigned id);
+    static unsigned getHeapObjectId(ScriptValue);
     static void start(ScriptState* state, const String& title);
     static void startForPage(Page*, const String& title);
 #if ENABLE(WORKERS)
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index 1023abd18..e2c1f7cd3 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -2098,18 +2098,12 @@ PassRefPtr<SerializedScriptValue> SerializedScriptValue::create()
     return adoptRef(new SerializedScriptValue());
 }
 
-SerializedScriptValue* SerializedScriptValue::nullValue(v8::Isolate* isolate)
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::nullValue(v8::Isolate* isolate)
 {
-    // FIXME: This is not thread-safe. Move caching to callers.
-    // https://bugs.webkit.org/show_bug.cgi?id=70833
-    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, nullValue, (0));
-    if (!nullValue) {
-        Writer writer(isolate);
-        writer.writeNull();
-        String wireData = StringImpl::adopt(writer.data());
-        nullValue = adoptRef(new SerializedScriptValue(wireData));
-    }
-    return nullValue.get();
+    Writer writer(isolate);
+    writer.writeNull();
+    String wireData = StringImpl::adopt(writer.data());
+    return adoptRef(new SerializedScriptValue(wireData));
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::undefinedValue(v8::Isolate* isolate)
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.h b/Source/WebCore/bindings/v8/SerializedScriptValue.h
index 1fa99e8a4..15ef2c23e 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.h
@@ -58,7 +58,7 @@ public:
     static PassRefPtr<SerializedScriptValue> create(const String& data, v8::Isolate* = 0);
     static PassRefPtr<SerializedScriptValue> create();
 
-    static SerializedScriptValue* nullValue(v8::Isolate* = 0);
+    static PassRefPtr<SerializedScriptValue> nullValue(v8::Isolate* = 0);
     static PassRefPtr<SerializedScriptValue> undefinedValue(v8::Isolate* = 0);
     static PassRefPtr<SerializedScriptValue> booleanValue(bool value, v8::Isolate* = 0);
     static PassRefPtr<SerializedScriptValue> numberValue(double value, v8::Isolate* = 0);
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
index 0ad4e2214..2cd79a972 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -253,10 +253,10 @@ bool V8DOMWrapper::isWrapperOfType(v8::Handle<v8::Value> value, WrapperTypeInfo*
 
 #define TRY_TO_WRAP_WITH_INTERFACE(interfaceName) \
     if (eventNames().interfaceFor##interfaceName == desiredInterface) \
-        return toV8(static_cast<interfaceName*>(target));
+        return toV8(static_cast<interfaceName*>(target), isolate);
 
 // A JS object of type EventTarget is limited to a small number of possible classes.
-v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* target)
+v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* target, v8::Isolate* isolate)
 {
     if (!target)
         return v8::Null();
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.h b/Source/WebCore/bindings/v8/V8DOMWrapper.h
index b3c9ff9d7..7059f51b8 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.h
@@ -86,12 +86,12 @@ namespace WebCore {
 
         static WrapperTypeInfo* domWrapperType(v8::Handle<v8::Object>);
 
-        static v8::Handle<v8::Value> convertEventTargetToV8Object(PassRefPtr<EventTarget> eventTarget)
+        static v8::Handle<v8::Value> convertEventTargetToV8Object(PassRefPtr<EventTarget> eventTarget, v8::Isolate* isolate = 0)
         {
-            return convertEventTargetToV8Object(eventTarget.get());
+            return convertEventTargetToV8Object(eventTarget.get(), isolate);
         }
 
-        static v8::Handle<v8::Value> convertEventTargetToV8Object(EventTarget*);
+        static v8::Handle<v8::Value> convertEventTargetToV8Object(EventTarget*, v8::Isolate* = 0);
 
         static PassRefPtr<EventListener> getEventListener(v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
 
diff --git a/Source/WebCore/bindings/v8/V8IsolatedContext.cpp b/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
index b24c64553..6cf654328 100644
--- a/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
+++ b/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
@@ -34,6 +34,7 @@
 
 #include "Frame.h"
 #include "FrameLoaderClient.h"
+#include "InspectorInstrumentation.h"
 #include "SecurityOrigin.h"
 #include "V8BindingPerContextData.h"
 #include "V8DOMWindow.h"
@@ -118,6 +119,11 @@ V8IsolatedContext::~V8IsolatedContext()
 
 void V8IsolatedContext::setSecurityOrigin(PassRefPtr<SecurityOrigin> securityOrigin)
 {
+    if (!m_securityOrigin && InspectorInstrumentation::hasFrontends() && !context().IsEmpty()) {
+        v8::HandleScope handleScope;
+        ScriptState* scriptState = ScriptState::forContext(v8::Local<v8::Context>::New(context()));
+        InspectorInstrumentation::didCreateIsolatedContext(m_frame, scriptState, securityOrigin.get());
+    }
     m_securityOrigin = securityOrigin;
 }
 
diff --git a/Source/WebCore/bindings/v8/V8NPObject.cpp b/Source/WebCore/bindings/v8/V8NPObject.cpp
index f6dd1f8f3..5a58d8272 100644
--- a/Source/WebCore/bindings/v8/V8NPObject.cpp
+++ b/Source/WebCore/bindings/v8/V8NPObject.cpp
@@ -92,14 +92,14 @@ static v8::Handle<v8::Value> npObjectInvokeImpl(const v8::Arguments& args, Invok
         // The holder object is not a subtype of HTMLPlugInElement, it must be an NPObject which has three
         // internal fields.
         if (args.Holder()->InternalFieldCount() != npObjectInternalFieldCount)
-          return throwError("NPMethod called on non-NPObject", V8Proxy::ReferenceError);
+            return V8Proxy::throwError(V8Proxy::ReferenceError, "NPMethod called on non-NPObject");
 
         npObject = v8ObjectToNPObject(args.Holder());
     }
 
     // Verify that our wrapper wasn't using a NPObject which has already been deleted.
     if (!npObject || !_NPN_IsAlive(npObject))
-        return throwError("NPObject deleted", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "NPObject deleted");
 
     // Wrap up parameters.
     int numArgs = args.Length();
@@ -133,13 +133,15 @@ static v8::Handle<v8::Value> npObjectInvokeImpl(const v8::Arguments& args, Invok
     }
 
     if (!retval)
-        throwError("Error calling method on NPObject.", V8Proxy::GeneralError);
+        V8Proxy::throwError(V8Proxy::GeneralError, "Error calling method on NPObject.");
 
     for (int i = 0; i < numArgs; i++)
         _NPN_ReleaseVariantValue(&npArgs[i]);
 
     // Unwrap return values.
-    v8::Handle<v8::Value> returnValue = convertNPVariantToV8Object(&result, npObject);
+    v8::Handle<v8::Value> returnValue;
+    if (_NPN_IsAlive(npObject))
+        returnValue = convertNPVariantToV8Object(&result, npObject);
     _NPN_ReleaseVariantValue(&result);
 
     return returnValue;
@@ -188,24 +190,33 @@ static v8::Handle<v8::Value> npObjectGetProperty(v8::Local<v8::Object> self, NPI
     // Verify that our wrapper wasn't using a NPObject which
     // has already been deleted.
     if (!npObject || !_NPN_IsAlive(npObject))
-        return throwError("NPObject deleted", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "NPObject deleted");
 
 
-    if (npObject->_class->hasProperty && npObject->_class->hasProperty(npObject, identifier)
-        && npObject->_class->getProperty) {
+    if (npObject->_class->hasProperty && npObject->_class->getProperty && npObject->_class->hasProperty(npObject, identifier)) {
+        if (!_NPN_IsAlive(npObject))
+            return V8Proxy::throwError(V8Proxy::ReferenceError, "NPObject deleted");
 
         NPVariant result;
         VOID_TO_NPVARIANT(result);
         if (!npObject->_class->getProperty(npObject, identifier, &result))
             return v8::Handle<v8::Value>();
 
-        v8::Handle<v8::Value> returnValue = convertNPVariantToV8Object(&result, npObject);
+        v8::Handle<v8::Value> returnValue;
+        if (_NPN_IsAlive(npObject))
+            returnValue = convertNPVariantToV8Object(&result, npObject);
         _NPN_ReleaseVariantValue(&result);
         return returnValue;
 
     }
 
+    if (!_NPN_IsAlive(npObject))
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "NPObject deleted");
+
     if (key->IsString() && npObject->_class->hasMethod && npObject->_class->hasMethod(npObject, identifier)) {
+        if (!_NPN_IsAlive(npObject))
+            return V8Proxy::throwError(V8Proxy::ReferenceError, "NPObject deleted");
+
         PrivateIdentifier* id = static_cast<PrivateIdentifier*>(identifier);
         v8::Persistent<v8::FunctionTemplate> functionTemplate = staticTemplateMap().get(id);
         // Cache templates using identifier as the key.
@@ -262,12 +273,13 @@ static v8::Handle<v8::Value> npObjectSetProperty(v8::Local<v8::Object> self, NPI
 
     // Verify that our wrapper wasn't using a NPObject which has already been deleted.
     if (!npObject || !_NPN_IsAlive(npObject)) {
-        throwError("NPObject deleted", V8Proxy::ReferenceError);
+        V8Proxy::throwError(V8Proxy::ReferenceError, "NPObject deleted");
         return value;  // Intercepted, but an exception was thrown.
     }
 
-    if (npObject->_class->hasProperty && npObject->_class->hasProperty(npObject, identifier)
-        && npObject->_class->setProperty) {
+    if (npObject->_class->hasProperty && npObject->_class->setProperty && npObject->_class->hasProperty(npObject, identifier)) {
+        if (!_NPN_IsAlive(npObject))
+            return V8Proxy::throwError(V8Proxy::ReferenceError, "NPObject deleted");
 
         NPVariant npValue;
         VOID_TO_NPVARIANT(npValue);
@@ -313,7 +325,7 @@ v8::Handle<v8::Array> npObjectPropertyEnumerator(const v8::AccessorInfo& info, b
     // Verify that our wrapper wasn't using a NPObject which
     // has already been deleted.
     if (!npObject || !_NPN_IsAlive(npObject))
-        throwError("NPObject deleted", V8Proxy::ReferenceError);
+        V8Proxy::throwError(V8Proxy::ReferenceError, "NPObject deleted");
 
     if (NP_CLASS_STRUCT_VERSION_HAS_ENUM(npObject->_class) && npObject->_class->enumerate) {
         uint32_t count;
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index e927d53af..bd2c078c1 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -69,6 +69,7 @@
 #include <wtf/StdLibExtras.h>
 #include <wtf/StringExtras.h>
 #include <wtf/UnusedParam.h>
+#include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
 
 #if PLATFORM(CHROMIUM)
@@ -160,7 +161,7 @@ static void handleFatalErrorInV8()
 
 static v8::Local<v8::Value> handleMaxRecursionDepthExceeded()
 {
-    throwError("Maximum call stack size exceeded.", V8Proxy::RangeError);
+    V8Proxy::throwError(V8Proxy::RangeError, "Maximum call stack size exceeded.");
     return v8::Local<v8::Value>();
 }
 
@@ -387,6 +388,31 @@ v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8
     return V8Proxy::instrumentedCallFunction(frame(), function, receiver, argc, args);
 }
 
+static inline void resourceInfo(const v8::Handle<v8::Function> function, String& resourceName, int& lineNumber)
+{
+    v8::ScriptOrigin origin = function->GetScriptOrigin();
+    if (origin.ResourceName().IsEmpty()) {
+        resourceName = "undefined";
+        lineNumber = 1;
+    } else {
+        resourceName = toWebCoreString(origin.ResourceName());
+        lineNumber = function->GetScriptLineNumber() + 1;
+    }
+}
+
+static inline String resourceString(const v8::Handle<v8::Function> function)
+{
+    String resourceName;
+    int lineNumber;
+    resourceInfo(function, resourceName, lineNumber);
+
+    StringBuilder builder;
+    builder.append(resourceName);
+    builder.append(':');
+    builder.append(String::number(lineNumber));
+    return builder.toString();
+}
+
 v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<v8::Function> function, v8::Handle<v8::Object> receiver, int argc, v8::Handle<v8::Value> args[])
 {
     V8GCController::checkMemoryUsage();
@@ -398,20 +424,16 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
 
     InspectorInstrumentationCookie cookie;
     if (InspectorInstrumentation::hasFrontends() && context) {
-        String resourceName("undefined");
-        int lineNumber = 1;
-        v8::ScriptOrigin origin = function->GetScriptOrigin();
-        if (!origin.ResourceName().IsEmpty()) {
-            resourceName = toWebCoreString(origin.ResourceName());
-            lineNumber = function->GetScriptLineNumber() + 1;
-        }
+        String resourceName;
+        int lineNumber;
+        resourceInfo(function, resourceName, lineNumber);
         cookie = InspectorInstrumentation::willCallFunction(context, resourceName, lineNumber);
     }
 
     v8::Local<v8::Value> result;
     {
 #if PLATFORM(CHROMIUM)
-        TRACE_EVENT0("v8", "v8.callFunction");
+        TRACE_EVENT1("v8", "v8.callFunction", "callsite", resourceString(function).utf8());
 #endif
         V8RecursionScope recursionScope(context);
         result = function->Call(receiver, argc, args);
@@ -547,6 +569,18 @@ void V8Proxy::clearForNavigation()
     windowShell()->clearForNavigation();
 }
 
+static v8::Handle<v8::Value> DOMExceptionStackGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    ASSERT(info.Data()->IsObject());
+    return info.Data()->ToObject()->Get(v8String("stack", info.GetIsolate()));
+}
+
+static void DOMExceptionStackSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    ASSERT(info.Data()->IsObject());
+    info.Data()->ToObject()->Set(v8String("stack", info.GetIsolate()), value);
+}
+
 #define TRY_TO_CREATE_EXCEPTION(interfaceName) \
     case interfaceName##Type: \
         exception = toV8(interfaceName::create(description), isolate); \
@@ -564,8 +598,16 @@ void V8Proxy::setDOMException(int ec, v8::Isolate* isolate)
         DOM_EXCEPTION_INTERFACES_FOR_EACH(TRY_TO_CREATE_EXCEPTION)
     }
 
-    if (!exception.IsEmpty())
-        v8::ThrowException(exception);
+    if (exception.IsEmpty())
+        return;
+
+    // Attach an Error object to the DOMException. This is then lazily used to get the stack value.
+    v8::Handle<v8::Value> error = v8::Exception::Error(v8String(description.description, isolate));
+    ASSERT(!error.IsEmpty());
+    ASSERT(exception->IsObject());
+    exception->ToObject()->SetAccessor(v8String("stack", isolate), DOMExceptionStackGetter, DOMExceptionStackSetter, error);
+
+    v8::ThrowException(exception);
 }
 
 #undef TRY_TO_CREATE_EXCEPTION
@@ -589,9 +631,9 @@ v8::Handle<v8::Value> V8Proxy::throwError(ErrorType type, const char* message, v
     }
 }
 
-v8::Handle<v8::Value> V8Proxy::throwTypeError()
+v8::Handle<v8::Value> V8Proxy::throwTypeError(const char* message)
 {
-    return throwError(TypeError, "Type error");
+    return throwError(TypeError, (message ? message : "Type error"));
 }
 
 v8::Handle<v8::Value> V8Proxy::throwNotEnoughArgumentsError()
@@ -631,6 +673,14 @@ v8::Local<v8::Context> V8Proxy::mainWorldContext()
     return v8::Local<v8::Context>::New(windowShell()->context());
 }
 
+v8::Local<v8::Context> V8Proxy::isolatedWorldContext(int worldId)
+{
+    IsolatedWorldMap::iterator iter = m_isolatedWorlds.find(worldId);
+    if (iter == m_isolatedWorlds.end())
+        return v8::Local<v8::Context>();
+    return v8::Local<v8::Context>::New(iter->second->context());
+}
+
 bool V8Proxy::matchesCurrentContext()
 {
     v8::Handle<v8::Context> context;
@@ -727,6 +777,21 @@ int V8Proxy::contextDebugId(v8::Handle<v8::Context> context)
     return atoi(comma + 1);
 }
 
+void V8Proxy::collectIsolatedContexts(Vector<std::pair<ScriptState*, SecurityOrigin*> >& result)
+{
+    v8::HandleScope handleScope;
+    for (IsolatedWorldMap::iterator it = m_isolatedWorlds.begin(); it != m_isolatedWorlds.end(); ++it) {
+        V8IsolatedContext* isolatedContext = it->second;
+        if (!isolatedContext->securityOrigin())
+            continue;
+        v8::Handle<v8::Context> v8Context = isolatedContext->context();
+        if (v8Context.IsEmpty())
+            continue;
+        ScriptState* scriptState = ScriptState::forContext(v8::Local<v8::Context>::New(v8Context));
+        result.append(std::pair<ScriptState*, SecurityOrigin*>(scriptState, isolatedContext->securityOrigin()));
+    }
+}
+
 v8::Local<v8::Context> toV8Context(ScriptExecutionContext* context, const WorldContextHandle& worldContext)
 {
     if (context->isDocument()) {
diff --git a/Source/WebCore/bindings/v8/V8Proxy.h b/Source/WebCore/bindings/v8/V8Proxy.h
index 66dbf5968..e5e947103 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.h
+++ b/Source/WebCore/bindings/v8/V8Proxy.h
@@ -239,11 +239,12 @@ namespace WebCore {
         static v8::Handle<v8::Value> throwError(ErrorType, const char* message, v8::Isolate* = 0);
 
         // Helpers for throwing syntax and type errors with predefined messages.
-        static v8::Handle<v8::Value> throwTypeError();
+        static v8::Handle<v8::Value> throwTypeError(const char* = 0);
         static v8::Handle<v8::Value> throwNotEnoughArgumentsError();
 
         v8::Local<v8::Context> context();
         v8::Local<v8::Context> mainWorldContext();
+        v8::Local<v8::Context> isolatedWorldContext(int worldId);
         bool matchesCurrentContext();
 
         // FIXME: This should eventually take DOMWrapperWorld argument!
@@ -251,6 +252,7 @@ namespace WebCore {
 
         bool setContextDebugId(int id);
         static int contextDebugId(v8::Handle<v8::Context>);
+        void collectIsolatedContexts(Vector<std::pair<ScriptState*, SecurityOrigin*> >&);
 
         // Registers a v8 extension to be available on webpages. Will only
         // affect v8 contexts initialized after this call. Takes ownership of
@@ -318,18 +320,6 @@ namespace WebCore {
         return v8::Local<v8::Object>();
     }
 
-    inline static v8::Local<v8::Boolean> deletionNotHandledByInterceptor()
-    {
-        return v8::Local<v8::Boolean>();
-    }
-
-    inline v8::Handle<v8::Primitive> throwError(const char* message, v8::Isolate* isolate = 0)
-    {
-        if (!v8::V8::IsExecutionTerminating())
-            V8Proxy::throwError(V8Proxy::TypeError, message, isolate);
-        return v8::Undefined();
-    }
-
     inline v8::Handle<v8::Primitive> throwError(const char* message, V8Proxy::ErrorType type, v8::Isolate* isolate = 0)
     {
         if (!v8::V8::IsExecutionTerminating())
diff --git a/Source/WebCore/bindings/v8/V8Utilities.cpp b/Source/WebCore/bindings/v8/V8Utilities.cpp
index d39049c8f..6364efc6a 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.cpp
+++ b/Source/WebCore/bindings/v8/V8Utilities.cpp
@@ -94,7 +94,7 @@ bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, A
     }
 
     if (!value->IsObject()) {
-        throwError("TransferArray argument must be an object");
+        V8Proxy::throwTypeError("TransferArray argument must be an object");
         return false;
     }
     uint32_t length = 0;
@@ -107,7 +107,7 @@ bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, A
         // Sequence-type object - get the length attribute
         v8::Local<v8::Value> sequenceLength = transferrables->Get(v8::String::New("length"));
         if (!sequenceLength->IsNumber()) {
-            throwError("TransferArray argument has no length attribute");
+            V8Proxy::throwTypeError("TransferArray argument has no length attribute");
             return false;
         }
         length = sequenceLength->Uint32Value();
@@ -127,7 +127,7 @@ bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, A
         else if (V8ArrayBuffer::HasInstance(transferrable))
             arrayBuffers.append(V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(transferrable)));
         else {
-            throwError("TransferArray argument must contain only Transferables");
+            V8Proxy::throwTypeError("TransferArray argument must contain only Transferables");
             return false;
         }
     }
@@ -141,7 +141,7 @@ bool getMessagePortArray(v8::Local<v8::Value> value, MessagePortArray& ports)
     if (!result)
         return false;
     if (arrayBuffers.size() > 0) {
-        throwError("MessagePortArray argument must contain only MessagePorts");
+        V8Proxy::throwTypeError("MessagePortArray argument must contain only MessagePorts");
         return false;
     }
     return true;
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
index cf690fd2b..b654de781 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
@@ -70,7 +70,7 @@ v8::Handle<v8::Value> V8ArrayBuffer::constructorCallback(const v8::Arguments& ar
     if (length >= 0)
         buffer = ArrayBuffer::create(static_cast<unsigned>(length), 1);
     if (!buffer.get())
-        return throwError("ArrayBuffer size is not a small enough positive integer.", V8Proxy::RangeError);
+        return V8Proxy::throwError(V8Proxy::RangeError, "ArrayBuffer size is not a small enough positive integer.");
     // Transform the holder into a wrapper object for the array.
     V8DOMWrapper::setDOMWrapper(args.Holder(), &info, buffer.get());
     V8DOMWrapper::setJSWrapperForDOMObject(buffer.release(), v8::Persistent<v8::Object>::New(args.Holder()));
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
index a0fc5aed5..e3c231242 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
@@ -60,23 +60,23 @@ v8::Handle<v8::Value> constructWebGLArrayWithArrayBufferArgument(const v8::Argum
 {
     ArrayBuffer* buf = V8ArrayBuffer::toNative(args[0]->ToObject());
     if (!buf)
-        return throwError("Could not convert argument 0 to a ArrayBuffer");
+        return V8Proxy::throwTypeError("Could not convert argument 0 to a ArrayBuffer");
     bool ok;
     uint32_t offset = 0;
     int argLen = args.Length();
     if (argLen > 1) {
         offset = toUInt32(args[1], ok);
         if (!ok)
-            return throwError("Could not convert argument 1 to a number");
+            return V8Proxy::throwTypeError("Could not convert argument 1 to a number");
     }
     uint32_t length = 0;
     if (argLen > 2) {
         length = toUInt32(args[2], ok);
         if (!ok)
-            return throwError("Could not convert argument 2 to a number");
+            return V8Proxy::throwTypeError("Could not convert argument 2 to a number");
     } else {
         if ((buf->byteLength() - offset) % sizeof(ElementType))
-            return throwError("ArrayBuffer length minus the byteOffset is not a multiple of the element size.", V8Proxy::RangeError);
+            return V8Proxy::throwError(V8Proxy::RangeError, "ArrayBuffer length minus the byteOffset is not a multiple of the element size.");
         length = (buf->byteLength() - offset) / sizeof(ElementType);
     }
     RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
@@ -99,7 +99,7 @@ template<class ArrayClass, class ElementType>
 v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperTypeInfo* type, v8::ExternalArrayType arrayType)
 {
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -153,7 +153,7 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
     if (args[0]->IsObject()) {
         srcArray = args[0]->ToObject();
         if (srcArray.IsEmpty())
-            return throwError("Could not convert argument 0 to an array");
+            return V8Proxy::throwTypeError("Could not convert argument 0 to an array");
         len = toUInt32(srcArray->Get(v8::String::New("length")));
         doInstantiation = true;
     } else {
@@ -169,7 +169,7 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
     if (doInstantiation)
         array = ArrayClass::create(len);
     if (!array.get())
-        return throwError("ArrayBufferView size is not a small enough positive integer.", V8Proxy::RangeError);
+        return V8Proxy::throwError(V8Proxy::RangeError, "ArrayBufferView size is not a small enough positive integer.");
 
 
     // Transform the holder into a wrapper object for the array.
diff --git a/Source/WebCore/bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp
index 8d870be11..79e02e8a0 100644
--- a/Source/WebCore/bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp
@@ -47,13 +47,13 @@ void V8AudioBufferSourceNode::bufferAccessorSetter(v8::Local<v8::String> name, v
     if (V8AudioBuffer::HasInstance(value)) {
         buffer = V8AudioBuffer::toNative(value->ToObject());
         if (buffer && !imp->setBuffer(buffer)) {
-            throwError("AudioBuffer unsupported number of channels");
+            V8Proxy::throwTypeError("AudioBuffer unsupported number of channels");
             return;
         }
     }
     
     if (!buffer) {
-        throwError("Value is not of type AudioBuffer");
+        V8Proxy::throwTypeError("Value is not of type AudioBuffer");
         return;
     }
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
index ec6338d42..b70848708 100644
--- a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
@@ -44,18 +44,18 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
     INC_STATS("DOM.AudioContext.Contructor");
 
     if (!args.IsConstructCall())
-        return throwError("AudioContext constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("AudioContext constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
 
     Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
     if (!frame)
-        return throwError("AudioContext constructor associated frame is unavailable", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "AudioContext constructor associated frame is unavailable");
 
     Document* document = frame->document();
     if (!document)
-        return throwError("AudioContext constructor associated document is unavailable", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "AudioContext constructor associated document is unavailable");
 
     RefPtr<AudioContext> audioContext;
     
@@ -66,7 +66,7 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
         if (ec)
             return throwError(ec);
         if (!audioContext.get())
-            return throwError("audio resources unavailable for AudioContext construction", V8Proxy::SyntaxError);
+            return V8Proxy::throwError(V8Proxy::SyntaxError, "audio resources unavailable for AudioContext construction");
     } else {
         // Constructor for offline (render-target) AudioContext which renders into an AudioBuffer.
         // new AudioContext(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate);
@@ -77,15 +77,15 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
 
         int32_t numberOfChannels = toInt32(args[0], ok);
         if (!ok || numberOfChannels <= 0 || numberOfChannels > 10)
-            return throwError("Invalid number of channels", V8Proxy::SyntaxError);
+            return V8Proxy::throwError(V8Proxy::SyntaxError, "Invalid number of channels");
 
         int32_t numberOfFrames = toInt32(args[1], ok);
         if (!ok || numberOfFrames <= 0)
-            return throwError("Invalid number of frames", V8Proxy::SyntaxError);
+            return V8Proxy::throwError(V8Proxy::SyntaxError, "Invalid number of frames");
 
         float sampleRate = toFloat(args[2]);
         if (sampleRate <= 0)
-            return throwError("Invalid sample rate", V8Proxy::SyntaxError);
+            return V8Proxy::throwError(V8Proxy::SyntaxError, "Invalid sample rate");
 
         ExceptionCode ec = 0;
         audioContext = AudioContext::createOfflineContext(document, numberOfChannels, numberOfFrames, sampleRate, ec);
@@ -94,7 +94,7 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
     }
 
     if (!audioContext.get())
-        return throwError("Error creating AudioContext", V8Proxy::SyntaxError);
+        return V8Proxy::throwError(V8Proxy::SyntaxError, "Error creating AudioContext");
     
     // Transform the holder into a wrapper object for the audio context.
     V8DOMWrapper::setDOMWrapper(args.Holder(), &info, audioContext.get());
diff --git a/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp b/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp
index 50b4873b7..d30a97171 100644
--- a/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp
@@ -60,7 +60,7 @@ v8::Handle<v8::Value> V8Blob::constructorCallback(const v8::Arguments& args)
     INC_STATS("DOM.Blob.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -68,7 +68,7 @@ v8::Handle<v8::Value> V8Blob::constructorCallback(const v8::Arguments& args)
     // Get the script execution context.
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
-        return throwError("Blob constructor associated document is unavailable", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "Blob constructor associated document is unavailable");
 
     if (!args.Length()) {
         RefPtr<Blob> blob = Blob::create();
@@ -77,14 +77,14 @@ v8::Handle<v8::Value> V8Blob::constructorCallback(const v8::Arguments& args)
 
     v8::Local<v8::Value> firstArg = args[0];
     if (!firstArg->IsArray())
-        return throwError("First argument of the constructor is not of type Array", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("First argument of the constructor is not of type Array");
 
     String type;
     String endings = "transparent";
 
     if (args.Length() > 1) {
         if (!args[1]->IsObject())
-            return throwError("Second argument of the constructor is not of type Object", V8Proxy::TypeError);
+            return V8Proxy::throwTypeError("Second argument of the constructor is not of type Object");
 
         Dictionary dictionary(args[1]);
 
@@ -95,7 +95,7 @@ v8::Handle<v8::Value> V8Blob::constructorCallback(const v8::Arguments& args)
 
         if (containsEndings) {
             if (endings != "transparent" && endings != "native")
-                return throwError("The endings property must be either \"transparent\" or \"native\"", V8Proxy::TypeError);
+                return V8Proxy::throwTypeError("The endings property must be either \"transparent\" or \"native\"");
         }
 
         v8::TryCatch tryCatchType;
diff --git a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
index b33661064..fbc3d0191 100644
--- a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
@@ -73,7 +73,7 @@ v8::Handle<v8::Value> V8Clipboard::clearDataCallback(const v8::Arguments& args)
     }
 
     if (args.Length() != 1)
-        return throwError("clearData: Invalid number of arguments", V8Proxy::SyntaxError);
+        return V8Proxy::throwError(V8Proxy::SyntaxError, "clearData: Invalid number of arguments");
 
     String type = toWebCoreString(args[0]);
     clipboard->clearData(type);
@@ -89,7 +89,7 @@ v8::Handle<v8::Value> V8Clipboard::setDragImageCallback(const v8::Arguments& arg
         return v8::Undefined();
 
     if (args.Length() != 3)
-        return throwError("setDragImage: Invalid number of arguments", V8Proxy::SyntaxError);
+        return V8Proxy::throwError(V8Proxy::SyntaxError, "setDragImage: Invalid number of arguments");
 
     int x = toInt32(args[1]);
     int y = toInt32(args[2]);
@@ -99,7 +99,7 @@ v8::Handle<v8::Value> V8Clipboard::setDragImageCallback(const v8::Arguments& arg
         node = V8Node::toNative(v8::Handle<v8::Object>::Cast(args[0]));
 
     if (!node || !node->isElementNode())
-        return throwError("setDragImageFromElement: Invalid first argument");
+        return V8Proxy::throwTypeError("setDragImageFromElement: Invalid first argument");
 
     if (static_cast<Element*>(node)->hasLocalName(HTMLNames::imgTag) && !node->inDocument())
         clipboard->setDragImage(static_cast<HTMLImageElement*>(node)->cachedImage(), IntPoint(x, y));
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
index a8d077dc5..10c9a234a 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
@@ -45,7 +45,7 @@ v8::Handle<v8::Value> V8DOMFormData::constructorCallback(const v8::Arguments& ar
     INC_STATS("DOM.FormData.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -65,7 +65,7 @@ v8::Handle<v8::Value> V8DOMFormData::appendCallback(const v8::Arguments& args)
     INC_STATS("DOM.FormData.append()");
     
     if (args.Length() < 2)
-        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+        return V8Proxy::throwError(V8Proxy::SyntaxError, "Not enough arguments");
 
     DOMFormData* domFormData = V8DOMFormData::toNative(args.Holder());
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
index ba5f8c458..a34017aa5 100755
--- a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
@@ -39,7 +39,7 @@ v8::Handle<v8::Value> V8DataView::constructorCallback(const v8::Arguments& args)
     INC_STATS("DOM.DataView.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
index d2416e8eb..2f1ea54e8 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
@@ -55,7 +55,7 @@ static v8::Handle<v8::Value> getNamedItems(HTMLCollection* collection, AtomicStr
         return toV8(namedItems.at(0).release(), isolate);
 
     if (collection->type() == FormControls)
-        return toV8(collection->base()->radioNodeList(name).get());
+        return toV8(collection->base()->radioNodeList(name).get(), isolate);
 
     return toV8(V8NamedNodesCollection::create(namedItems), isolate);
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index b5d857525..06e165e49 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -149,7 +149,7 @@ v8::Handle<v8::Value> V8HTMLDocument::openCallback(const v8::Arguments& args)
             v8::Local<v8::Value> function = global->Get(v8::String::New("open"));
             // If the open property is not a function throw a type error.
             if (!function->IsFunction()) {
-                throwError("open is not a function");
+                V8Proxy::throwTypeError("open is not a function");
                 return v8::Undefined();
             }
             // Wrap up the arguments and call the function.
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLElementCustom.cpp
index dea17ec8c..19286124f 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLElementCustom.cpp
@@ -57,7 +57,7 @@ v8::Handle<v8::Value> toV8(HTMLElement* impl, v8::Isolate* isolate, bool forceNe
 {
     if (!impl)
         return v8::Null();
-    return createV8HTMLWrapper(impl, forceNewObject);
+    return createV8HTMLWrapper(impl, isolate, forceNewObject);
 }
 
 #if ENABLE(MICRODATA)
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
index 8c73a38e7..513b506cd 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
@@ -51,18 +51,18 @@ static v8::Handle<v8::Value> v8HTMLImageElementConstructorCallback(const v8::Arg
     INC_STATS("DOM.HTMLImageElement.Contructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
 
     Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
     if (!frame)
-        return throwError("Image constructor associated frame is unavailable", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "Image constructor associated frame is unavailable");
 
     Document* document = frame->document();
     if (!document)
-        return throwError("Image constructor associated document is unavailable", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "Image constructor associated document is unavailable");
 
     // Make sure the document is added to the DOM Node map. Otherwise, the HTMLImageElement instance
     // may end up being the only node in the map and get garbage-ccollected prematurely.
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
index c74d3f6d2..65686546e 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
@@ -45,7 +45,7 @@ v8::Handle<v8::Value> V8HTMLInputElement::selectionStartAccessorGetter(v8::Local
     HTMLInputElement* imp = V8HTMLInputElement::toNative(holder);
 
     if (!imp->canHaveSelection())
-        return throwError("Accessing selectionStart on an input element that cannot have a selection.");
+        return V8Proxy::throwTypeError("Accessing selectionStart on an input element that cannot have a selection.");
 
     int v = imp->selectionStart();
     return v8::Integer::New(v);
@@ -58,7 +58,7 @@ void V8HTMLInputElement::selectionStartAccessorSetter(v8::Local<v8::String> name
     HTMLInputElement* imp = V8HTMLInputElement::toNative(holder);
 
     if (!imp->canHaveSelection()) {
-        throwError("Accessing selectionStart on an input element that cannot have a selection.");
+        V8Proxy::throwTypeError("Accessing selectionStart on an input element that cannot have a selection.");
         return;
     }
     imp->setSelectionStart(value->Int32Value());
@@ -71,7 +71,7 @@ v8::Handle<v8::Value> V8HTMLInputElement::selectionEndAccessorGetter(v8::Local<v
     HTMLInputElement* imp = V8HTMLInputElement::toNative(holder);
 
     if (!imp->canHaveSelection())
-        return throwError("Accessing selectionEnd on an input element that cannot have a selection.");
+        return V8Proxy::throwTypeError("Accessing selectionEnd on an input element that cannot have a selection.");
 
     int v = imp->selectionEnd();
     return v8::Integer::New(v);
@@ -84,7 +84,7 @@ void V8HTMLInputElement::selectionEndAccessorSetter(v8::Local<v8::String> name,
     HTMLInputElement* imp = V8HTMLInputElement::toNative(holder);
 
     if (!imp->canHaveSelection()) {
-        throwError("Accessing selectionEnd on an input element that cannot have a selection.");
+        V8Proxy::throwTypeError("Accessing selectionEnd on an input element that cannot have a selection.");
         return;
     }
 
@@ -98,7 +98,7 @@ v8::Handle<v8::Value> V8HTMLInputElement::selectionDirectionAccessorGetter(v8::L
     HTMLInputElement* imp = V8HTMLInputElement::toNative(holder);
 
     if (!imp->canHaveSelection())
-        return throwError("Accessing selectionDirection on an input element that cannot have a selection.");
+        return V8Proxy::throwTypeError("Accessing selectionDirection on an input element that cannot have a selection.");
 
     return v8String(imp->selectionDirection());
 }
@@ -110,7 +110,7 @@ void V8HTMLInputElement::selectionDirectionAccessorSetter(v8::Local<v8::String>
     HTMLInputElement* imp = V8HTMLInputElement::toNative(holder);
 
     if (!imp->canHaveSelection()) {
-        throwError("Accessing selectionDirection on an input element that cannot have a selection.");
+        V8Proxy::throwTypeError("Accessing selectionDirection on an input element that cannot have a selection.");
         return;
     }
 
@@ -124,7 +124,7 @@ v8::Handle<v8::Value> V8HTMLInputElement::setSelectionRangeCallback(const v8::Ar
     HTMLInputElement* imp = V8HTMLInputElement::toNative(holder);
 
     if (!imp->canHaveSelection())
-        return throwError("Calling setSelectionRange on an input element that cannot have a selection.");
+        return V8Proxy::throwTypeError("Calling setSelectionRange on an input element that cannot have a selection.");
 
     int start = args[0]->Int32Value();
     int end = args[1]->Int32Value();
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLMediaElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLMediaElementCustom.cpp
index e92504cc6..7cb2276d8 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLMediaElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLMediaElementCustom.cpp
@@ -43,7 +43,7 @@ void V8HTMLMediaElement::controllerAccessorSetter(v8::Local<v8::String> name, v8
         controller = V8MediaController::toNative(value->ToObject());
     
     if (!controller) {
-        throwError("Value is not of type MediaController");
+        V8Proxy::throwTypeError("Value is not of type MediaController");
         return;
     }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp b/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
index 1733ec8bc..143405430 100644
--- a/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
@@ -55,23 +55,23 @@ v8::Handle<v8::Value> toV8(IDBAny* impl, v8::Isolate* isolate)
     case IDBAny::NullType:
         return v8::Null();
     case IDBAny::DOMStringListType:
-        return toV8(impl->domStringList());
+        return toV8(impl->domStringList(), isolate);
     case IDBAny::IDBCursorType:
-        return toV8(impl->idbCursor());
+        return toV8(impl->idbCursor(), isolate);
     case IDBAny::IDBCursorWithValueType:
-        return toV8(impl->idbCursorWithValue());
+        return toV8(impl->idbCursorWithValue(), isolate);
     case IDBAny::IDBDatabaseType:
-        return toV8(impl->idbDatabase());
+        return toV8(impl->idbDatabase(), isolate);
     case IDBAny::IDBFactoryType:
-        return toV8(impl->idbFactory());
+        return toV8(impl->idbFactory(), isolate);
     case IDBAny::IDBIndexType:
-        return toV8(impl->idbIndex());
+        return toV8(impl->idbIndex(), isolate);
     case IDBAny::IDBKeyType:
-        return toV8(impl->idbKey());
+        return toV8(impl->idbKey(), isolate);
     case IDBAny::IDBObjectStoreType:
-        return toV8(impl->idbObjectStore());
+        return toV8(impl->idbObjectStore(), isolate);
     case IDBAny::IDBTransactionType:
-        return toV8(impl->idbTransaction());
+        return toV8(impl->idbTransaction(), isolate);
     case IDBAny::SerializedScriptValueType:
         return impl->serializedScriptValue()->deserialize(0, isolate);
     }
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 87d195ace..9f9780c7d 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -83,7 +83,7 @@ v8::Handle<v8::Value> V8InjectedScriptHost::inspectedObjectCallback(const v8::Ar
         return v8::Undefined();
 
     if (!args[0]->IsInt32()) {
-        throwError("argument has to be an integer");
+        V8Proxy::throwTypeError("argument has to be an integer");
         return v8::Undefined();
     }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp
index d87ed75d2..28fa21e3b 100644
--- a/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp
@@ -48,7 +48,7 @@ v8::Handle<v8::Value> V8Intent::constructorCallback(const v8::Arguments& args)
     INC_STATS("DOM.Intent.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -76,7 +76,7 @@ v8::Handle<v8::Value> V8Intent::constructorCallback(const v8::Arguments& args)
     ArrayBufferArray arrayBufferArrayTransferList;
     if (args.Length() > 3) {
         if (!extractTransferables(args[3], messagePortArrayTransferList, arrayBufferArrayTransferList))
-            return throwError("Could not extract transferables", V8Proxy::TypeError);
+            return V8Proxy::throwTypeError("Could not extract transferables");
     }
     bool dataDidThrow = false;
     RefPtr<SerializedScriptValue> data = SerializedScriptValue::create(args[2], &messagePortArrayTransferList, &arrayBufferArrayTransferList, dataDidThrow);
diff --git a/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
index bad469a50..9bb9c5513 100644
--- a/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
@@ -51,7 +51,7 @@ v8::Handle<v8::Value> V8MessageChannel::constructorCallback(const v8::Arguments&
     // FIXME: The logic here is almost exact duplicate of V8::constructDOMObject.
     // Consider refactoring to reduce duplication.
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
diff --git a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
index bc1ecc7e7..4ca198c7e 100644
--- a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -95,7 +95,7 @@ v8::Handle<v8::Value> V8NotificationCenter::requestPermissionCallback(const v8::
     RefPtr<V8CustomVoidCallback> callback;
     if (args.Length() > 0) {
         if (!args[0]->IsObject())
-            return throwError("Callback must be of valid type.", V8Proxy::TypeError);
+            return V8Proxy::throwTypeError("Callback must be of valid type.");
  
         callback = V8CustomVoidCallback::create(args[0], context);
     }
diff --git a/Source/WebCore/bindings/v8/custom/V8SVGElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SVGElementCustom.cpp
index fcce45a87..257f42dbb 100644
--- a/Source/WebCore/bindings/v8/custom/V8SVGElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SVGElementCustom.cpp
@@ -1,14 +1,14 @@
 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
- * Redistribution and use in source and binary forms") return toV8(static_cast<SVGwith or without
- * modification") return toV8(static_cast<SVGare permitted provided that the following conditions are
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
- * notice") return toV8(static_cast<SVGthis list of conditions and the following disclaimer.
+ * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
- * copyright notice") return toV8(static_cast<SVGthis list of conditions and the following disclaimer
+ * copyright notice, this list of conditions and the following disclaimer
  * in the documentation and/or other materials provided with the
  * distribution.
  *     * Neither the name of Google Inc. nor the names of its
@@ -16,16 +16,16 @@
  * this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES") return toV8(static_cast<SVGINCLUDING") return toV8(static_cast<SVGBUT NOT
- * LIMITED TO") return toV8(static_cast<SVGTHE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT") return toV8(static_cast<SVGINDIRECT") return toV8(static_cast<SVGINCIDENTAL,
- * SPECIAL") return toV8(static_cast<SVGEXEMPLARY") return toV8(static_cast<SVGOR CONSEQUENTIAL DAMAGES (INCLUDING") return toV8(static_cast<SVGBUT NOT
- * LIMITED TO") return toV8(static_cast<SVGPROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA") return toV8(static_cast<SVGOR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY") return toV8(static_cast<SVGWHETHER IN CONTRACT") return toV8(static_cast<SVGSTRICT LIABILITY") return toV8(static_cast<SVGOR TORT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE") return toV8(static_cast<SVGEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -41,7 +41,7 @@ v8::Handle<v8::Value> toV8(SVGElement* impl, v8::Isolate* isolate, bool forceNew
 {
     if (!impl)
         return v8::Null();
-    return createV8SVGWrapper(impl, forceNewObject);
+    return createV8SVGWrapper(impl, isolate, forceNewObject);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
index 896330439..4247fde98 100644
--- a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
@@ -136,7 +136,7 @@ static v8::Handle<v8::Boolean> storageDeleter(v8::Local<v8::String> v8Name, cons
         return v8::True();
     }
 
-    return deletionNotHandledByInterceptor();
+    return v8::Handle<v8::Boolean>();
 }
 
 v8::Handle<v8::Boolean> V8Storage::indexedPropertyDeleter(uint32_t index, const v8::AccessorInfo& info)
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
index e75b94476..771529e3e 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
@@ -55,7 +55,7 @@ v8::Handle<v8::Value> V8WebKitMutationObserver::constructorCallback(const v8::Ar
     INC_STATS("DOM.WebKitMutationObserver.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -69,7 +69,7 @@ v8::Handle<v8::Value> V8WebKitMutationObserver::constructorCallback(const v8::Ar
 
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
-        return throwError("WebKitMutationObserver constructor's associated frame unavailable", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "WebKitMutationObserver constructor's associated frame unavailable");
 
     RefPtr<MutationCallback> callback = V8MutationCallback::create(arg, context);
     RefPtr<WebKitMutationObserver> observer = WebKitMutationObserver::create(callback.release());
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
index 9a83bb8d5..da1247274 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
@@ -45,7 +45,7 @@ v8::Handle<v8::Value> V8WebKitPoint::constructorCallback(const v8::Arguments& ar
     INC_STATS("DOM.WebKitPoint.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
diff --git a/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
index ae12b6fee..3b1143799 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
@@ -56,7 +56,7 @@ v8::Handle<v8::Value> V8WebSocket::constructorCallback(const v8::Arguments& args
     INC_STATS("DOM.WebSocket.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -69,12 +69,12 @@ v8::Handle<v8::Value> V8WebSocket::constructorCallback(const v8::Arguments& args
     if (tryCatch.HasCaught())
         return throwError(tryCatch.Exception());
     if (urlstring.IsEmpty())
-        return throwError("Empty URL", V8Proxy::SyntaxError);
+        return V8Proxy::throwError(V8Proxy::SyntaxError, "Empty URL");
 
     // Get the script execution context.
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
-        return throwError("WebSocket constructor's associated frame is not available", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "WebSocket constructor's associated frame is not available");
 
     const KURL& url = context->completeURL(toWebCoreString(urlstring));
 
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
index 71d7dd286..87d054ff8 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
@@ -48,7 +48,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::constructorCallback(const v8::Arguments&
     INC_STATS("DOM.XMLHttpRequest.Constructor");
 
     if (!args.IsConstructCall())
-        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+        return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.");
 
     if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
         return args.Holder();
@@ -57,7 +57,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::constructorCallback(const v8::Arguments&
     // Allocate a XMLHttpRequest object as its internal field.
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
-        return throwError("XMLHttpRequest constructor's associated context is not available", V8Proxy::ReferenceError);
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "XMLHttpRequest constructor's associated context is not available");
 
     RefPtr<SecurityOrigin> securityOrigin;
     if (V8IsolatedContext* isolatedContext = V8IsolatedContext::getEntered())
diff --git a/Source/WebCore/bridge/c/c_class.cpp b/Source/WebCore/bridge/c/c_class.cpp
index 4f9cdd90f..50073d1af 100644
--- a/Source/WebCore/bridge/c/c_class.cpp
+++ b/Source/WebCore/bridge/c/c_class.cpp
@@ -73,24 +73,26 @@ CClass* CClass::classForIsA(NPClass* isa)
     return aClass;
 }
 
-MethodList CClass::methodsNamed(const Identifier& identifier, Instance* instance) const
+MethodList CClass::methodsNamed(PropertyName identifier, Instance* instance) const
 {
+    UString name(identifier.impl());
+    
     MethodList methodList;
 
-    Method* method = _methods.get(identifier.ustring().impl());
+    Method* method = _methods.get(name.impl());
     if (method) {
         methodList.append(method);
         return methodList;
     }
 
-    NPIdentifier ident = _NPN_GetStringIdentifier(identifier.ascii().data());
+    NPIdentifier ident = _NPN_GetStringIdentifier(name.ascii().data());
     const CInstance* inst = static_cast<const CInstance*>(instance);
     NPObject* obj = inst->getObject();
     if (_isa->hasMethod && _isa->hasMethod(obj, ident)){
         Method* aMethod = new CMethod(ident); // deleted in the CClass destructor
         {
             JSLock lock(SilenceAssertionsOnly);
-            _methods.set(identifier.ustring().impl(), aMethod);
+            _methods.set(name.impl(), aMethod);
         }
         methodList.append(aMethod);
     }
@@ -98,20 +100,22 @@ MethodList CClass::methodsNamed(const Identifier& identifier, Instance* instance
     return methodList;
 }
 
-Field* CClass::fieldNamed(const Identifier& identifier, Instance* instance) const
+Field* CClass::fieldNamed(PropertyName identifier, Instance* instance) const
 {
-    Field* aField = _fields.get(identifier.ustring().impl());
+    UString name(identifier.impl());
+    
+    Field* aField = _fields.get(name.impl());
     if (aField)
         return aField;
     
-    NPIdentifier ident = _NPN_GetStringIdentifier(identifier.ascii().data());
+    NPIdentifier ident = _NPN_GetStringIdentifier(name.ascii().data());
     const CInstance* inst = static_cast<const CInstance*>(instance);
     NPObject* obj = inst->getObject();
     if (_isa->hasProperty && _isa->hasProperty(obj, ident)){
         aField = new CField(ident); // deleted in the CClass destructor
         {
             JSLock lock(SilenceAssertionsOnly);
-            _fields.set(identifier.ustring().impl(), aField);
+            _fields.set(name.impl(), aField);
         }
     }
     return aField;
diff --git a/Source/WebCore/bridge/c/c_class.h b/Source/WebCore/bridge/c/c_class.h
index 0ee88cf53..c8c2e8985 100644
--- a/Source/WebCore/bridge/c/c_class.h
+++ b/Source/WebCore/bridge/c/c_class.h
@@ -43,8 +43,8 @@ public:
     static CClass* classForIsA(NPClass*);
     virtual ~CClass();
 
-    virtual MethodList methodsNamed(const Identifier&, Instance*) const;
-    virtual Field* fieldNamed(const Identifier&, Instance*) const;
+    virtual MethodList methodsNamed(PropertyName, Instance*) const;
+    virtual Field* fieldNamed(PropertyName, Instance*) const;
 
 private:
     NPClass* _isa;
diff --git a/Source/WebCore/bridge/c/c_instance.cpp b/Source/WebCore/bridge/c/c_instance.cpp
index b23e2b5de..d21786a8b 100644
--- a/Source/WebCore/bridge/c/c_instance.cpp
+++ b/Source/WebCore/bridge/c/c_instance.cpp
@@ -113,7 +113,7 @@ class CRuntimeMethod : public RuntimeMethod {
 public:
     typedef RuntimeMethod Base;
 
-    static CRuntimeMethod* create(ExecState* exec, JSGlobalObject* globalObject, const Identifier& name, Bindings::MethodList& list)
+    static CRuntimeMethod* create(ExecState* exec, JSGlobalObject* globalObject, const UString& name, Bindings::MethodList& list)
     {
         // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
         // We need to pass in the right global object for "i".
@@ -136,7 +136,7 @@ private:
     {
     }
 
-    void finishCreation(JSGlobalData& globalData, const Identifier& name)
+    void finishCreation(JSGlobalData& globalData, const UString& name)
     {
         Base::finishCreation(globalData, name);
         ASSERT(inherits(&s_info));
@@ -146,10 +146,10 @@ private:
 
 const ClassInfo CRuntimeMethod::s_info = { "CRuntimeMethod", &RuntimeMethod::s_info, 0, 0, CREATE_METHOD_TABLE(CRuntimeMethod) };
 
-JSValue CInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+JSValue CInstance::getMethod(ExecState* exec, PropertyName propertyName)
 {
     MethodList methodList = getClass()->methodsNamed(propertyName, this);
-    return CRuntimeMethod::create(exec, exec->lexicalGlobalObject(), propertyName, methodList);
+    return CRuntimeMethod::create(exec, exec->lexicalGlobalObject(), propertyName.impl(), methodList);
 }
 
 JSValue CInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod)
diff --git a/Source/WebCore/bridge/c/c_instance.h b/Source/WebCore/bridge/c/c_instance.h
index a525a7acd..61e34911b 100644
--- a/Source/WebCore/bridge/c/c_instance.h
+++ b/Source/WebCore/bridge/c/c_instance.h
@@ -59,7 +59,7 @@ public:
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue getMethod(ExecState*, PropertyName);
     virtual JSValue invokeMethod(ExecState*, RuntimeMethod* method);
     virtual bool supportsInvokeDefaultMethod() const;
     virtual JSValue invokeDefaultMethod(ExecState*);
diff --git a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
index 9756e7df6..6787a972c 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
@@ -114,7 +114,7 @@ JavaClass::~JavaClass()
     m_methods.clear();
 }
 
-MethodList JavaClass::methodsNamed(const Identifier& identifier, Instance*) const
+MethodList JavaClass::methodsNamed(PropertyName identifier, Instance*) const
 {
     MethodList* methodList = m_methods.get(identifier.ustring().impl());
 
@@ -123,7 +123,7 @@ MethodList JavaClass::methodsNamed(const Identifier& identifier, Instance*) cons
     return MethodList();
 }
 
-Field* JavaClass::fieldNamed(const Identifier& identifier, Instance*) const
+Field* JavaClass::fieldNamed(PropertyName identifier, Instance*) const
 {
     return m_fields.get(identifier.ustring().impl());
 }
diff --git a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.h b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.h
index 48c9cac54..15308079c 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.h
@@ -41,8 +41,8 @@ public:
     JavaClass(jobject);
     ~JavaClass();
 
-    virtual MethodList methodsNamed(const Identifier&, Instance*) const;
-    virtual Field* fieldNamed(const Identifier&, Instance*) const;
+    virtual MethodList methodsNamed(PropertyName, Instance*) const;
+    virtual Field* fieldNamed(PropertyName, Instance*) const;
 
     bool isNumberClass() const;
     bool isBooleanClass() const;
diff --git a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
index 6af2da5a7..255739e23 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
@@ -118,7 +118,7 @@ class JavaRuntimeMethod : public RuntimeMethod {
 public:
     typedef RuntimeMethod Base;
 
-    static JavaRuntimeMethod* create(ExecState* exec, JSGlobalObject* globalObject, const Identifier& name, Bindings::MethodList& list)
+    static JavaRuntimeMethod* create(ExecState* exec, JSGlobalObject* globalObject, const UString& name, Bindings::MethodList& list)
     {
         // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
         // We need to pass in the right global object for "i".
@@ -141,7 +141,7 @@ private:
     {
     }
 
-    void finishCreation(JSGlobalData& globalData, const Identifier& name)
+    void finishCreation(JSGlobalData& globalData, const UString& name)
     {
         Base::finishCreation(globalData, name);
         ASSERT(inherits(&s_info));
@@ -150,10 +150,10 @@ private:
 
 const ClassInfo JavaRuntimeMethod::s_info = { "JavaRuntimeMethod", &RuntimeMethod::s_info, 0, 0, CREATE_METHOD_TABLE(JavaRuntimeMethod) };
 
-JSValue JavaInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+JSValue JavaInstance::getMethod(ExecState* exec, PropertyName propertyName)
 {
     MethodList methodList = getClass()->methodsNamed(propertyName, this);
-    return JavaRuntimeMethod::create(exec, exec->lexicalGlobalObject(), propertyName, methodList);
+    return JavaRuntimeMethod::create(exec, exec->lexicalGlobalObject(), propertyName.ustring(), methodList);
 }
 
 JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod)
diff --git a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.h b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.h
index 22389cdf3..f8d6c8e85 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.h
@@ -53,8 +53,8 @@ public:
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
-    virtual JSValue invokeMethod(ExecState* exec, RuntimeMethod* method);
+    virtual JSValue getMethod(ExecState*, PropertyName);
+    virtual JSValue invokeMethod(ExecState*, RuntimeMethod*);
 
     jobject javaInstance() const { return m_instance->instance(); }
 
diff --git a/Source/WebCore/bridge/jsc/BridgeJSC.h b/Source/WebCore/bridge/jsc/BridgeJSC.h
index a9f2baed0..7375bfed8 100644
--- a/Source/WebCore/bridge/jsc/BridgeJSC.h
+++ b/Source/WebCore/bridge/jsc/BridgeJSC.h
@@ -62,9 +62,9 @@ class Class {
     WTF_MAKE_NONCOPYABLE(Class); WTF_MAKE_FAST_ALLOCATED;
 public:
     Class() { }
-    virtual MethodList methodsNamed(const Identifier&, Instance*) const = 0;
-    virtual Field* fieldNamed(const Identifier&, Instance*) const = 0;
-    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&) { return jsUndefined(); }
+    virtual MethodList methodsNamed(PropertyName, Instance*) const = 0;
+    virtual Field* fieldNamed(PropertyName, Instance*) const = 0;
+    virtual JSValue fallbackObject(ExecState*, Instance*, PropertyName) { return jsUndefined(); }
 
     virtual ~Class() { }
 };
@@ -89,9 +89,9 @@ public:
     void willInvalidateRuntimeObject();
 
     // Returns false if the value was not set successfully.
-    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
+    virtual bool setValueOfUndefinedField(ExecState*, PropertyName, JSValue) { return false; }
 
-    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName) = 0;
+    virtual JSValue getMethod(ExecState*, PropertyName) = 0;
     virtual JSValue invokeMethod(ExecState*, RuntimeMethod* method) = 0;
 
     virtual bool supportsInvokeDefaultMethod() const { return false; }
@@ -110,9 +110,9 @@ public:
 
     virtual ~Instance();
 
-    virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
-    virtual bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&) { return false; }
-    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&) { }
+    virtual bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&) { return false; }
+    virtual bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&) { return false; }
+    virtual void put(JSObject*, ExecState*, PropertyName, JSValue, PutPropertySlot&) { }
 
 protected:
     virtual void virtualBegin() { }
diff --git a/Source/WebCore/bridge/objc/objc_class.h b/Source/WebCore/bridge/objc/objc_class.h
index 298549054..c358ae93b 100644
--- a/Source/WebCore/bridge/objc/objc_class.h
+++ b/Source/WebCore/bridge/objc/objc_class.h
@@ -41,10 +41,10 @@ public:
     // Return the cached ObjC of the specified name.
     static ObjcClass *classForIsA(ClassStructPtr);
     
-    virtual MethodList methodsNamed(const Identifier&, Instance *instance) const;
-    virtual Field *fieldNamed(const Identifier&, Instance *instance) const;
+    virtual MethodList methodsNamed(PropertyName, Instance*) const;
+    virtual Field *fieldNamed(PropertyName, Instance*) const;
 
-    virtual JSValue fallbackObject(ExecState *exec, Instance *instance, const Identifier &propertyName);
+    virtual JSValue fallbackObject(ExecState*, Instance*, PropertyName);
     
     ClassStructPtr isa() { return _isa; }
     
diff --git a/Source/WebCore/bridge/objc/objc_class.mm b/Source/WebCore/bridge/objc/objc_class.mm
index d02422bbd..7080ee4f4 100644
--- a/Source/WebCore/bridge/objc/objc_class.mm
+++ b/Source/WebCore/bridge/objc/objc_class.mm
@@ -95,7 +95,7 @@ static inline void convertJSMethodNameToObjc(const CString& jsName, JSNameConver
     }
 }
 
-MethodList ObjcClass::methodsNamed(const Identifier& identifier, Instance*) const
+MethodList ObjcClass::methodsNamed(PropertyName identifier, Instance*) const
 {
     MethodList methodList;
     if (Method* method = m_methodCache.get(identifier.impl())) {
@@ -103,7 +103,7 @@ MethodList ObjcClass::methodsNamed(const Identifier& identifier, Instance*) cons
         return methodList;
     }
 
-    CString jsName = identifier.ascii();
+    CString jsName = identifier.ustring().ascii();
     JSNameConversionBuffer buffer;
     convertJSMethodNameToObjc(jsName, buffer);
     RetainPtr<CFStringRef> methodName(AdoptCF, CFStringCreateWithCString(NULL, buffer.data(), kCFStringEncodingASCII));
@@ -143,7 +143,7 @@ MethodList ObjcClass::methodsNamed(const Identifier& identifier, Instance*) cons
     return methodList;
 }
 
-Field* ObjcClass::fieldNamed(const Identifier& identifier, Instance* instance) const
+Field* ObjcClass::fieldNamed(PropertyName identifier, Instance* instance) const
 {
     Field* field = m_fieldCache.get(identifier.impl());
     if (field)
@@ -151,7 +151,7 @@ Field* ObjcClass::fieldNamed(const Identifier& identifier, Instance* instance) c
 
     ClassStructPtr thisClass = _isa;
 
-    CString jsName = identifier.ascii();
+    CString jsName = identifier.ustring().ascii();
     RetainPtr<CFStringRef> fieldName(AdoptCF, CFStringCreateWithCString(NULL, jsName.data(), kCFStringEncodingASCII));
     id targetObject = (static_cast<ObjcInstance*>(instance))->getObject();
     id attributes = [targetObject attributeKeys];
@@ -221,14 +221,14 @@ Field* ObjcClass::fieldNamed(const Identifier& identifier, Instance* instance) c
     return field;
 }
 
-JSValue ObjcClass::fallbackObject(ExecState* exec, Instance* instance, const Identifier &propertyName)
+JSValue ObjcClass::fallbackObject(ExecState* exec, Instance* instance, PropertyName propertyName)
 {
     ObjcInstance* objcInstance = static_cast<ObjcInstance*>(instance);
     id targetObject = objcInstance->getObject();
     
     if (![targetObject respondsToSelector:@selector(invokeUndefinedMethodFromWebScript:withArguments:)])
         return jsUndefined();
-    return ObjcFallbackObjectImp::create(exec, exec->lexicalGlobalObject(), objcInstance, propertyName);
+    return ObjcFallbackObjectImp::create(exec, exec->lexicalGlobalObject(), objcInstance, propertyName.impl());
 }
 
 }
diff --git a/Source/WebCore/bridge/objc/objc_instance.h b/Source/WebCore/bridge/objc/objc_instance.h
index 914c1fcc5..e0b603f9d 100644
--- a/Source/WebCore/bridge/objc/objc_instance.h
+++ b/Source/WebCore/bridge/objc/objc_instance.h
@@ -47,14 +47,14 @@ public:
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue getMethod(ExecState*, PropertyName);
     JSValue invokeObjcMethod(ExecState*, ObjcMethod* method);
     virtual JSValue invokeMethod(ExecState*, RuntimeMethod* method);
     virtual bool supportsInvokeDefaultMethod() const;
     virtual JSValue invokeDefaultMethod(ExecState*);
 
-    JSValue getValueOfUndefinedField(ExecState*, const Identifier&) const;
-    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue);
+    JSValue getValueOfUndefinedField(ExecState*, PropertyName) const;
+    virtual bool setValueOfUndefinedField(ExecState*, PropertyName, JSValue);
 
     ObjectStructPtr getObject() const { return _instance.get(); }
     
diff --git a/Source/WebCore/bridge/objc/objc_instance.mm b/Source/WebCore/bridge/objc/objc_instance.mm
index af544b668..cc0e6890e 100644
--- a/Source/WebCore/bridge/objc/objc_instance.mm
+++ b/Source/WebCore/bridge/objc/objc_instance.mm
@@ -181,7 +181,7 @@ bool ObjcInstance::supportsInvokeDefaultMethod() const
 
 class ObjCRuntimeMethod : public RuntimeMethod {
 public:
-    static ObjCRuntimeMethod* create(ExecState* exec, JSGlobalObject* globalObject, const Identifier& name, Bindings::MethodList& list)
+    static ObjCRuntimeMethod* create(ExecState* exec, JSGlobalObject* globalObject, const UString& name, Bindings::MethodList& list)
     {
         // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
         // We need to pass in the right global object for "i".
@@ -206,7 +206,7 @@ private:
     {
     }
 
-    void finishCreation(JSGlobalData& globalData, const Identifier& name)
+    void finishCreation(JSGlobalData& globalData, const UString& name)
     {
         Base::finishCreation(globalData, name);
         ASSERT(inherits(&s_info));
@@ -215,10 +215,10 @@ private:
 
 const ClassInfo ObjCRuntimeMethod::s_info = { "ObjCRuntimeMethod", &RuntimeMethod::s_info, 0, 0, CREATE_METHOD_TABLE(ObjCRuntimeMethod) };
 
-JSValue ObjcInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+JSValue ObjcInstance::getMethod(ExecState* exec, PropertyName propertyName)
 {
     MethodList methodList = getClass()->methodsNamed(propertyName, this);
-    return ObjCRuntimeMethod::create(exec, exec->lexicalGlobalObject(), propertyName, methodList);
+    return ObjCRuntimeMethod::create(exec, exec->lexicalGlobalObject(), propertyName.ustring(), methodList);
 }
 
 JSValue ObjcInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod)
@@ -401,7 +401,7 @@ JSValue ObjcInstance::invokeDefaultMethod(ExecState* exec)
     return const_cast<JSValue&>(result);
 }
 
-bool ObjcInstance::setValueOfUndefinedField(ExecState* exec, const Identifier& property, JSValue aValue)
+bool ObjcInstance::setValueOfUndefinedField(ExecState* exec, PropertyName property, JSValue aValue)
 {
     id targetObject = getObject();
     if (![targetObject respondsToSelector:@selector(setValue:forUndefinedKey:)])
@@ -418,7 +418,7 @@ bool ObjcInstance::setValueOfUndefinedField(ExecState* exec, const Identifier& p
         ObjcValue objcValue = convertValueToObjcValue(exec, aValue, ObjcObjectType);
 
         @try {
-            [targetObject setValue:objcValue.objectValue forUndefinedKey:[NSString stringWithCString:property.ascii().data() encoding:NSASCIIStringEncoding]];
+            [targetObject setValue:objcValue.objectValue forUndefinedKey:[NSString stringWithCString:property.ustring().ascii().data() encoding:NSASCIIStringEncoding]];
         } @catch(NSException* localException) {
             // Do nothing.  Class did not override valueForUndefinedKey:.
         }
@@ -429,7 +429,7 @@ bool ObjcInstance::setValueOfUndefinedField(ExecState* exec, const Identifier& p
     return true;
 }
 
-JSValue ObjcInstance::getValueOfUndefinedField(ExecState* exec, const Identifier& property) const
+JSValue ObjcInstance::getValueOfUndefinedField(ExecState* exec, PropertyName property) const
 {
     JSValue result = jsUndefined();
     
@@ -444,7 +444,7 @@ JSValue ObjcInstance::getValueOfUndefinedField(ExecState* exec, const Identifier
         setGlobalException(nil);
     
         @try {
-            id objcValue = [targetObject valueForUndefinedKey:[NSString stringWithCString:property.ascii().data() encoding:NSASCIIStringEncoding]];
+            id objcValue = [targetObject valueForUndefinedKey:[NSString stringWithCString:property.ustring().ascii().data() encoding:NSASCIIStringEncoding]];
             result = convertObjcValueToValue(exec, &objcValue, ObjcObjectType, m_rootObject.get());
         } @catch(NSException* localException) {
             // Do nothing.  Class did not override valueForUndefinedKey:.
diff --git a/Source/WebCore/bridge/objc/objc_runtime.h b/Source/WebCore/bridge/objc/objc_runtime.h
index f008706bd..1d16040c7 100644
--- a/Source/WebCore/bridge/objc/objc_runtime.h
+++ b/Source/WebCore/bridge/objc/objc_runtime.h
@@ -94,7 +94,7 @@ class ObjcFallbackObjectImp : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
 
-    static ObjcFallbackObjectImp* create(ExecState* exec, JSGlobalObject* globalObject, ObjcInstance* instance, const Identifier& propertyName)
+    static ObjcFallbackObjectImp* create(ExecState* exec, JSGlobalObject* globalObject, ObjcInstance* instance, const UString& propertyName)
     {
         // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
         Structure* domStructure = WebCore::deprecatedGetDOMStructure<ObjcFallbackObjectImp>(exec);
@@ -105,7 +105,7 @@ public:
 
     static const ClassInfo s_info;
 
-    const Identifier& propertyName() const { return _item; }
+    const UString& propertyName() const { return _item; }
 
     static ObjectPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
@@ -121,20 +121,20 @@ protected:
     void finishCreation(JSGlobalObject*);
 
 private:
-    ObjcFallbackObjectImp(JSGlobalObject*, Structure*, ObjcInstance*, const Identifier& propertyName);
+    ObjcFallbackObjectImp(JSGlobalObject*, Structure*, ObjcInstance*, const UString& propertyName);
     static void destroy(JSCell*);
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
-    static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier&, PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
-    static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
+    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
     static CallType getCallData(JSCell*, CallData&);
-    static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
     static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
 
     bool toBoolean(ExecState*) const; // FIXME: Currently this is broken because none of the superclasses are marked virtual. We need to solve this in the longer term.
 
     RefPtr<ObjcInstance> _instance;
-    Identifier _item;
+    UString _item;
 };
 
 } // namespace Bindings
diff --git a/Source/WebCore/bridge/objc/objc_runtime.mm b/Source/WebCore/bridge/objc/objc_runtime.mm
index 72fedc745..25a3d1fc2 100644
--- a/Source/WebCore/bridge/objc/objc_runtime.mm
+++ b/Source/WebCore/bridge/objc/objc_runtime.mm
@@ -192,7 +192,7 @@ unsigned int ObjcArray::getLength() const
 
 const ClassInfo ObjcFallbackObjectImp::s_info = { "ObjcFallbackObject", &JSNonFinalObject::s_info, 0, 0, CREATE_METHOD_TABLE(ObjcFallbackObjectImp) };
 
-ObjcFallbackObjectImp::ObjcFallbackObjectImp(JSGlobalObject* globalObject, Structure* structure, ObjcInstance* i, const Identifier& propertyName)
+ObjcFallbackObjectImp::ObjcFallbackObjectImp(JSGlobalObject* globalObject, Structure* structure, ObjcInstance* i, const UString& propertyName)
     : JSNonFinalObject(globalObject->globalData(), structure)
     , _instance(i)
     , _item(propertyName)
@@ -210,21 +210,21 @@ void ObjcFallbackObjectImp::finishCreation(JSGlobalObject* globalObject)
     ASSERT(inherits(&s_info));
 }
 
-bool ObjcFallbackObjectImp::getOwnPropertySlot(JSCell*, ExecState*, const Identifier&, PropertySlot& slot)
+bool ObjcFallbackObjectImp::getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot& slot)
 {
     // keep the prototype from getting called instead of just returning false
     slot.setUndefined();
     return true;
 }
 
-bool ObjcFallbackObjectImp::getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor& descriptor)
+bool ObjcFallbackObjectImp::getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor& descriptor)
 {
     // keep the prototype from getting called instead of just returning false
     descriptor.setUndefined();
     return true;
 }
 
-void ObjcFallbackObjectImp::put(JSCell*, ExecState*, const Identifier&, JSValue, PutPropertySlot&)
+void ObjcFallbackObjectImp::put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&)
 {
 }
 
@@ -249,7 +249,7 @@ static EncodedJSValue JSC_HOST_CALL callObjCFallbackObject(ExecState* exec)
     if ([targetObject respondsToSelector:@selector(invokeUndefinedMethodFromWebScript:withArguments:)]){
         ObjcClass* objcClass = static_cast<ObjcClass*>(objcInstance->getClass());
         OwnPtr<ObjcMethod> fallbackMethod(adoptPtr(new ObjcMethod(objcClass->isa(), @selector(invokeUndefinedMethodFromWebScript:withArguments:))));
-        const Identifier& nameIdentifier = static_cast<ObjcFallbackObjectImp*>(exec->callee())->propertyName();
+        const UString& nameIdentifier = static_cast<ObjcFallbackObjectImp*>(exec->callee())->propertyName();
         RetainPtr<CFStringRef> name(AdoptCF, CFStringCreateWithCharacters(0, nameIdentifier.characters(), nameIdentifier.length()));
         fallbackMethod->setJavaScriptName(name.get());
         result = objcInstance->invokeObjcMethod(exec, fallbackMethod.get());
@@ -270,7 +270,7 @@ CallType ObjcFallbackObjectImp::getCallData(JSCell* cell, CallData& callData)
     return CallTypeHost;
 }
 
-bool ObjcFallbackObjectImp::deleteProperty(JSCell*, ExecState*, const Identifier&)
+bool ObjcFallbackObjectImp::deleteProperty(JSCell*, ExecState*, PropertyName)
 {
     return false;
 }
@@ -278,7 +278,7 @@ bool ObjcFallbackObjectImp::deleteProperty(JSCell*, ExecState*, const Identifier
 JSValue ObjcFallbackObjectImp::defaultValue(const JSObject* object, ExecState* exec, PreferredPrimitiveType)
 {
     const ObjcFallbackObjectImp* thisObject = jsCast<const ObjcFallbackObjectImp*>(object);
-    return thisObject->_instance->getValueOfUndefinedField(exec, thisObject->_item);
+    return thisObject->_instance->getValueOfUndefinedField(exec, Identifier(exec, thisObject->_item));
 }
 
 bool ObjcFallbackObjectImp::toBoolean(ExecState *) const
diff --git a/Source/WebCore/bridge/qt/qt_class.cpp b/Source/WebCore/bridge/qt/qt_class.cpp
index 2ed7a0841..d53d27c91 100644
--- a/Source/WebCore/bridge/qt/qt_class.cpp
+++ b/Source/WebCore/bridge/qt/qt_class.cpp
@@ -66,7 +66,7 @@ const char* QtClass::name() const
 // and not get wrapped in RuntimeMethod). Also, use this for methods,
 // so we can cache the object and return the same object for the same
 // identifier.
-JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifier& identifier)
+JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, PropertyName identifier)
 {
     QtInstance* qtinst = static_cast<QtInstance*>(inst);
 
@@ -86,7 +86,7 @@ JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifie
     if (normal.contains('(') && (index = m_metaObject->indexOfMethod(normal)) != -1) {
         QMetaMethod m = m_metaObject->method(index);
         if (m.access() != QMetaMethod::Private) {
-            QtRuntimeMetaMethod* val = QtRuntimeMetaMethod::create(exec, identifier, static_cast<QtInstance*>(inst), index, normal, false);
+            QtRuntimeMetaMethod* val = QtRuntimeMetaMethod::create(exec, ustring, static_cast<QtInstance*>(inst), index, normal, false);
             qtinst->m_methods.insert(name, WriteBarrier<JSObject>(exec->globalData(), qtinst->createRuntimeObject(exec), val));
             return val;
         }
@@ -109,7 +109,7 @@ JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifie
 #else
         if (normal == m.name()) {
 #endif
-            QtRuntimeMetaMethod* val = QtRuntimeMetaMethod::create(exec, identifier, static_cast<QtInstance*>(inst), index, normal, false);
+            QtRuntimeMetaMethod* val = QtRuntimeMetaMethod::create(exec, ustring, static_cast<QtInstance*>(inst), index, normal, false);
             qtinst->m_methods.insert(name, WriteBarrier<JSObject>(exec->globalData(), qtinst->createRuntimeObject(exec), val));
             return val;
         }
@@ -119,7 +119,7 @@ JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifie
 }
 
 // This functionality is handled by the fallback case above...
-MethodList QtClass::methodsNamed(const Identifier&, Instance*) const
+MethodList QtClass::methodsNamed(PropertyName, Instance*) const
 {
     return MethodList();
 }
@@ -127,7 +127,7 @@ MethodList QtClass::methodsNamed(const Identifier&, Instance*) const
 // ### we may end up with a different search order than QtScript by not
 // folding this code into the fallbackMethod above, but Fields propagate out
 // of the binding code
-Field* QtClass::fieldNamed(const Identifier& identifier, Instance* instance) const
+Field* QtClass::fieldNamed(PropertyName identifier, Instance* instance) const
 {
     // Check static properties first
     QtInstance* qtinst = static_cast<QtInstance*>(instance);
diff --git a/Source/WebCore/bridge/qt/qt_class.h b/Source/WebCore/bridge/qt/qt_class.h
index 4c1a7538d..ce9bbc446 100644
--- a/Source/WebCore/bridge/qt/qt_class.h
+++ b/Source/WebCore/bridge/qt/qt_class.h
@@ -41,10 +41,10 @@ public:
     virtual ~QtClass();
 
     virtual const char* name() const;
-    virtual MethodList methodsNamed(const Identifier&, Instance*) const;
-    virtual Field* fieldNamed(const Identifier&, Instance*) const;
+    virtual MethodList methodsNamed(PropertyName, Instance*) const;
+    virtual Field* fieldNamed(PropertyName, Instance*) const;
 
-    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&);
+    virtual JSValue fallbackObject(ExecState*, Instance*, PropertyName);
 
 private:
     QtClass(const QtClass&); // prohibit copying
diff --git a/Source/WebCore/bridge/qt/qt_instance.cpp b/Source/WebCore/bridge/qt/qt_instance.cpp
index ced002260..4222cc531 100644
--- a/Source/WebCore/bridge/qt/qt_instance.cpp
+++ b/Source/WebCore/bridge/qt/qt_instance.cpp
@@ -148,12 +148,12 @@ PassRefPtr<QtInstance> QtInstance::getQtInstance(QObject* o, PassRefPtr<RootObje
     return ret.release();
 }
 
-bool QtInstance::getOwnPropertySlot(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool QtInstance::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     return JSObject::getOwnPropertySlot(object, exec, propertyName, slot);
 }
 
-void QtInstance::put(JSObject* object, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void QtInstance::put(JSObject* object, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSObject::put(object, exec, propertyName, value, slot);
 }
@@ -248,12 +248,12 @@ void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array)
     }
 }
 
-JSValue QtInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+JSValue QtInstance::getMethod(ExecState* exec, PropertyName propertyName)
 {
     if (!getClass())
         return jsNull();
     MethodList methodList = m_class->methodsNamed(propertyName, this);
-    return RuntimeMethod::create(exec, exec->lexicalGlobalObject(), WebCore::deprecatedGetDOMStructure<RuntimeMethod>(exec), propertyName, methodList);
+    return RuntimeMethod::create(exec, exec->lexicalGlobalObject(), WebCore::deprecatedGetDOMStructure<RuntimeMethod>(exec), propertyName.ustring(), methodList);
 }
 
 JSValue QtInstance::invokeMethod(ExecState*, RuntimeMethod*)
diff --git a/Source/WebCore/bridge/qt/qt_instance.h b/Source/WebCore/bridge/qt/qt_instance.h
index fa1fd1f33..055623bfd 100644
--- a/Source/WebCore/bridge/qt/qt_instance.h
+++ b/Source/WebCore/bridge/qt/qt_instance.h
@@ -51,7 +51,7 @@ public:
 
     void visitAggregate(SlotVisitor&);
 
-    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue getMethod(ExecState*, PropertyName);
     virtual JSValue invokeMethod(ExecState*, RuntimeMethod*);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
@@ -65,8 +65,8 @@ public:
 
     static PassRefPtr<QtInstance> getQtInstance(QObject*, PassRefPtr<RootObject>, QScriptEngine::ValueOwnership ownership);
 
-    virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&);
-    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+    virtual bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    virtual void put(JSObject*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
 
     void removeCachedMethod(JSObject*);
 
diff --git a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
index 7e8d7a5b7..ed9cea74a 100644
--- a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
+++ b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
@@ -50,8 +50,8 @@ namespace Bindings {
 class QtPixmapClass : public Class {
 public:
     QtPixmapClass();
-    virtual MethodList methodsNamed(const Identifier&, Instance*) const;
-    virtual Field* fieldNamed(const Identifier&, Instance*) const;
+    virtual MethodList methodsNamed(PropertyName, Instance*) const;
+    virtual Field* fieldNamed(PropertyName, Instance*) const;
 };
 
 
@@ -239,10 +239,10 @@ Class* QtPixmapInstance::getClass() const
     return &qt_pixmap_metaData.cls;
 }
 
-JSValue QtPixmapInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+JSValue QtPixmapInstance::getMethod(ExecState* exec, PropertyName propertyName)
 {
     MethodList methodList = getClass()->methodsNamed(propertyName, this);
-    return RuntimeMethod::create(exec, exec->lexicalGlobalObject(), WebCore::deprecatedGetDOMStructure<RuntimeMethod>(exec), propertyName, methodList);
+    return RuntimeMethod::create(exec, exec->lexicalGlobalObject(), WebCore::deprecatedGetDOMStructure<RuntimeMethod>(exec), propertyName.ustring(), methodList);
 }
 
 JSValue QtPixmapInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod)
@@ -256,25 +256,25 @@ JSValue QtPixmapInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMe
     return jsUndefined();
 }
 
-MethodList QtPixmapClass::methodsNamed(const Identifier& identifier, Instance*) const
+MethodList QtPixmapClass::methodsNamed(PropertyName identifier, Instance*) const
 {
     MethodList methods;
-    if (identifier == QtPixmapToDataUrlMethod::name())
+    if (identifier.ustring() == QtPixmapToDataUrlMethod::name())
         methods.append(&qt_pixmap_metaData.toDataUrlMethod);
-    else if (identifier == QtPixmapToImageDataMethod::name())
+    else if (identifier.ustring() == QtPixmapToImageDataMethod::name())
         methods.append(&qt_pixmap_metaData.toImageDataMethod);
-    else if (identifier == QtPixmapAssignToElementMethod::name())
+    else if (identifier.ustring() == QtPixmapAssignToElementMethod::name())
         methods.append(&qt_pixmap_metaData.assignToElementMethod);
-    else if (identifier == QtPixmapToStringMethod::name())
+    else if (identifier.ustring() == QtPixmapToStringMethod::name())
         methods.append(&qt_pixmap_metaData.toStringMethod);
     return methods;
 }
 
-Field* QtPixmapClass::fieldNamed(const Identifier& identifier, Instance*) const
+Field* QtPixmapClass::fieldNamed(PropertyName identifier, Instance*) const
 {
-    if (identifier == QtPixmapWidthField::name())
+    if (identifier.ustring() == QtPixmapWidthField::name())
         return &qt_pixmap_metaData.widthField;
-    if (identifier == QtPixmapHeightField::name())
+    if (identifier.ustring() == QtPixmapHeightField::name())
         return &qt_pixmap_metaData.heightField;
     return 0;
 }
diff --git a/Source/WebCore/bridge/qt/qt_pixmapruntime.h b/Source/WebCore/bridge/qt/qt_pixmapruntime.h
index b474efd0b..c41c9e2e0 100644
--- a/Source/WebCore/bridge/qt/qt_pixmapruntime.h
+++ b/Source/WebCore/bridge/qt/qt_pixmapruntime.h
@@ -32,17 +32,17 @@ class QtPixmapInstance : public Instance {
 public:
     QtPixmapInstance(PassRefPtr<RootObject> rootObj, const QVariant& newData);
     virtual Class* getClass() const;
-    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue getMethod(ExecState*, PropertyName);
     virtual JSValue invokeMethod(ExecState*, RuntimeMethod*);
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
-    virtual JSValue valueOf(ExecState* exec) const;
+    virtual JSValue valueOf(ExecState*) const;
     int width() const;
     int height() const;
     QPixmap toPixmap();
     QImage toImage();
-    RuntimeObject* newRuntimeObject(ExecState* exec);
+    RuntimeObject* newRuntimeObject(ExecState*);
     static JSObject* createPixmapRuntimeObject(ExecState*, PassRefPtr<RootObject>, const QVariant&);
     static QVariant variantFromObject(JSObject*, QMetaType::Type hint);
     static bool canHandle(QMetaType::Type hint);
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index da875bfef..da186b630 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -968,13 +968,13 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
 
 const ClassInfo QtRuntimeMethod::s_info = { "QtRuntimeMethod", &InternalFunction::s_info, 0, 0, CREATE_METHOD_TABLE(QtRuntimeMethod) };
 
-QtRuntimeMethod::QtRuntimeMethod(QtRuntimeMethodData* dd, ExecState* exec, Structure* structure, const Identifier& identifier)
+QtRuntimeMethod::QtRuntimeMethod(QtRuntimeMethodData* dd, ExecState* exec, Structure* structure, const UString& identifier)
     : InternalFunction(exec->lexicalGlobalObject(), structure)
     , d_ptr(dd)
 {
 }
 
-void QtRuntimeMethod::finishCreation(ExecState* exec, const Identifier& identifier, PassRefPtr<QtInstance> instance)
+void QtRuntimeMethod::finishCreation(ExecState* exec, const UString& identifier, PassRefPtr<QtInstance> instance)
 {
     Base::finishCreation(exec->globalData(), identifier);
     QW_D(QtRuntimeMethod);
@@ -1385,12 +1385,12 @@ static int findSignalIndex(const QMetaObject* meta, int initialIndex, QByteArray
 
 const ClassInfo QtRuntimeMetaMethod::s_info = { "QtRuntimeMethod", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(QtRuntimeMetaMethod) };
 
-QtRuntimeMetaMethod::QtRuntimeMetaMethod(ExecState* exec, Structure* structure, const Identifier& identifier)
+QtRuntimeMetaMethod::QtRuntimeMetaMethod(ExecState* exec, Structure* structure, const UString& identifier)
     : QtRuntimeMethod (new QtRuntimeMetaMethodData(), exec, structure, identifier)
 {
 }
 
-void QtRuntimeMetaMethod::finishCreation(ExecState* exec, const Identifier& identifier, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature, bool allowPrivate)
+void QtRuntimeMetaMethod::finishCreation(ExecState* exec, const UString& identifier, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature, bool allowPrivate)
 {
     Base::finishCreation(exec, identifier, instance);
     QW_D(QtRuntimeMetaMethod);
@@ -1452,16 +1452,18 @@ CallType QtRuntimeMetaMethod::getCallData(JSCell*, CallData& callData)
     return CallTypeHost;
 }
 
-bool QtRuntimeMetaMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool QtRuntimeMetaMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObject = jsCast<QtRuntimeMetaMethod*>(cell);
-    if (propertyName == "connect") {
+    if (propertyName == Identifier(exec, "connect")) {
         slot.setCustom(thisObject, thisObject->connectGetter);
         return true;
-    } else if (propertyName == "disconnect") {
+    }
+    if (propertyName == Identifier(exec, "disconnect")) {
         slot.setCustom(thisObject, thisObject->disconnectGetter);
         return true;
-    } else if (propertyName == exec->propertyNames().length) {
+    }
+    if (propertyName == exec->propertyNames().length) {
         slot.setCustom(thisObject, thisObject->lengthGetter);
         return true;
     }
@@ -1469,17 +1471,17 @@ bool QtRuntimeMetaMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, cons
     return QtRuntimeMethod::getOwnPropertySlot(thisObject, exec, propertyName, slot);
 }
 
-bool QtRuntimeMetaMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool QtRuntimeMetaMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     QtRuntimeMetaMethod* thisObject = jsCast<QtRuntimeMetaMethod*>(object);
-    if (propertyName == "connect") {
+    if (propertyName == Identifier(exec, "connect")) {
         PropertySlot slot;
         slot.setCustom(thisObject, connectGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
         return true;
     }
 
-    if (propertyName == "disconnect") {
+    if (propertyName == Identifier(exec, "disconnect")) {
         PropertySlot slot;
         slot.setCustom(thisObject, disconnectGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
@@ -1507,29 +1509,29 @@ void QtRuntimeMetaMethod::getOwnPropertyNames(JSObject* object, ExecState* exec,
     QtRuntimeMethod::getOwnPropertyNames(object, exec, propertyNames, mode);
 }
 
-JSValue QtRuntimeMetaMethod::lengthGetter(ExecState*, JSValue, const Identifier&)
+JSValue QtRuntimeMetaMethod::lengthGetter(ExecState*, JSValue, PropertyName)
 {
     // QtScript always returns 0
     return jsNumber(0);
 }
 
-JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, JSValue slotBase, const Identifier& ident)
+JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, JSValue slotBase, PropertyName ident)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_connect)
-        d->m_connect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident, true, d->m_instance, d->m_index, d->m_signature));
+        d->m_connect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident.impl(), true, d->m_instance, d->m_index, d->m_signature));
     return d->m_connect.get();
 }
 
-JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, JSValue slotBase, const Identifier& ident)
+JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, JSValue slotBase, PropertyName ident)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_disconnect)
-        d->m_disconnect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident, false, d->m_instance, d->m_index, d->m_signature));
+        d->m_disconnect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident.impl(), false, d->m_instance, d->m_index, d->m_signature));
     return d->m_disconnect.get();
 }
 
@@ -1539,12 +1541,12 @@ QMultiMap<QObject*, QtConnectionObject*> QtRuntimeConnectionMethod::connections;
 
 const ClassInfo QtRuntimeConnectionMethod::s_info = { "QtRuntimeMethod", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(QtRuntimeConnectionMethod) };
 
-QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, Structure* structure, const Identifier& identifier)
+QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, Structure* structure, const UString& identifier)
     : QtRuntimeMethod (new QtRuntimeConnectionMethodData(), exec, structure, identifier)
 {
 }
 
-void QtRuntimeConnectionMethod::finishCreation(ExecState* exec, const Identifier& identifier, bool isConnect, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature)
+void QtRuntimeConnectionMethod::finishCreation(ExecState* exec, const UString& identifier, bool isConnect, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature)
 {
     Base::finishCreation(exec, identifier, instance);
     QW_D(QtRuntimeConnectionMethod);
@@ -1695,7 +1697,7 @@ CallType QtRuntimeConnectionMethod::getCallData(JSCell*, CallData& callData)
     return CallTypeHost;
 }
 
-bool QtRuntimeConnectionMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool QtRuntimeConnectionMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     QtRuntimeConnectionMethod* thisObject = jsCast<QtRuntimeConnectionMethod*>(cell);
     if (propertyName == exec->propertyNames().length) {
@@ -1706,7 +1708,7 @@ bool QtRuntimeConnectionMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec
     return QtRuntimeMethod::getOwnPropertySlot(thisObject, exec, propertyName, slot);
 }
 
-bool QtRuntimeConnectionMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool QtRuntimeConnectionMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     QtRuntimeConnectionMethod* thisObject = jsCast<QtRuntimeConnectionMethod*>(object);
     if (propertyName == exec->propertyNames().length) {
@@ -1727,7 +1729,7 @@ void QtRuntimeConnectionMethod::getOwnPropertyNames(JSObject* object, ExecState*
     QtRuntimeMethod::getOwnPropertyNames(object, exec, propertyNames, mode);
 }
 
-JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState*, JSValue, const Identifier&)
+JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState*, JSValue, PropertyName)
 {
     // we have one formal argument, and one optional
     return jsNumber(1);
diff --git a/Source/WebCore/bridge/qt/qt_runtime.h b/Source/WebCore/bridge/qt/qt_runtime.h
index 53e5f26f6..737247acd 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.h
+++ b/Source/WebCore/bridge/qt/qt_runtime.h
@@ -149,11 +149,11 @@ public:
     }
 
 protected:
-    void finishCreation(ExecState*, const Identifier&, PassRefPtr<QtInstance>);
+    void finishCreation(ExecState*, const UString&, PassRefPtr<QtInstance>);
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | InternalFunction::StructureFlags | OverridesVisitChildren;
 
     QtRuntimeMethodData *d_func() const {return d_ptr;}
-    QtRuntimeMethod(QtRuntimeMethodData *dd, ExecState *, Structure*, const Identifier &name);
+    QtRuntimeMethod(QtRuntimeMethodData *dd, ExecState *, Structure*, const UString& name);
     QtRuntimeMethodData *d_ptr;
 };
 
@@ -161,7 +161,7 @@ class QtRuntimeMetaMethod : public QtRuntimeMethod {
 public:
     typedef QtRuntimeMethod Base;
 
-    static QtRuntimeMetaMethod* create(ExecState* exec, const Identifier& name, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature, bool allowPrivate)
+    static QtRuntimeMetaMethod* create(ExecState* exec, const UString& name, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature, bool allowPrivate)
     {
         Structure* domStructure = WebCore::deprecatedGetDOMStructure<QtRuntimeMetaMethod>(exec);
         QtRuntimeMetaMethod* method = new (allocateCell<QtRuntimeMetaMethod>(*exec->heap())) QtRuntimeMetaMethod(exec, domStructure, name);
@@ -169,8 +169,8 @@ public:
         return method;
     }
 
-    static bool getOwnPropertySlot(JSCell*, ExecState *, const Identifier&, PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSCell*, ExecState *, PropertyName, PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
     static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
 
     static void visitChildren(JSCell*, SlotVisitor&);
@@ -186,14 +186,14 @@ protected:
     QtRuntimeMetaMethodData* d_func() const {return reinterpret_cast<QtRuntimeMetaMethodData*>(d_ptr);}
 
 private:
-    QtRuntimeMetaMethod(ExecState*, Structure*, const Identifier&);
-    void finishCreation(ExecState*, const Identifier&, PassRefPtr<QtInstance>, int index, const QByteArray& signature, bool allowPrivate);
+    QtRuntimeMetaMethod(ExecState*, Structure*, const UString&);
+    void finishCreation(ExecState*, const UString&, PassRefPtr<QtInstance>, int index, const QByteArray& signature, bool allowPrivate);
 
     static CallType getCallData(JSCell*, CallData&);
     static EncodedJSValue JSC_HOST_CALL call(ExecState* exec);
-    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
-    static JSValue connectGetter(ExecState*, JSValue, const Identifier&);
-    static JSValue disconnectGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue lengthGetter(ExecState*, JSValue, PropertyName);
+    static JSValue connectGetter(ExecState*, JSValue, PropertyName);
+    static JSValue disconnectGetter(ExecState*, JSValue, PropertyName);
 };
 
 class QtConnectionObject;
@@ -201,7 +201,7 @@ class QtRuntimeConnectionMethod : public QtRuntimeMethod {
 public:
     typedef QtRuntimeMethod Base;
 
-    static QtRuntimeConnectionMethod* create(ExecState* exec, const Identifier& name, bool isConnect, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature)
+    static QtRuntimeConnectionMethod* create(ExecState* exec, const UString& name, bool isConnect, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature)
     {
         Structure* domStructure = WebCore::deprecatedGetDOMStructure<QtRuntimeConnectionMethod>(exec);
         QtRuntimeConnectionMethod* method = new (allocateCell<QtRuntimeConnectionMethod>(*exec->heap())) QtRuntimeConnectionMethod(exec, domStructure, name);
@@ -209,8 +209,8 @@ public:
         return method;
     }
 
-    static bool getOwnPropertySlot(JSCell*, ExecState *, const Identifier&, PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSCell*, ExecState *, PropertyName, PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
     static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
  
     static const ClassInfo s_info;
@@ -224,12 +224,12 @@ protected:
     QtRuntimeConnectionMethodData* d_func() const {return reinterpret_cast<QtRuntimeConnectionMethodData*>(d_ptr);}
 
 private:
-    QtRuntimeConnectionMethod(ExecState*, Structure*, const Identifier&);
-    void finishCreation(ExecState*, const Identifier&, bool isConnect, PassRefPtr<QtInstance>, int index, const QByteArray& signature);
+    QtRuntimeConnectionMethod(ExecState*, Structure*, const UString&);
+    void finishCreation(ExecState*, const UString&, bool isConnect, PassRefPtr<QtInstance>, int index, const QByteArray& signature);
 
     static CallType getCallData(JSCell*, CallData&);
     static EncodedJSValue JSC_HOST_CALL call(ExecState* exec);
-    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue lengthGetter(ExecState*, JSValue, PropertyName);
     static QMultiMap<QObject *, QtConnectionObject *> connections;
     friend class QtConnectionObject;
 };
diff --git a/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp b/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
index a114aee49..2bd36ce5f 100644
--- a/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
@@ -968,13 +968,13 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
 
 const ClassInfo QtRuntimeMethod::s_info = { "QtRuntimeMethod", &InternalFunction::s_info, 0, 0, CREATE_METHOD_TABLE(QtRuntimeMethod) };
 
-QtRuntimeMethod::QtRuntimeMethod(QtRuntimeMethodData* dd, ExecState* exec, Structure* structure, const Identifier& identifier)
+QtRuntimeMethod::QtRuntimeMethod(QtRuntimeMethodData* dd, ExecState* exec, Structure* structure, const UString& identifier)
     : InternalFunction(exec->lexicalGlobalObject(), structure)
     , d_ptr(dd)
 {
 }
 
-void QtRuntimeMethod::finishCreation(ExecState* exec, const Identifier& identifier, PassRefPtr<QtInstance> instance)
+void QtRuntimeMethod::finishCreation(ExecState* exec, const UString& identifier, PassRefPtr<QtInstance> instance)
 {
     Base::finishCreation(exec->globalData(), identifier);
     QW_D(QtRuntimeMethod);
@@ -1394,12 +1394,12 @@ static int findSignalIndex(const QMetaObject* meta, int initialIndex, QByteArray
 
 const ClassInfo QtRuntimeMetaMethod::s_info = { "QtRuntimeMethod", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(QtRuntimeMetaMethod) };
 
-QtRuntimeMetaMethod::QtRuntimeMetaMethod(ExecState* exec, Structure* structure, const Identifier& identifier)
+QtRuntimeMetaMethod::QtRuntimeMetaMethod(ExecState* exec, Structure* structure, const UString& identifier)
     : QtRuntimeMethod (new QtRuntimeMetaMethodData(), exec, structure, identifier)
 {
 }
 
-void QtRuntimeMetaMethod::finishCreation(ExecState* exec, const Identifier& identifier, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature, bool allowPrivate)
+void QtRuntimeMetaMethod::finishCreation(ExecState* exec, const UString& identifier, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature, bool allowPrivate)
 {
     Base::finishCreation(exec, identifier, instance);
     QW_D(QtRuntimeMetaMethod);
@@ -1461,16 +1461,18 @@ CallType QtRuntimeMetaMethod::getCallData(JSCell*, CallData& callData)
     return CallTypeHost;
 }
 
-bool QtRuntimeMetaMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool QtRuntimeMetaMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObject = jsCast<QtRuntimeMetaMethod*>(cell);
-    if (propertyName == "connect") {
+    if (propertyName == Identifier(exec, "connect")) {
         slot.setCustom(thisObject, thisObject->connectGetter);
         return true;
-    } else if (propertyName == "disconnect") {
+    }
+    if (propertyName == Identifier(exec, "disconnect")) {
         slot.setCustom(thisObject, thisObject->disconnectGetter);
         return true;
-    } else if (propertyName == exec->propertyNames().length) {
+    }
+    if (propertyName == exec->propertyNames().length) {
         slot.setCustom(thisObject, thisObject->lengthGetter);
         return true;
     }
@@ -1478,17 +1480,17 @@ bool QtRuntimeMetaMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, cons
     return QtRuntimeMethod::getOwnPropertySlot(thisObject, exec, propertyName, slot);
 }
 
-bool QtRuntimeMetaMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool QtRuntimeMetaMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     QtRuntimeMetaMethod* thisObject = jsCast<QtRuntimeMetaMethod*>(object);
-    if (propertyName == "connect") {
+    if (propertyName == Identifier(exec, "connect")) {
         PropertySlot slot;
         slot.setCustom(thisObject, connectGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
         return true;
     }
 
-    if (propertyName == "disconnect") {
+    if (propertyName == Identifier(exec, "disconnect")) {
         PropertySlot slot;
         slot.setCustom(thisObject, disconnectGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
@@ -1516,29 +1518,29 @@ void QtRuntimeMetaMethod::getOwnPropertyNames(JSObject* object, ExecState* exec,
     QtRuntimeMethod::getOwnPropertyNames(object, exec, propertyNames, mode);
 }
 
-JSValue QtRuntimeMetaMethod::lengthGetter(ExecState*, JSValue, const Identifier&)
+JSValue QtRuntimeMetaMethod::lengthGetter(ExecState*, JSValue, PropertyName)
 {
     // QtScript always returns 0
     return jsNumber(0);
 }
 
-JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, JSValue slotBase, const Identifier& ident)
+JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, JSValue slotBase, PropertyName ident)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_connect)
-        d->m_connect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident, true, d->m_instance, d->m_index, d->m_signature));
+        d->m_connect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident.ustring(), true, d->m_instance, d->m_index, d->m_signature));
     return d->m_connect.get();
 }
 
-JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, JSValue slotBase, const Identifier& ident)
+JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, JSValue slotBase, PropertyName ident)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_disconnect)
-        d->m_disconnect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident, false, d->m_instance, d->m_index, d->m_signature));
+        d->m_disconnect.set(exec->globalData(), thisObj, QtRuntimeConnectionMethod::create(exec, ident.ustring(), false, d->m_instance, d->m_index, d->m_signature));
     return d->m_disconnect.get();
 }
 
@@ -1548,12 +1550,12 @@ QMultiMap<QObject*, QtConnectionObject*> QtRuntimeConnectionMethod::connections;
 
 const ClassInfo QtRuntimeConnectionMethod::s_info = { "QtRuntimeMethod", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(QtRuntimeConnectionMethod) };
 
-QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, Structure* structure, const Identifier& identifier)
+QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, Structure* structure, const UString& identifier)
     : QtRuntimeMethod (new QtRuntimeConnectionMethodData(), exec, structure, identifier)
 {
 }
 
-void QtRuntimeConnectionMethod::finishCreation(ExecState* exec, const Identifier& identifier, bool isConnect, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature)
+void QtRuntimeConnectionMethod::finishCreation(ExecState* exec, const UString& identifier, bool isConnect, PassRefPtr<QtInstance> instance, int index, const QByteArray& signature)
 {
     Base::finishCreation(exec, identifier, instance);
     QW_D(QtRuntimeConnectionMethod);
@@ -1704,7 +1706,7 @@ CallType QtRuntimeConnectionMethod::getCallData(JSCell*, CallData& callData)
     return CallTypeHost;
 }
 
-bool QtRuntimeConnectionMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool QtRuntimeConnectionMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     QtRuntimeConnectionMethod* thisObject = jsCast<QtRuntimeConnectionMethod*>(cell);
     if (propertyName == exec->propertyNames().length) {
@@ -1715,7 +1717,7 @@ bool QtRuntimeConnectionMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec
     return QtRuntimeMethod::getOwnPropertySlot(thisObject, exec, propertyName, slot);
 }
 
-bool QtRuntimeConnectionMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool QtRuntimeConnectionMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     QtRuntimeConnectionMethod* thisObject = jsCast<QtRuntimeConnectionMethod*>(object);
     if (propertyName == exec->propertyNames().length) {
@@ -1736,7 +1738,7 @@ void QtRuntimeConnectionMethod::getOwnPropertyNames(JSObject* object, ExecState*
     QtRuntimeMethod::getOwnPropertyNames(object, exec, propertyNames, mode);
 }
 
-JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState*, JSValue, const Identifier&)
+JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState*, JSValue, PropertyName)
 {
     // we have one formal argument, and one optional
     return jsNumber(1);
diff --git a/Source/WebCore/bridge/runtime_array.cpp b/Source/WebCore/bridge/runtime_array.cpp
index f0c5080f9..4e39d43ca 100644
--- a/Source/WebCore/bridge/runtime_array.cpp
+++ b/Source/WebCore/bridge/runtime_array.cpp
@@ -60,7 +60,7 @@ void RuntimeArray::destroy(JSCell* cell)
     jsCast<RuntimeArray*>(cell)->RuntimeArray::~RuntimeArray();
 }
 
-JSValue RuntimeArray::lengthGetter(ExecState*, JSValue slotBase, const Identifier&)
+JSValue RuntimeArray::lengthGetter(ExecState*, JSValue slotBase, PropertyName)
 {
     RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slotBase));
     return jsNumber(thisObj->getLength());
@@ -85,7 +85,7 @@ void RuntimeArray::getOwnPropertyNames(JSObject* object, ExecState* exec, Proper
     JSObject::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
 }
 
-bool RuntimeArray::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool RuntimeArray::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     RuntimeArray* thisObject = jsCast<RuntimeArray*>(cell);
     if (propertyName == exec->propertyNames().length) {
@@ -93,19 +93,17 @@ bool RuntimeArray::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Ident
         return true;
     }
     
-    bool ok;
-    unsigned index = propertyName.toArrayIndex(ok);
-    if (ok) {
-        if (index < thisObject->getLength()) {
-            slot.setCustomIndex(thisObject, index, thisObject->indexGetter);
-            return true;
-        }
+    unsigned index = propertyName.asIndex();
+    if (index < thisObject->getLength()) {
+        ASSERT(index != PropertyName::NotAnIndex);
+        slot.setCustomIndex(thisObject, index, thisObject->indexGetter);
+        return true;
     }
     
     return JSObject::getOwnPropertySlot(thisObject, exec, propertyName, slot);
 }
 
-bool RuntimeArray::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool RuntimeArray::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     RuntimeArray* thisObject = jsCast<RuntimeArray*>(object);
     if (propertyName == exec->propertyNames().length) {
@@ -115,15 +113,13 @@ bool RuntimeArray::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, c
         return true;
     }
     
-    bool ok;
-    unsigned index = propertyName.toArrayIndex(ok);
-    if (ok) {
-        if (index < thisObject->getLength()) {
-            PropertySlot slot;
-            slot.setCustomIndex(thisObject, index, indexGetter);
-            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | DontEnum);
-            return true;
-        }
+    unsigned index = propertyName.asIndex();
+    if (index < thisObject->getLength()) {
+        ASSERT(index != PropertyName::NotAnIndex);
+        PropertySlot slot;
+        slot.setCustomIndex(thisObject, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | DontEnum);
+        return true;
     }
     
     return JSObject::getOwnPropertyDescriptor(thisObject, exec, propertyName, descriptor);
@@ -140,7 +136,7 @@ bool RuntimeArray::getOwnPropertySlotByIndex(JSCell* cell, ExecState *exec, unsi
     return JSObject::getOwnPropertySlotByIndex(thisObject, exec, index, slot);
 }
 
-void RuntimeArray::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void RuntimeArray::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     RuntimeArray* thisObject = jsCast<RuntimeArray*>(cell);
     if (propertyName == exec->propertyNames().length) {
@@ -148,9 +144,8 @@ void RuntimeArray::put(JSCell* cell, ExecState* exec, const Identifier& property
         return;
     }
     
-    bool ok;
-    unsigned index = propertyName.toArrayIndex(ok);
-    if (ok) {
+    unsigned index = propertyName.asIndex();
+    if (index != PropertyName::NotAnIndex) {
         thisObject->getConcreteArray()->setValueAt(exec, index, value);
         return;
     }
@@ -169,7 +164,7 @@ void RuntimeArray::putByIndex(JSCell* cell, ExecState* exec, unsigned index, JSV
     thisObject->getConcreteArray()->setValueAt(exec, index, value);
 }
 
-bool RuntimeArray::deleteProperty(JSCell*, ExecState*, const Identifier&)
+bool RuntimeArray::deleteProperty(JSCell*, ExecState*, PropertyName)
 {
     return false;
 }
diff --git a/Source/WebCore/bridge/runtime_array.h b/Source/WebCore/bridge/runtime_array.h
index 2ea52b68a..60cd73473 100644
--- a/Source/WebCore/bridge/runtime_array.h
+++ b/Source/WebCore/bridge/runtime_array.h
@@ -51,13 +51,13 @@ public:
     static void destroy(JSCell*);
 
     static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
-    static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier&, PropertySlot&);
+    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
     static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned, PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
-    static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
+    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
     static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
     
-    static bool deleteProperty(JSCell*, ExecState*, const Identifier &propertyName);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
     static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
     
     unsigned getLength() const { return m_array->getLength(); }
@@ -83,7 +83,7 @@ protected:
 
 private:
     RuntimeArray(ExecState*, Structure*);
-    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue lengthGetter(ExecState*, JSValue, PropertyName);
     static JSValue indexGetter(ExecState*, JSValue, unsigned);
 
     BindingsArray* m_array;
diff --git a/Source/WebCore/bridge/runtime_method.cpp b/Source/WebCore/bridge/runtime_method.cpp
index 5efc71276..b8fb5b112 100644
--- a/Source/WebCore/bridge/runtime_method.cpp
+++ b/Source/WebCore/bridge/runtime_method.cpp
@@ -55,13 +55,13 @@ void RuntimeMethod::destroy(JSCell* cell)
     jsCast<RuntimeMethod*>(cell)->RuntimeMethod::~RuntimeMethod();
 }
 
-void RuntimeMethod::finishCreation(JSGlobalData& globalData, const Identifier& ident)
+void RuntimeMethod::finishCreation(JSGlobalData& globalData, const UString& ident)
 {
     Base::finishCreation(globalData, ident);
     ASSERT(inherits(&s_info));
 }
 
-JSValue RuntimeMethod::lengthGetter(ExecState*, JSValue slotBase, const Identifier&)
+JSValue RuntimeMethod::lengthGetter(ExecState*, JSValue slotBase, PropertyName)
 {
     RuntimeMethod* thisObj = static_cast<RuntimeMethod*>(asObject(slotBase));
 
@@ -74,7 +74,7 @@ JSValue RuntimeMethod::lengthGetter(ExecState*, JSValue slotBase, const Identifi
     return jsNumber(thisObj->_methodList->at(0)->numParameters());
 }
 
-bool RuntimeMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot &slot)
+bool RuntimeMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
 {
     RuntimeMethod* thisObject = jsCast<RuntimeMethod*>(cell);
     if (propertyName == exec->propertyNames().length) {
@@ -85,7 +85,7 @@ bool RuntimeMethod::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Iden
     return InternalFunction::getOwnPropertySlot(thisObject, exec, propertyName, slot);
 }
 
-bool RuntimeMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor &descriptor)
+bool RuntimeMethod::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor &descriptor)
 {
     RuntimeMethod* thisObject = jsCast<RuntimeMethod*>(object);
     if (propertyName == exec->propertyNames().length) {
diff --git a/Source/WebCore/bridge/runtime_method.h b/Source/WebCore/bridge/runtime_method.h
index 79ae67844..f629578ef 100644
--- a/Source/WebCore/bridge/runtime_method.h
+++ b/Source/WebCore/bridge/runtime_method.h
@@ -39,7 +39,7 @@ public:
 
     static void destroy(JSCell*);
 
-    static RuntimeMethod* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const Identifier& name, Bindings::MethodList& methodList)
+    static RuntimeMethod* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const UString& name, Bindings::MethodList& methodList)
     {
         RuntimeMethod* method = new (NotNull, allocateCell<RuntimeMethod>(*exec->heap())) RuntimeMethod(globalObject, structure, methodList);
         method->finishCreation(exec->globalData(), name);
@@ -62,15 +62,15 @@ public:
 
 protected:
     RuntimeMethod(JSGlobalObject*, Structure*, Bindings::MethodList&);
-    void finishCreation(JSGlobalData&, const Identifier&);
+    void finishCreation(JSGlobalData&, const UString&);
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | InternalFunction::StructureFlags;
     static CallType getCallData(JSCell*, CallData&);
 
-    static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier&, PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
 
 private:
-    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue lengthGetter(ExecState*, JSValue, PropertyName);
 
     OwnPtr<Bindings::MethodList> _methodList;
 };
diff --git a/Source/WebCore/bridge/runtime_object.cpp b/Source/WebCore/bridge/runtime_object.cpp
index 74bcc3f56..50bacbcf6 100644
--- a/Source/WebCore/bridge/runtime_object.cpp
+++ b/Source/WebCore/bridge/runtime_object.cpp
@@ -64,7 +64,7 @@ void RuntimeObject::invalidate()
     m_instance = 0;
 }
 
-JSValue RuntimeObject::fallbackObjectGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue RuntimeObject::fallbackObjectGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     RuntimeObject* thisObj = static_cast<RuntimeObject*>(asObject(slotBase));
     RefPtr<Instance> instance = thisObj->m_instance;
@@ -82,7 +82,7 @@ JSValue RuntimeObject::fallbackObjectGetter(ExecState* exec, JSValue slotBase, c
     return result;
 }
 
-JSValue RuntimeObject::fieldGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue RuntimeObject::fieldGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {    
     RuntimeObject* thisObj = static_cast<RuntimeObject*>(asObject(slotBase));
     RefPtr<Instance> instance = thisObj->m_instance;
@@ -101,7 +101,7 @@ JSValue RuntimeObject::fieldGetter(ExecState* exec, JSValue slotBase, const Iden
     return result;
 }
 
-JSValue RuntimeObject::methodGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+JSValue RuntimeObject::methodGetter(ExecState* exec, JSValue slotBase, PropertyName propertyName)
 {
     RuntimeObject* thisObj = static_cast<RuntimeObject*>(asObject(slotBase));
     RefPtr<Instance> instance = thisObj->m_instance;
@@ -118,7 +118,7 @@ JSValue RuntimeObject::methodGetter(ExecState* exec, JSValue slotBase, const Ide
     return method;
 }
 
-bool RuntimeObject::getOwnPropertySlot(JSCell* cell, ExecState *exec, const Identifier& propertyName, PropertySlot& slot)
+bool RuntimeObject::getOwnPropertySlot(JSCell* cell, ExecState *exec, PropertyName propertyName, PropertySlot& slot)
 {
     RuntimeObject* thisObject = jsCast<RuntimeObject*>(cell);
     if (!thisObject->m_instance) {
@@ -164,7 +164,7 @@ bool RuntimeObject::getOwnPropertySlot(JSCell* cell, ExecState *exec, const Iden
     return instance->getOwnPropertySlot(thisObject, exec, propertyName, slot);
 }
 
-bool RuntimeObject::getOwnPropertyDescriptor(JSObject* object, ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool RuntimeObject::getOwnPropertyDescriptor(JSObject* object, ExecState *exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     RuntimeObject* thisObject = jsCast<RuntimeObject*>(object);
     if (!thisObject->m_instance) {
@@ -214,7 +214,7 @@ bool RuntimeObject::getOwnPropertyDescriptor(JSObject* object, ExecState *exec,
     return instance->getOwnPropertyDescriptor(thisObject, exec, propertyName, descriptor);
 }
 
-void RuntimeObject::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void RuntimeObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     RuntimeObject* thisObject = jsCast<RuntimeObject*>(cell);
     if (!thisObject->m_instance) {
@@ -235,7 +235,7 @@ void RuntimeObject::put(JSCell* cell, ExecState* exec, const Identifier& propert
     instance->end();
 }
 
-bool RuntimeObject::deleteProperty(JSCell*, ExecState*, const Identifier&)
+bool RuntimeObject::deleteProperty(JSCell*, ExecState*, PropertyName)
 {
     // Can never remove a property of a RuntimeObject.
     return false;
diff --git a/Source/WebCore/bridge/runtime_object.h b/Source/WebCore/bridge/runtime_object.h
index 0f0fae7b9..2a1624ca0 100644
--- a/Source/WebCore/bridge/runtime_object.h
+++ b/Source/WebCore/bridge/runtime_object.h
@@ -45,10 +45,10 @@ public:
 
     static void destroy(JSCell*);
 
-    static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier& propertyName, PropertySlot&);
-    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier& propertyName, PropertyDescriptor&);
-    static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-    static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
+    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
+    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
     static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
     static CallType getCallData(JSCell*, CallData&);
     static ConstructType getConstructData(JSCell*, ConstructData&);
@@ -79,9 +79,9 @@ protected:
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | Base::StructureFlags;
 
 private:
-    static JSValue fallbackObjectGetter(ExecState*, JSValue, const Identifier&);
-    static JSValue fieldGetter(ExecState*, JSValue, const Identifier&);
-    static JSValue methodGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue fallbackObjectGetter(ExecState*, JSValue, PropertyName);
+    static JSValue fieldGetter(ExecState*, JSValue, PropertyName);
+    static JSValue methodGetter(ExecState*, JSValue, PropertyName);
 
     RefPtr<Instance> m_instance;
 };
diff --git a/Source/WebCore/css/CSSAllInOne.cpp b/Source/WebCore/css/CSSAllInOne.cpp
index 71c92c477..2ce1e36dd 100644
--- a/Source/WebCore/css/CSSAllInOne.cpp
+++ b/Source/WebCore/css/CSSAllInOne.cpp
@@ -58,7 +58,6 @@
 #include "CSSSegmentedFontFace.cpp"
 #include "CSSSelector.cpp"
 #include "CSSSelectorList.cpp"
-#include "CSSStyleDeclaration.cpp"
 #include "CSSStyleRule.cpp"
 #include "CSSStyleSheet.cpp"
 #include "CSSTimingFunctionValue.cpp"
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index 6941c126d..1b250eb29 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -532,8 +532,8 @@ static inline bool isValidKeywordPropertyAndValue(CSSPropertyID propertyId, int
         // inline | block | list-item | run-in | inline-block | table |
         // inline-table | table-row-group | table-header-group | table-footer-group | table-row |
         // table-column-group | table-column | table-cell | table-caption | -webkit-box | -webkit-inline-box | none | inherit
-        // -webkit-flexbox | -webkit-inline-flexbox | -webkit-grid | -webkit-inline-grid
-        if ((valueID >= CSSValueInline && valueID <= CSSValueWebkitInlineFlexbox) || valueID == CSSValueNone)
+        // -webkit-flex | -webkit-inline-flex | -webkit-grid | -webkit-inline-grid
+        if ((valueID >= CSSValueInline && valueID <= CSSValueWebkitInlineFlex) || valueID == CSSValueNone)
             return true;
 #if ENABLE(CSS_GRID_LAYOUT)
         if (valueID == CSSValueWebkitGrid || valueID == CSSValueWebkitInlineGrid)
@@ -1430,15 +1430,6 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
     RefPtr<CSSValue> parsedValue;
 
     switch (propId) {
-        /* The comment to the left defines all valid value of this properties as defined
-         * in CSS 2, Appendix F. Property index
-         */
-
-        /* All the CSS properties are not supported by the renderer at the moment.
-         * Note that all the CSS2 Aural properties are only checked, if CSS_AURAL is defined
-         * (see parseAuralValues). As we don't support them at all this seems reasonable.
-         */
-
     case CSSPropertySize:                 // <length>{1,2} | auto | [ <page-size> || [ portrait | landscape] ]
         return parseSize(propId, important);
 
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index d607713a0..822ad51b6 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1111,11 +1111,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EDisplay e)
         case INLINE_BOX:
             m_value.ident = CSSValueWebkitInlineBox;
             break;
-        case FLEXBOX:
-            m_value.ident = CSSValueWebkitFlexbox;
+        case FLEX:
+            m_value.ident = CSSValueWebkitFlex;
             break;
-        case INLINE_FLEXBOX:
-            m_value.ident = CSSValueWebkitInlineFlexbox;
+        case INLINE_FLEX:
+            m_value.ident = CSSValueWebkitInlineFlex;
             break;
 #if ENABLE(CSS_GRID_LAYOUT)
         case GRID:
diff --git a/Source/WebCore/css/CSSStyleDeclaration.cpp b/Source/WebCore/css/CSSStyleDeclaration.cpp
deleted file mode 100644
index a71e00d30..000000000
--- a/Source/WebCore/css/CSSStyleDeclaration.cpp
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * (C) 1999-2003 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2012 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "CSSStyleDeclaration.h"
-
-#ifndef NDEBUG
-#include <wtf/ASCIICType.h>
-#include <wtf/text/CString.h>
-#include <stdio.h>
-#endif
-
-using namespace WTF;
-
-namespace WebCore {
-
-#ifndef NDEBUG
-void CSSStyleDeclaration::showStyle()
-{
-    fprintf(stderr, "%s\n", cssText().ascii().data());
-}
-#endif
-
-} // namespace WebCore
diff --git a/Source/WebCore/css/CSSStyleDeclaration.h b/Source/WebCore/css/CSSStyleDeclaration.h
index d52f2495c..5d88ebd07 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.h
+++ b/Source/WebCore/css/CSSStyleDeclaration.h
@@ -69,10 +69,6 @@ public:
     virtual bool cssPropertyMatches(const CSSProperty*) const = 0;
     virtual CSSStyleSheet* parentStyleSheet() const { return 0; }
 
-#ifndef NDEBUG
-    void showStyle();
-#endif
-
 protected:
     CSSStyleDeclaration() { }
 };
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index 46b4c955a..e9e2111b5 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -332,8 +332,8 @@ table-cell
 table-caption
 -webkit-box
 -webkit-inline-box
--webkit-flexbox
--webkit-inline-flexbox
+-webkit-flex
+-webkit-inline-flex
 #if defined(ENABLE_CSS_GRID_LAYOUT) && ENABLE_CSS_GRID_LAYOUT
 -webkit-grid
 -webkit-inline-grid
diff --git a/Source/WebCore/css/StylePropertySet.cpp b/Source/WebCore/css/StylePropertySet.cpp
index caeda8896..ac7eacd8c 100644
--- a/Source/WebCore/css/StylePropertySet.cpp
+++ b/Source/WebCore/css/StylePropertySet.cpp
@@ -33,6 +33,12 @@
 #include <wtf/BitVector.h>
 #include <wtf/text/StringBuilder.h>
 
+#ifndef NDEBUG
+#include <stdio.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/text/CString.h>
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -1023,4 +1029,11 @@ class SameSizeAsStylePropertySet : public RefCounted<SameSizeAsStylePropertySet>
 };
 COMPILE_ASSERT(sizeof(StylePropertySet) == sizeof(SameSizeAsStylePropertySet), style_property_set_should_stay_small);
 
+#ifndef NDEBUG
+void StylePropertySet::showStyle()
+{
+    fprintf(stderr, "%s\n", asText().ascii().data());
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index 1ff576a8b..d500398d0 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -115,6 +115,10 @@ public:
 
     static unsigned averageSizeInBytes();
 
+#ifndef NDEBUG
+    void showStyle();
+#endif
+    
 private:
     StylePropertySet(CSSParserMode);
     StylePropertySet(const Vector<CSSProperty>&);
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index 24a180f10..1d946912a 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -460,6 +460,7 @@ static PassOwnPtr<RuleSet> makeRuleSet(const Vector<StyleResolver::RuleFeature>&
     OwnPtr<RuleSet> ruleSet = RuleSet::create();
     for (size_t i = 0; i < size; ++i)
         ruleSet->addRule(rules[i].rule, rules[i].selector, rules[i].hasDocumentSecurityOrigin, false);
+    ruleSet->shrinkToFit();
     return ruleSet.release();
 }
 
@@ -1692,7 +1693,7 @@ PassRefPtr<RenderStyle> StyleResolver::styleForKeyframe(const RenderStyle* eleme
     // decl, there's nothing to override. So just add the first properties.
     bool inheritedOnly = false;
     if (keyframe->properties())
-        applyMatchedProperties<true>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
+        applyMatchedProperties<HighPriorityProperties>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // If our font got dirtied, go ahead and update it now.
     updateFont();
@@ -1703,7 +1704,7 @@ PassRefPtr<RenderStyle> StyleResolver::styleForKeyframe(const RenderStyle* eleme
 
     // Now do rest of the properties.
     if (keyframe->properties())
-        applyMatchedProperties<false>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
+        applyMatchedProperties<LowPriorityProperties>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // If our font got dirtied by one of the non-essential font props,
     // go ahead and update it a second time.
@@ -1860,7 +1861,7 @@ PassRefPtr<RenderStyle> StyleResolver::styleForPage(int pageIndex)
     matchPageRules(result, m_authorStyle.get(), isLeft, isFirst, page);
     m_lineHeightValue = 0;
     bool inheritedOnly = false;
-    applyMatchedProperties<true>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
+    applyMatchedProperties<HighPriorityProperties>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // If our font got dirtied, go ahead and update it now.
     updateFont();
@@ -1869,7 +1870,7 @@ PassRefPtr<RenderStyle> StyleResolver::styleForPage(int pageIndex)
     if (m_lineHeightValue)
         applyProperty(CSSPropertyLineHeight, m_lineHeightValue);
 
-    applyMatchedProperties<false>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
+    applyMatchedProperties<LowPriorityProperties>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // Start loading images referenced by this style.
     loadPendingImages();
@@ -1911,7 +1912,7 @@ static EDisplay equivalentBlockDisplay(EDisplay display, bool isFloating, bool s
     case BLOCK:
     case TABLE:
     case BOX:
-    case FLEXBOX:
+    case FLEX:
 #if ENABLE(CSS_GRID_LAYOUT)
     case GRID:
 #endif
@@ -1926,8 +1927,8 @@ static EDisplay equivalentBlockDisplay(EDisplay display, bool isFloating, bool s
         return TABLE;
     case INLINE_BOX:
         return BOX;
-    case INLINE_FLEXBOX:
-        return FLEXBOX;
+    case INLINE_FLEX:
+        return FLEX;
 #if ENABLE(CSS_GRID_LAYOUT)
     case INLINE_GRID:
         return GRID;
@@ -2626,7 +2627,7 @@ Length StyleResolver::convertToFloatLength(CSSPrimitiveValue* primitiveValue, Re
     return primitiveValue ? primitiveValue->convertToLength<FixedFloatConversion | PercentConversion | FractionConversion | ViewportPercentageConversion>(style, rootStyle, multiplier) : Length(Undefined);
 }
 
-template <bool applyFirst>
+template <StyleResolver::StyleApplicationPass pass>
 void StyleResolver::applyProperties(const StylePropertySet* properties, StyleRule* rule, bool isImportant, bool inheritedOnly, bool filterRegionProperties)
 {
     ASSERT(!filterRegionProperties || m_regionForStyling);
@@ -2649,7 +2650,7 @@ void StyleResolver::applyProperties(const StylePropertySet* properties, StyleRul
         if (filterRegionProperties && !StyleResolver::isValidRegionStyleProperty(property))
             continue;
 
-        if (applyFirst) {
+        if (pass == HighPriorityProperties) {
             COMPILE_ASSERT(firstCSSProperty == CSSPropertyColor, CSS_color_is_first_property);
             COMPILE_ASSERT(CSSPropertyZoom == CSSPropertyColor + 18, CSS_zoom_is_end_of_first_prop_range);
             COMPILE_ASSERT(CSSPropertyLineHeight == CSSPropertyZoom + 1, CSS_line_height_is_after_zoom);
@@ -2670,7 +2671,7 @@ void StyleResolver::applyProperties(const StylePropertySet* properties, StyleRul
     InspectorInstrumentation::didProcessRule(cookie);
 }
 
-template <bool applyFirst>
+template <StyleResolver::StyleApplicationPass pass>
 void StyleResolver::applyMatchedProperties(const MatchResult& matchResult, bool isImportant, int startIndex, int endIndex, bool inheritedOnly)
 {
     if (startIndex == -1)
@@ -2684,7 +2685,7 @@ void StyleResolver::applyMatchedProperties(const MatchResult& matchResult, bool
             m_applyPropertyToRegularStyle = linkMatchType & SelectorChecker::MatchLink;
             m_applyPropertyToVisitedLinkStyle = linkMatchType & SelectorChecker::MatchVisited;
 
-            applyProperties<applyFirst>(matchedProperties.properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly, matchedProperties.isInRegionRule);
+            applyProperties<pass>(matchedProperties.properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly, matchedProperties.isInRegionRule);
         }
         m_applyPropertyToRegularStyle = true;
         m_applyPropertyToVisitedLinkStyle = false;
@@ -2692,7 +2693,7 @@ void StyleResolver::applyMatchedProperties(const MatchResult& matchResult, bool
     }
     for (int i = startIndex; i <= endIndex; ++i) {
         const MatchedProperties& matchedProperties = matchResult.matchedProperties[i];
-        applyProperties<applyFirst>(matchedProperties.properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly, matchedProperties.isInRegionRule);
+        applyProperties<pass>(matchedProperties.properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly, matchedProperties.isInRegionRule);
     }
 }
 
@@ -2815,10 +2816,10 @@ void StyleResolver::applyMatchedProperties(const MatchResult& matchResult)
     // The order is (1) high-priority not important, (2) high-priority important, (3) normal not important
     // and (4) normal important.
     m_lineHeightValue = 0;
-    applyMatchedProperties<true>(matchResult, false, 0, matchResult.matchedProperties.size() - 1, applyInheritedOnly);
-    applyMatchedProperties<true>(matchResult, true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
-    applyMatchedProperties<true>(matchResult, true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
-    applyMatchedProperties<true>(matchResult, true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
+    applyMatchedProperties<HighPriorityProperties>(matchResult, false, 0, matchResult.matchedProperties.size() - 1, applyInheritedOnly);
+    applyMatchedProperties<HighPriorityProperties>(matchResult, true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
+    applyMatchedProperties<HighPriorityProperties>(matchResult, true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
+    applyMatchedProperties<HighPriorityProperties>(matchResult, true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
 
     if (cacheItem && cacheItem->renderStyle->effectiveZoom() != m_style->effectiveZoom()) {
         m_fontDirty = true;
@@ -2837,16 +2838,16 @@ void StyleResolver::applyMatchedProperties(const MatchResult& matchResult)
         applyInheritedOnly = false;
 
     // Now do the normal priority UA properties.
-    applyMatchedProperties<false>(matchResult, false, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
+    applyMatchedProperties<LowPriorityProperties>(matchResult, false, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
     
     // Cache our border and background so that we can examine them later.
     cacheBorderAndBackground();
     
     // Now do the author and user normal priority properties and all the !important properties.
-    applyMatchedProperties<false>(matchResult, false, matchResult.ranges.lastUARule + 1, matchResult.matchedProperties.size() - 1, applyInheritedOnly);
-    applyMatchedProperties<false>(matchResult, true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
-    applyMatchedProperties<false>(matchResult, true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
-    applyMatchedProperties<false>(matchResult, true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
+    applyMatchedProperties<LowPriorityProperties>(matchResult, false, matchResult.ranges.lastUARule + 1, matchResult.matchedProperties.size() - 1, applyInheritedOnly);
+    applyMatchedProperties<LowPriorityProperties>(matchResult, true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
+    applyMatchedProperties<LowPriorityProperties>(matchResult, true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
+    applyMatchedProperties<LowPriorityProperties>(matchResult, true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
     
     loadPendingImages();
     
@@ -4046,6 +4047,7 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue *value)
     case CSSPropertyRight:
     case CSSPropertySize:
     case CSSPropertySpeak:
+    case CSSPropertyTabSize:
     case CSSPropertyTableLayout:
     case CSSPropertyTextAlign:
     case CSSPropertyTextDecoration:
diff --git a/Source/WebCore/css/StyleResolver.h b/Source/WebCore/css/StyleResolver.h
index 2a261448d..377add29b 100644
--- a/Source/WebCore/css/StyleResolver.h
+++ b/Source/WebCore/css/StyleResolver.h
@@ -353,9 +353,13 @@ private:
     bool checkSelector(const RuleData&, const ContainerNode* scope = 0);
     bool checkRegionSelector(CSSSelector* regionSelector, Element* regionElement);
     void applyMatchedProperties(const MatchResult&);
-    template <bool firstPass>
+    enum StyleApplicationPass {
+        HighPriorityProperties,
+        LowPriorityProperties
+    };
+    template <StyleApplicationPass pass>
     void applyMatchedProperties(const MatchResult&, bool important, int startIndex, int endIndex, bool inheritedOnly);
-    template <bool firstPass>
+    template <StyleApplicationPass pass>
     void applyProperties(const StylePropertySet* properties, StyleRule*, bool isImportant, bool inheritedOnly, bool filterRegionProperties);
 
     static bool isValidRegionStyleProperty(CSSPropertyID);
diff --git a/Source/WebCore/css/mediaControlsChromium.css b/Source/WebCore/css/mediaControlsChromium.css
index 7323f2a46..409398c5d 100644
--- a/Source/WebCore/css/mediaControlsChromium.css
+++ b/Source/WebCore/css/mediaControlsChromium.css
@@ -154,7 +154,8 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
 
 audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
     -webkit-appearance: media-volume-slider-container;
-    position: relative;
+    position: absolute;
+    bottom: 32px;
 
     width: 34px;
     height: 100px;
diff --git a/Source/WebCore/css/mediaControlsQuickTime.css b/Source/WebCore/css/mediaControlsQuickTime.css
index a7e5f41bc..2eb908b00 100644
--- a/Source/WebCore/css/mediaControlsQuickTime.css
+++ b/Source/WebCore/css/mediaControlsQuickTime.css
@@ -50,7 +50,7 @@ audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-bu
     border: none !important;
 
     position: relative;
-    z-index: 2;
+    z-index: 1;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
@@ -204,7 +204,7 @@ audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-cont
     position: absolute;
 
     bottom: 0px;
-    z-index: 1;
+    z-index: 2;
 
     width: 22px;
     height: 114px;
@@ -221,3 +221,21 @@ audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volum
     width: 10px;
     height: 80px;
 }
+
+audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button {
+    -webkit-appearance: media-volume-slider-mute-button;
+    display: inline;
+
+    position: absolute;
+
+    bottom: 7px;
+    left: 0px;
+
+    width: 14px;
+    height: 12px;
+
+    margin-left: 2px;
+    margin-right: 9px;
+
+    border: none !important;
+}
diff --git a/Source/WebCore/dom/Attr.cpp b/Source/WebCore/dom/Attr.cpp
index e00646f29..807f7f4ec 100644
--- a/Source/WebCore/dom/Attr.cpp
+++ b/Source/WebCore/dom/Attr.cpp
@@ -102,8 +102,8 @@ void Attr::setPrefix(const AtomicString& prefix, ExceptionCode& ec)
 
     const AtomicString& newPrefix = prefix.isEmpty() ? nullAtom : prefix;
 
-    if (Attribute* attribute = elementAttribute())
-        attribute->setPrefix(newPrefix);
+    if (m_element)
+        elementAttribute().setPrefix(newPrefix);
     m_name.setPrefix(newPrefix);
 }
 
@@ -113,13 +113,13 @@ void Attr::setValue(const AtomicString& value)
     m_ignoreChildrenChanged++;
     removeChildren();
     if (m_element)
-        elementAttribute()->setValue(value);
+        elementAttribute().setValue(value);
     else
         m_standaloneValue = value;
     createTextChild();
     m_ignoreChildrenChanged--;
 
-    invalidateNodeListsCacheAfterAttributeChanged(m_name);
+    invalidateNodeListsCacheAfterAttributeChanged(m_name, m_element);
 }
 
 void Attr::setValue(const AtomicString& value, ExceptionCode&)
@@ -162,7 +162,7 @@ void Attr::childrenChanged(bool, Node*, Node*, int)
     if (m_ignoreChildrenChanged > 0)
         return;
 
-    invalidateNodeListsCacheAfterAttributeChanged(qualifiedName());
+    invalidateNodeListsCacheAfterAttributeChanged(qualifiedName(), m_element);
 
     // FIXME: We should include entity references in the value
 
@@ -177,7 +177,7 @@ void Attr::childrenChanged(bool, Node*, Node*, int)
         m_element->willModifyAttribute(qualifiedName(), value(), newValue);
 
     if (m_element)
-        elementAttribute()->setValue(newValue);
+        elementAttribute().setValue(newValue);
     else
         m_standaloneValue = newValue;
 
@@ -193,7 +193,7 @@ bool Attr::isId() const
 CSSStyleDeclaration* Attr::style()
 {
     // This function only exists to support the Obj-C bindings.
-    if (!m_element->isStyledElement())
+    if (!m_element || !m_element->isStyledElement())
         return 0;
     m_style = StylePropertySet::create();
     static_cast<StyledElement*>(m_element)->collectStyleForAttribute(elementAttribute(), m_style.get());
@@ -207,11 +207,11 @@ const AtomicString& Attr::value() const
     return m_standaloneValue;
 }
 
-Attribute* Attr::elementAttribute()
+Attribute& Attr::elementAttribute()
 {
-    if (!m_element || !m_element->attributeData())
-        return 0;
-    return m_element->getAttributeItem(qualifiedName());
+    ASSERT(m_element);
+    ASSERT(m_element->attributeData());
+    return *m_element->getAttributeItem(qualifiedName());
 }
 
 void Attr::detachFromElementWithValue(const AtomicString& value)
diff --git a/Source/WebCore/dom/Attr.h b/Source/WebCore/dom/Attr.h
index a55a00950..8e760aa25 100644
--- a/Source/WebCore/dom/Attr.h
+++ b/Source/WebCore/dom/Attr.h
@@ -92,7 +92,7 @@ private:
     virtual const AtomicString& virtualLocalName() const { return localName(); }
     virtual const AtomicString& virtualNamespaceURI() const { return namespaceURI(); }
 
-    Attribute* elementAttribute();
+    Attribute& elementAttribute();
 
     // Attr wraps either an element/name, or a name/value pair (when it's a standalone Node.)
     // Note that m_name is always set, but m_element/m_standaloneValue may be null.
diff --git a/Source/WebCore/dom/ComposedShadowTreeWalker.cpp b/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
index d1a889e67..0f8614433 100644
--- a/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
+++ b/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
@@ -27,12 +27,11 @@
 #include "config.h"
 #include "ComposedShadowTreeWalker.h"
 
+#include "ContentDistributor.h"
 #include "Element.h"
 #include "ElementShadow.h"
-#include "HTMLContentSelector.h"
 #include "InsertionPoint.h"
 
-
 namespace WebCore {
 
 static inline ElementShadow* shadowFor(const Node* node)
@@ -114,9 +113,9 @@ Node* ComposedShadowTreeWalker::traverseNode(const Node* node, TraversalDirectio
 {
     ASSERT(node);
     if (isInsertionPoint(node)) {
-        const HTMLContentSelectionList* selectionList = toInsertionPoint(node)->selections();
-        if (HTMLContentSelection* selection = (direction == TraversalDirectionForward ? selectionList->first() : selectionList->last()))
-            return traverseNode(selection->node(), direction);
+        const InsertionPoint* insertionPoint = toInsertionPoint(node);
+        if (Node* next = (direction == TraversalDirectionForward ? insertionPoint->first() : insertionPoint->last()))
+            return traverseNode(next, direction);
         return traverseLightChildren(node, direction);
     }
     return const_cast<Node*>(node);
@@ -142,12 +141,12 @@ Node* ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint(const Node
     ElementShadow* shadow = shadowOfParent(node);
     if (!shadow)
         return traverseSiblingInCurrentTree(node, direction);
-    HTMLContentSelection* selection = shadow->selectionFor(node);
-    if (!selection)
+    InsertionPoint* insertionPoint = shadow->insertionPointFor(node);
+    if (!insertionPoint)
         return traverseSiblingInCurrentTree(node, direction);
-    if (HTMLContentSelection* nextSelection = (direction == TraversalDirectionForward ? selection->next() : selection->previous()))
-        return traverseNode(nextSelection->node(), direction);
-    return traverseSiblingOrBackToInsertionPoint(selection->insertionPoint(), direction);
+    if (Node* next = (direction == TraversalDirectionForward ? insertionPoint->nextTo(node) : insertionPoint->previousTo(node)))
+        return traverseNode(next, direction);
+    return traverseSiblingOrBackToInsertionPoint(insertionPoint, direction);
 }
 
 Node* ComposedShadowTreeWalker::traverseSiblingInCurrentTree(const Node* node, TraversalDirection direction)
@@ -197,6 +196,28 @@ void ComposedShadowTreeWalker::parent()
     assertPostcondition();
 }
 
+void ComposedShadowTreeWalker::parentIncludingInsertionPointAndShadowRoot()
+{
+    ASSERT(m_node);
+    m_node = traverseParentIncludingInsertionPointAndShadowRoot(m_node);
+}
+
+Node* ComposedShadowTreeWalker::traverseParentIncludingInsertionPointAndShadowRoot(const Node* node) const
+{
+    if (ElementShadow* shadow = shadowOfParent(node)) {
+        if (InsertionPoint* insertionPoint = shadow->insertionPointFor(node))
+            return insertionPoint;
+    }
+    if (!node->isShadowRoot())
+        return node->parentNode();
+    const ShadowRoot* shadowRoot = toShadowRoot(node);
+    if (shadowRoot->isYoungest())
+        return shadowRoot->host();
+    InsertionPoint* assignedInsertionPoint = shadowRoot->assignedTo();
+    ASSERT(assignedInsertionPoint);
+    return assignedInsertionPoint;
+}
+
 Node* ComposedShadowTreeWalker::traverseParent(const Node* node) const
 {
     if (!canCrossUpperBoundary() && node->isShadowRoot()) {
@@ -204,8 +225,8 @@ Node* ComposedShadowTreeWalker::traverseParent(const Node* node) const
         return 0;
     }
     if (ElementShadow* shadow = shadowOfParent(node)) {
-        if (HTMLContentSelection* selection = shadow->selectionFor(node))
-            return traverseParent(selection->insertionPoint());
+        if (InsertionPoint* insertionPoint = shadow->insertionPointFor(node))
+            return traverseParent(insertionPoint);
     }
     return traverseParentInCurrentTree(node);
 }
diff --git a/Source/WebCore/dom/ComposedShadowTreeWalker.h b/Source/WebCore/dom/ComposedShadowTreeWalker.h
index 9766c1a36..831b82c69 100644
--- a/Source/WebCore/dom/ComposedShadowTreeWalker.h
+++ b/Source/WebCore/dom/ComposedShadowTreeWalker.h
@@ -27,6 +27,7 @@
 #ifndef ComposedShadowTreeWalker_h
 #define ComposedShadowTreeWalker_h
 
+#include "InsertionPoint.h"
 #include "ShadowRoot.h"
 
 namespace WebCore {
@@ -58,6 +59,8 @@ public:
     void previousSibling();
 
     void parent();
+    // This function ignores policy and always crosses an upper boundary.
+    void parentIncludingInsertionPointAndShadowRoot();
 
     void next();
     void previous();
@@ -78,9 +81,7 @@ private:
             ASSERT(!m_node->isShadowRoot());
         else
             ASSERT(!m_node->isShadowRoot() || toShadowRoot(m_node)->isYoungest());
-        // FIXME: Add an assertion once InsertionPoint have isActive() function.
-        // https://bugs.webkit.org/show_bug.cgi?id=82010
-        // ASSERT(!isInsertionPoint(m_node) || !toInsertionPoint(node)->isActive());
+        ASSERT(!isInsertionPoint(m_node) || !toInsertionPoint(m_node)->isActive());
 #endif
     }
 
@@ -99,6 +100,7 @@ private:
     Node* traverseLastChild(const Node*) const;
     Node* traverseChild(const Node*, TraversalDirection) const;
     Node* traverseParent(const Node*) const;
+    Node* traverseParentIncludingInsertionPointAndShadowRoot(const Node*) const;
 
     static Node* traverseNextSibling(const Node*);
     static Node* traversePreviousSibling(const Node*);
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 3c0e66c2c..33ad817c0 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -322,11 +322,11 @@ static void willRemoveChild(Node* child)
 
 static void willRemoveChildren(ContainerNode* container)
 {
-    container->document()->nodeChildrenWillBeRemoved(container);
-
     NodeVector children;
     getChildNodes(container, children);
 
+    container->document()->nodeChildrenWillBeRemoved(container);
+
 #if ENABLE(MUTATION_OBSERVERS)
     ChildListMutationScope mutation(container);
 #endif
diff --git a/Source/WebCore/dom/ContainerNode.h b/Source/WebCore/dom/ContainerNode.h
index 233e034f2..1439b3697 100644
--- a/Source/WebCore/dom/ContainerNode.h
+++ b/Source/WebCore/dom/ContainerNode.h
@@ -229,6 +229,36 @@ inline Node* Node::highestAncestor() const
     return highest;
 }
 
+inline Node* Node::traverseNextSibling() const
+{
+    if (nextSibling())
+        return nextSibling();
+    return traverseNextAncestorSibling();
+}
+
+inline Node* Node::traverseNextNode() const
+{
+    if (firstChild())
+        return firstChild();
+    return traverseNextSibling();
+}
+
+inline Node* Node::traverseNextSibling(const Node* stayWithin) const
+{
+    if (this == stayWithin)
+        return 0;
+    if (nextSibling())
+        return nextSibling();
+    return traverseNextAncestorSibling(stayWithin);
+}
+
+inline Node* Node::traverseNextNode(const Node* stayWithin) const
+{
+    if (firstChild())
+        return firstChild();
+    return traverseNextSibling(stayWithin);
+}
+
 typedef Vector<RefPtr<Node>, 11> NodeVector;
 
 inline void getChildNodes(Node* node, NodeVector& nodes)
diff --git a/Source/WebCore/dom/ContainerNodeAlgorithms.h b/Source/WebCore/dom/ContainerNodeAlgorithms.h
index fccb5eeb1..a3ce88e69 100644
--- a/Source/WebCore/dom/ContainerNodeAlgorithms.h
+++ b/Source/WebCore/dom/ContainerNodeAlgorithms.h
@@ -303,7 +303,7 @@ inline void ChildFrameDisconnector::collectDescendant(Node* root)
         if (!node->isElementNode())
             continue;
         Element* element = toElement(node);
-        if (element->isFrameOwnerElement())
+        if (element->hasCustomCallbacks() && element->isFrameOwnerElement())
             m_list.append(node);
         if (ElementShadow* shadow = element->shadow())
             collectDescendant(shadow);
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index 6f65c0013..320aef982 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -133,7 +133,6 @@
 #include "TransformSourceLibxslt.cpp"
 #include "Traversal.cpp"
 #include "TreeScope.cpp"
-#include "TreeScopeAdjuster.cpp"
 #include "TreeScopeAdopter.cpp"
 #include "TreeWalker.cpp"
 #include "UIEvent.cpp"
diff --git a/Source/WebCore/dom/DOMImplementation.cpp b/Source/WebCore/dom/DOMImplementation.cpp
index 66ea0dcab..c42118409 100644
--- a/Source/WebCore/dom/DOMImplementation.cpp
+++ b/Source/WebCore/dom/DOMImplementation.cpp
@@ -67,6 +67,24 @@ static void addString(FeatureSet& set, const char* string)
     set.add(string);
 }
 
+#if ENABLE(VIDEO)
+class DOMImplementationSupportsTypeClient : public MediaPlayerSupportsTypeClient {
+public:
+    DOMImplementationSupportsTypeClient(bool needsHacks, const String& host)
+        : m_needsHacks(needsHacks)
+        , m_host(host)
+    {
+    }
+
+private:
+    virtual bool mediaPlayerNeedsSiteSpecificHacks() const OVERRIDE { return m_needsHacks; }
+    virtual String mediaPlayerDocumentHost() const OVERRIDE { return m_host; }
+
+    bool m_needsHacks;
+    String m_host;
+};
+#endif
+
 #if ENABLE(SVG)
 
 static bool isSVG10Feature(const String &feature, const String &version)
@@ -387,7 +405,8 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
 #if ENABLE(VIDEO)
      // Check to see if the type can be played by our MediaPlayer, if so create a MediaDocument
     // Key system is not applicable here.
-    if (MediaPlayer::supportsType(ContentType(type), String()))
+    DOMImplementationSupportsTypeClient client(frame && frame->settings() && frame->settings()->needsSiteSpecificQuirks(), url.host());
+    if (MediaPlayer::supportsType(ContentType(type), String(), &client))
          return MediaDocument::create(frame, url);
 #endif
 
diff --git a/Source/WebCore/dom/DOMImplementation.h b/Source/WebCore/dom/DOMImplementation.h
index e493b6e99..81ae29faa 100644
--- a/Source/WebCore/dom/DOMImplementation.h
+++ b/Source/WebCore/dom/DOMImplementation.h
@@ -25,6 +25,7 @@
 #define DOMImplementation_h
 
 #include "Document.h"
+#include "MediaPlayer.h"
 #include <wtf/Forward.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 30d367f93..eeea03260 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -46,6 +46,7 @@
 #include "ContentSecurityPolicy.h"
 #include "CookieJar.h"
 #include "DOMImplementation.h"
+#include "DOMSelection.h"
 #include "DOMWindow.h"
 #include "DateComponents.h"
 #include "DeviceMotionController.h"
@@ -206,6 +207,10 @@
 #include "NodeRareData.h"
 #endif
 
+#if ENABLE(LINK_PRERENDER)
+#include "Prerenderer.h"
+#endif
+
 using namespace std;
 using namespace WTF;
 using namespace Unicode;
@@ -509,7 +514,9 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     m_markers = adoptPtr(new DocumentMarkerController);
 
     m_cachedResourceLoader = adoptPtr(new CachedResourceLoader(this));
-
+#if ENABLE(LINK_PRERENDER)
+    m_prerenderer = Prerenderer::create(this);
+#endif
     m_visuallyOrdered = false;
     m_bParsing = false;
     m_wellFormed = false;
@@ -907,8 +914,7 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
         if (ec)
             return 0;
 
-        newElement->setAttributesFromElement(*oldElement);
-        newElement->copyNonAttributeProperties(oldElement);
+        newElement->cloneDataFromElement(*oldElement);
 
         if (deep) {
             for (Node* oldChild = oldElement->firstChild(); oldChild; oldChild = oldChild->nextSibling()) {
@@ -3654,6 +3660,8 @@ bool Document::setFocusedNode(PassRefPtr<Node> prpNewFocusedNode)
 
     // Remove focus from the existing focus node (if any)
     if (oldFocusedNode) {
+        ASSERT(!oldFocusedNode->inDetach());
+
         if (oldFocusedNode->active())
             oldFocusedNode->setActive(false);
 
@@ -3688,7 +3696,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> prpNewFocusedNode)
         if (oldFocusedNode == this && oldFocusedNode->hasOneRef())
             return true;
             
-        if (oldFocusedNode == oldFocusedNode->rootEditableElement())
+        if (oldFocusedNode->isRootEditableElement())
             frame()->editor()->didEndEditing();
 
         if (view()) {
@@ -3701,7 +3709,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> prpNewFocusedNode)
     }
 
     if (newFocusedNode) {
-        if (newFocusedNode == newFocusedNode->rootEditableElement() && !acceptsEditingFocus(newFocusedNode.get())) {
+        if (newFocusedNode->isRootEditableElement() && !acceptsEditingFocus(newFocusedNode.get())) {
             // delegate blocks focus change
             focusChangeBlocked = true;
             goto SetFocusedNodeDone;
@@ -3737,7 +3745,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> prpNewFocusedNode)
         }
         m_focusedNode->setFocus(true);
 
-        if (m_focusedNode == m_focusedNode->rootEditableElement())
+        if (m_focusedNode->isRootEditableElement())
             frame()->editor()->didBeginEditing();
 
         // eww, I suck. set the qt focus correctly
@@ -5052,7 +5060,7 @@ void Document::updateURLForPushOrReplaceState(const KURL& url)
         documentLoader->replaceRequestURLForSameDocumentNavigation(url);
 }
 
-void Document::statePopped(SerializedScriptValue* stateObject)
+void Document::statePopped(PassRefPtr<SerializedScriptValue> stateObject)
 {
     if (!frame())
         return;
@@ -5092,12 +5100,6 @@ void Document::updateFocusAppearanceTimerFired(Timer<Document>*)
         element->updateFocusAppearance(m_updateFocusAppearanceRestoresSelection);
 }
 
-// FF method for accessing the selection added for compatibility.
-DOMSelection* Document::getSelection() const
-{
-    return frame() ? frame()->domWindow()->getSelection() : 0;
-}
-
 void Document::attachRange(Range* range)
 {
     ASSERT(!m_ranges.contains(range));
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 6c684e822..78a2b8e67 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -167,6 +167,10 @@ class ScriptedAnimationController;
 class MicroDataItemList;
 #endif
 
+#if ENABLE(LINK_PRERENDER)
+class Prerenderer;
+#endif
+
 typedef int ExceptionCode;
 
 class FormElementKey {
@@ -969,9 +973,6 @@ public:
     void updateFocusAppearanceSoon(bool restorePreviousSelection);
     void cancelFocusAppearanceUpdate();
         
-    // FF method for accessing the selection added for compatibility.
-    DOMSelection* getSelection() const;
-    
     // Extension for manipulating canvas drawing contexts for use in CSS
     CanvasRenderingContext* getCSSCanvasContext(const String& type, const String& name, int width, int height);
     HTMLCanvasElement* getCSSCanvasElement(const String& name);
@@ -1049,7 +1050,7 @@ public:
     void setSecurityOrigin(PassRefPtr<SecurityOrigin>);
 
     void updateURLForPushOrReplaceState(const KURL&);
-    void statePopped(SerializedScriptValue*);
+    void statePopped(PassRefPtr<SerializedScriptValue>);
 
     bool processingLoadEvent() const { return m_processingLoadEvent; }
     bool loadEventFinished() const { return m_loadEventFinished; }
@@ -1156,6 +1157,10 @@ public:
 
     IntSize viewportSize() const;
 
+#if ENABLE(LINK_PRERENDER)
+    Prerenderer* prerenderer() { return m_prerenderer.get(); }
+#endif
+
 protected:
     Document(Frame*, const KURL&, bool isXHTML, bool isHTML);
 
@@ -1500,6 +1505,11 @@ private:
 
     Timer<Document> m_pendingTasksTimer;
     Vector<OwnPtr<Task> > m_pendingTasks;
+
+#if ENABLE(LINK_PRERENDER)
+    OwnPtr<Prerenderer> m_prerenderer;
+#endif
+
     bool m_scheduledTasksAreSuspended;
     
     bool m_visualUpdatesAllowed;
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index cc49393d8..2390c7c0c 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -60,7 +60,6 @@
 #include "RenderRegion.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
-#include "RuntimeEnabledFeatures.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
 #include "StyleResolver.h"
@@ -179,9 +178,7 @@ PassRefPtr<Element> Element::cloneElementWithoutChildren()
     // This is a sanity check as HTML overloads some of the DOM methods.
     ASSERT(isHTMLElement() == clone->isHTMLElement());
 
-    clone->setAttributesFromElement(*this);
-    clone->copyNonAttributeProperties(this);
-
+    clone->cloneDataFromElement(*this);
     return clone.release();
 }
 
@@ -190,10 +187,6 @@ PassRefPtr<Element> Element::cloneElementWithoutAttributesAndChildren()
     return document()->createElement(tagQName(), false);
 }
 
-void Element::copyNonAttributeProperties(const Element*)
-{
-}
-
 PassRefPtr<Attr> Element::detachAttribute(size_t index)
 {
     if (!attributeData())
@@ -697,38 +690,38 @@ inline void Element::setAttributeInternal(size_t index, const QualifiedName& nam
         old->setValue(value);
 
     if (inUpdateStyleAttribute == NotInUpdateStyleAttribute)
-        didModifyAttribute(old);
+        didModifyAttribute(*old);
 }
 
-void Element::attributeChanged(Attribute* attr)
+void Element::attributeChanged(const Attribute& attribute)
 {
     document()->incDOMTreeVersion();
 
-    if (isIdAttributeName(attr->name())) {
+    if (isIdAttributeName(attribute.name())) {
         if (attributeData()) {
-            if (attr->isNull())
+            if (attribute.isNull())
                 attributeData()->setIdForStyleResolution(nullAtom);
             else if (document()->inQuirksMode())
-                attributeData()->setIdForStyleResolution(attr->value().lower());
+                attributeData()->setIdForStyleResolution(attribute.value().lower());
             else
-                attributeData()->setIdForStyleResolution(attr->value());
+                attributeData()->setIdForStyleResolution(attribute.value());
         }
         setNeedsStyleRecalc();
-    } else if (attr->name() == HTMLNames::nameAttr)
-        setHasName(!attr->isNull());
+    } else if (attribute.name() == HTMLNames::nameAttr)
+        setHasName(!attribute.isNull());
 
     if (!needsStyleRecalc() && document()->attached()) {
         StyleResolver* styleResolver = document()->styleResolverIfExists();
-        if (!styleResolver || styleResolver->hasSelectorForAttribute(attr->name().localName()))
+        if (!styleResolver || styleResolver->hasSelectorForAttribute(attribute.name().localName()))
             setNeedsStyleRecalc();
     }
 
-    invalidateNodeListsCacheAfterAttributeChanged(attr->name());
+    invalidateNodeListsCacheAfterAttributeChanged(attribute.name(), this);
 
     if (!AXObjectCache::accessibilityEnabled())
         return;
 
-    const QualifiedName& attrName = attr->name();
+    const QualifiedName& attrName = attribute.name();
     if (attrName == aria_activedescendantAttr) {
         // any change to aria-activedescendant attribute triggers accessibility focus change, but document focus remains intact
         document()->axObjectCache()->handleActiveDescendantChanged(renderer());
@@ -803,7 +796,7 @@ void Element::parserSetAttributes(const Vector<Attribute>& attributeVector, Frag
     // attributeChanged mutates m_attributeData.
     Vector<Attribute> clonedAttributes = m_attributeData->clonedAttributeVector();
     for (unsigned i = 0; i < clonedAttributes.size(); ++i)
-        attributeChanged(&clonedAttributes[i]);
+        attributeChanged(clonedAttributes[i]);
 }
 
 bool Element::hasAttributes() const
@@ -1041,22 +1034,19 @@ bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderS
     return false;
 }
 
-PassRefPtr<RenderStyle> Element::customStyleForRenderer()
-{
-    ASSERT_NOT_REACHED(); 
-    return 0; 
-}
-
 PassRefPtr<RenderStyle> Element::styleForRenderer()
 {
-    if (hasCustomStyleForRenderer())
-        return customStyleForRenderer();
-    return document()->styleResolver()->styleForElement(static_cast<Element*>(this));
+    if (hasCustomCallbacks()) {
+        if (RefPtr<RenderStyle> style = customStyleForRenderer())
+            return style.release();
+    }
+
+    return document()->styleResolver()->styleForElement(this);
 }
 
 void Element::recalcStyle(StyleChange change)
 {
-    if (hasCustomWillOrDidRecalcStyle()) {
+    if (hasCustomCallbacks()) {
         if (!willRecalcStyle(change))
             return;
     }
@@ -1084,7 +1074,7 @@ void Element::recalcStyle(StyleChange change)
             clearNeedsStyleRecalc();
             clearChildNeedsStyleRecalc();
 
-            if (hasCustomWillOrDidRecalcStyle())
+            if (hasCustomCallbacks())
                 didRecalcStyle(change);
             return;
         }
@@ -1174,7 +1164,7 @@ void Element::recalcStyle(StyleChange change)
     clearNeedsStyleRecalc();
     clearChildNeedsStyleRecalc();
     
-    if (hasCustomWillOrDidRecalcStyle())
+    if (hasCustomCallbacks())
         didRecalcStyle(change);
 }
 
@@ -1588,7 +1578,7 @@ void Element::focus(bool restorePreviousSelection)
 
 void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
 {
-    if (this == rootEditableElement()) { 
+    if (isRootEditableElement()) {
         Frame* frame = document()->frame();
         if (!frame)
             return;
@@ -2026,25 +2016,23 @@ void Element::willModifyAttribute(const QualifiedName& name, const AtomicString&
 #endif
 }
 
-void Element::didAddAttribute(Attribute* attr)
+void Element::didAddAttribute(const Attribute& attribute)
 {
-    attributeChanged(attr);
-    InspectorInstrumentation::didModifyDOMAttr(document(), this, attr->name().localName(), attr->value());
+    attributeChanged(attribute);
+    InspectorInstrumentation::didModifyDOMAttr(document(), this, attribute.localName(), attribute.value());
     dispatchSubtreeModifiedEvent();
 }
 
-void Element::didModifyAttribute(Attribute* attr)
+void Element::didModifyAttribute(const Attribute& attribute)
 {
-    attributeChanged(attr);
-    InspectorInstrumentation::didModifyDOMAttr(document(), this, attr->name().localName(), attr->value());
+    attributeChanged(attribute);
+    InspectorInstrumentation::didModifyDOMAttr(document(), this, attribute.localName(), attribute.value());
     // Do not dispatch a DOMSubtreeModified event here; see bug 81141.
 }
 
 void Element::didRemoveAttribute(const QualifiedName& name)
 {
-    Attribute dummyAttribute(name, nullAtom);
-    attributeChanged(&dummyAttribute);
-
+    attributeChanged(Attribute(name, nullAtom));
     InspectorInstrumentation::didRemoveDOMAttr(document(), this, name.localName());
     dispatchSubtreeModifiedEvent();
 }
@@ -2104,4 +2092,39 @@ PassRefPtr<Attr> Element::ensureAttr(const QualifiedName& name)
     return attributeData()->ensureAttr(this, name);
 }
 
+bool Element::willRecalcStyle(StyleChange)
+{
+    ASSERT(hasCustomCallbacks());
+    return true;
+}
+
+void Element::didRecalcStyle(StyleChange)
+{
+    ASSERT(hasCustomCallbacks());
+}
+
+
+PassRefPtr<RenderStyle> Element::customStyleForRenderer()
+{
+    ASSERT(hasCustomCallbacks());
+    return 0;
+}
+
+
+void Element::cloneAttributesFromElement(const Element& other)
+{
+    if (ElementAttributeData* attributeData = other.updatedAttributeData())
+        ensureUpdatedAttributeData()->cloneDataFrom(*attributeData, other, *this);
+    else if (m_attributeData) {
+        m_attributeData->clearAttributes(this);
+        m_attributeData.clear();
+    }
+}
+
+void Element::cloneDataFromElement(const Element& other)
+{
+    cloneAttributesFromElement(other);
+    copyNonAttributePropertiesFromElement(other);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 8bd9cd810..e436f3481 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -241,7 +241,7 @@ public:
     NamedNodeMap* attributes() const;
 
     // This method is called whenever an attribute is added, changed or removed.
-    virtual void attributeChanged(Attribute*);
+    virtual void attributeChanged(const Attribute&);
 
     // Only called by the parser immediately after element construction.
     void parserSetAttributes(const Vector<Attribute>&, FragmentScriptingPermission);
@@ -251,10 +251,15 @@ public:
     ElementAttributeData* updatedAttributeData() const;
     ElementAttributeData* ensureUpdatedAttributeData() const;
 
-    void setAttributesFromElement(const Element&);
+    // Clones attributes only.
+    void cloneAttributesFromElement(const Element&);
+
+    // Clones all attribute-derived data, including subclass specifics (through copyNonAttributeProperties.)
+    void cloneDataFromElement(const Element&);
+
     bool hasEquivalentAttributes(const Element* other) const;
 
-    virtual void copyNonAttributeProperties(const Element* source);
+    virtual void copyNonAttributePropertiesFromElement(const Element&) { }
 
     virtual void attach();
     virtual void detach();
@@ -302,8 +307,8 @@ public:
 
     void willModifyAttribute(const QualifiedName&, const AtomicString& oldValue, const AtomicString& newValue);
     void willRemoveAttribute(const QualifiedName&, const AtomicString& value);
-    void didAddAttribute(Attribute*);
-    void didModifyAttribute(Attribute*);
+    void didAddAttribute(const Attribute&);
+    void didModifyAttribute(const Attribute&);
     void didRemoveAttribute(const QualifiedName&);
 
     LayoutSize minimumSizeForResizing() const;
@@ -422,8 +427,9 @@ protected:
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void removedFrom(Node*) OVERRIDE;
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-    virtual bool willRecalcStyle(StyleChange) { return true; }
-    virtual void didRecalcStyle(StyleChange) { }
+
+    virtual bool willRecalcStyle(StyleChange);
+    virtual void didRecalcStyle(StyleChange);
     virtual PassRefPtr<RenderStyle> customStyleForRenderer();
 
     virtual bool shouldRegisterAsNamedItem() const { return false; }
@@ -561,12 +567,6 @@ inline ElementAttributeData* Element::ensureUpdatedAttributeData() const
     return ensureAttributeData();
 }
 
-inline void Element::setAttributesFromElement(const Element& other)
-{
-    if (ElementAttributeData* attributeData = other.updatedAttributeData())
-        ensureUpdatedAttributeData()->setAttributes(*attributeData, this);
-}
-
 inline void Element::updateName(const AtomicString& oldName, const AtomicString& newName)
 {
     if (!inDocument())
diff --git a/Source/WebCore/dom/ElementAttributeData.cpp b/Source/WebCore/dom/ElementAttributeData.cpp
index 6527cf90a..da848159b 100644
--- a/Source/WebCore/dom/ElementAttributeData.cpp
+++ b/Source/WebCore/dom/ElementAttributeData.cpp
@@ -180,7 +180,7 @@ void ElementAttributeData::addAttribute(const Attribute& attribute, Element* ele
     m_attributes.append(attribute);
 
     if (element && inUpdateStyleAttribute == NotInUpdateStyleAttribute)
-        element->didAddAttribute(const_cast<Attribute*>(&attribute));
+        element->didAddAttribute(attribute);
 }
 
 void ElementAttributeData::removeAttribute(size_t index, Element* element, EInUpdateStyleAttribute inUpdateStyleAttribute)
@@ -252,28 +252,36 @@ size_t ElementAttributeData::getAttributeItemIndexSlowCase(const String& name, b
     return notFound;
 }
 
-void ElementAttributeData::setAttributes(const ElementAttributeData& other, Element* element)
+void ElementAttributeData::cloneDataFrom(const ElementAttributeData& sourceData, const Element& sourceElement, Element& targetElement)
 {
-    ASSERT(element);
+    const AtomicString& oldID = targetElement.getIdAttribute();
+    const AtomicString& newID = sourceElement.getIdAttribute();
 
-    // If assigning the map changes the id attribute, we need to call
-    // updateId.
-    Attribute* oldId = getAttributeItem(element->document()->idAttributeName());
-    Attribute* newId = other.getAttributeItem(element->document()->idAttributeName());
+    if (!oldID.isNull() || !newID.isNull())
+        targetElement.updateId(oldID, newID);
 
-    if (oldId || newId)
-        element->updateId(oldId ? oldId->value() : nullAtom, newId ? newId->value() : nullAtom);
+    const AtomicString& oldName = targetElement.getNameAttribute();
+    const AtomicString& newName = sourceElement.getNameAttribute();
 
-    Attribute* oldName = getAttributeItem(HTMLNames::nameAttr);
-    Attribute* newName = other.getAttributeItem(HTMLNames::nameAttr);
+    if (!oldName.isNull() || !newName.isNull())
+        targetElement.updateName(oldName, newName);
 
-    if (oldName || newName)
-        element->updateName(oldName ? oldName->value() : nullAtom, newName ? newName->value() : nullAtom);
+    clearAttributes(&targetElement);
+    m_attributes = sourceData.m_attributes;
+    for (unsigned i = 0; i < m_attributes.size(); ++i) {
+        if (targetElement.isStyledElement() && m_attributes[i].name() == HTMLNames::styleAttr) {
+            static_cast<StyledElement&>(targetElement).styleAttributeChanged(m_attributes[i].value(), StyledElement::DoNotReparseStyleAttribute);
+            continue;
+        }
+        targetElement.attributeChanged(m_attributes[i]);
+    }
 
-    clearAttributes(element);
-    m_attributes = other.m_attributes;
-    for (unsigned i = 0; i < m_attributes.size(); ++i)
-        element->attributeChanged(&m_attributes[i]);
+    if (targetElement.isStyledElement() && sourceData.m_inlineStyleDecl) {
+        StylePropertySet* inlineStyle = ensureMutableInlineStyle(static_cast<StyledElement*>(&targetElement));
+        inlineStyle->copyPropertiesFrom(*sourceData.m_inlineStyleDecl);
+        inlineStyle->setCSSParserMode(sourceData.m_inlineStyleDecl->cssParserMode());
+        targetElement.setIsStyleAttributeValid(sourceElement.isStyleAttributeValid());
+    }
 }
 
 void ElementAttributeData::clearAttributes(Element* element)
@@ -290,7 +298,7 @@ void ElementAttributeData::replaceAttribute(size_t index, const Attribute& attri
 
     element->willModifyAttribute(attribute.name(), m_attributes[index].value(), attribute.value());
     m_attributes[index] = attribute;
-    element->didModifyAttribute(const_cast<Attribute*>(&attribute));
+    element->didModifyAttribute(attribute);
 }
 
 PassRefPtr<Attr> ElementAttributeData::getAttributeNode(const String& name, bool shouldIgnoreAttributeCase, Element* element) const
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index 67513d26a..5ad7287e3 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -113,7 +113,7 @@ private:
     void detachAttributesFromElement(Element*);
     Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
     size_t getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
-    void setAttributes(const ElementAttributeData& other, Element*);
+    void cloneDataFrom(const ElementAttributeData& sourceData, const Element& sourceElement, Element& targetElement);
     void clearAttributes(Element*);
     void replaceAttribute(size_t index, const Attribute&, Element*);
 
diff --git a/Source/WebCore/dom/ElementShadow.cpp b/Source/WebCore/dom/ElementShadow.cpp
index cc6c86e16..6e104ac6a 100644
--- a/Source/WebCore/dom/ElementShadow.cpp
+++ b/Source/WebCore/dom/ElementShadow.cpp
@@ -32,7 +32,6 @@
 #include "Element.h"
 #include "HTMLShadowElement.h"
 #include "InspectorInstrumentation.h"
-#include "RuntimeEnabledFeatures.h"
 #include "ShadowRoot.h"
 #include "StyleResolver.h"
 #include "Text.h"
@@ -40,7 +39,7 @@
 namespace WebCore {
 
 ElementShadow::ElementShadow()
-    : m_needsRecalculateContent(false)
+    : m_needsRedistributing(false)
 {
 }
 
@@ -119,16 +118,16 @@ void ElementShadow::setParentTreeScope(TreeScope* scope)
 
 void ElementShadow::attach()
 {
-    // Children of m_selector is populated lazily in
-    // ensureSelector(), and here we just ensure that it is in clean state.
-    ASSERT(!selector().hasPopulated());
+    // The pool nodes are populated lazily in
+    // ensureDistributor(), and here we just ensure that it is in clean state.
+    ASSERT(!distributor().poolIsReady());
 
-    selector().willSelect();
+    distributor().willDistribute();
     for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
         if (!root->attached())
             root->attach();
     }
-    selector().didSelect();
+    distributor().didDistribute();
 }
 
 void ElementShadow::attachHost(Element* host)
@@ -164,15 +163,7 @@ InsertionPoint* ElementShadow::insertionPointFor(const Node* node) const
         return 0;
     }
 
-    HTMLContentSelection* found = selector().findFor(node);
-    if (!found)
-        return 0;
-    return found->insertionPoint();
-}
-
-HTMLContentSelection* ElementShadow::selectionFor(const Node* node) const
-{
-    return m_selector.findFor(node);
+    return distributor().findInsertionPointFor(node);
 }
 
 void ElementShadow::reattach()
@@ -207,7 +198,7 @@ void ElementShadow::recalcStyle(Node::StyleChange change)
     if (!youngest)
         return;
 
-    if (needsReattachHostChildrenAndShadow())
+    if (needsRedistributing())
         reattachHostChildrenAndShadow();
     else {
         StyleResolver* styleResolver = youngest->document()->styleResolver();
@@ -222,16 +213,16 @@ void ElementShadow::recalcStyle(Node::StyleChange change)
         styleResolver->popParentShadowRoot(youngest);
     }
 
-    clearNeedsReattachHostChildrenAndShadow();
+    clearNeedsRedistributing();
     for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
         root->clearNeedsStyleRecalc();
         root->clearChildNeedsStyleRecalc();
     }
 }
 
-bool ElementShadow::needsReattachHostChildrenAndShadow()
+bool ElementShadow::needsRedistributing()
 {
-    return m_needsRecalculateContent || (youngestShadowRoot() && youngestShadowRoot()->hasInsertionPoint());
+    return m_needsRedistributing || (youngestShadowRoot() && youngestShadowRoot()->hasInsertionPoint());
 }
 
 void ElementShadow::hostChildrenChanged()
@@ -242,12 +233,12 @@ void ElementShadow::hostChildrenChanged()
         return;
 
     // This results in forced detaching/attaching of the shadow render tree. See ShadowRoot::recalcStyle().
-    setNeedsReattachHostChildrenAndShadow();
+    setNeedsRedistributing();
 }
 
-void ElementShadow::setNeedsReattachHostChildrenAndShadow()
+void ElementShadow::setNeedsRedistributing()
 {
-    m_needsRecalculateContent = true;
+    m_needsRedistributing = true;
 
     host()->setNeedsStyleRecalc();
 }
diff --git a/Source/WebCore/dom/ElementShadow.h b/Source/WebCore/dom/ElementShadow.h
index 4c07a27e0..e6f860b6d 100644
--- a/Source/WebCore/dom/ElementShadow.h
+++ b/Source/WebCore/dom/ElementShadow.h
@@ -27,8 +27,8 @@
 #ifndef ElementShadow_h
 #define ElementShadow_h
 
+#include "ContentDistributor.h"
 #include "ExceptionCode.h"
-#include "HTMLContentSelector.h"
 #include "ShadowRoot.h"
 #include <wtf/DoublyLinkedList.h>
 #include <wtf/Noncopyable.h>
@@ -40,9 +40,7 @@ namespace WebCore {
 
 class Node;
 class Element;
-class InsertionPoint;
 class TreeScope;
-class HTMLContentSelection;
 
 class ElementShadow {
 public:
@@ -66,24 +64,23 @@ public:
     bool childNeedsStyleRecalc();
     bool needsStyleRecalc();
     void recalcStyle(Node::StyleChange);
-    void setNeedsReattachHostChildrenAndShadow();
-    void clearNeedsReattachHostChildrenAndShadow();
-    bool needsReattachHostChildrenAndShadow();
-    void reattachHostChildrenAndShadow();
+    void setNeedsRedistributing();
+    void clearNeedsRedistributing();
+    bool needsRedistributing();
     void hostChildrenChanged();
 
     InsertionPoint* insertionPointFor(const Node*) const;
-    HTMLContentSelection* selectionFor(const Node*) const;
 
-    HTMLContentSelector& selector();
-    const HTMLContentSelector& selector() const;
+    ContentDistributor& distributor();
+    const ContentDistributor& distributor() const;
 
 private:
     void removeAllShadowRoots();
+    void reattachHostChildrenAndShadow();
 
     DoublyLinkedList<ShadowRoot> m_shadowRoots;
-    HTMLContentSelector m_selector;
-    bool m_needsRecalculateContent : 1;
+    ContentDistributor m_distributor;
+    bool m_needsRedistributing : 1;
     WTF_MAKE_NONCOPYABLE(ElementShadow);
 };
 
@@ -97,19 +94,19 @@ inline ShadowRoot* ElementShadow::oldestShadowRoot() const
     return m_shadowRoots.tail();
 }
 
-inline HTMLContentSelector& ElementShadow::selector()
+inline ContentDistributor& ElementShadow::distributor()
 {
-    return m_selector;
+    return m_distributor;
 }
 
-inline const HTMLContentSelector& ElementShadow::selector() const
+inline const ContentDistributor& ElementShadow::distributor() const
 {
-    return m_selector;
+    return m_distributor;
 }
 
-inline void ElementShadow::clearNeedsReattachHostChildrenAndShadow()
+inline void ElementShadow::clearNeedsRedistributing()
 {
-    m_needsRecalculateContent = false;
+    m_needsRedistributing = false;
 }
 
 inline Element* ElementShadow::host() const
diff --git a/Source/WebCore/dom/EventContext.cpp b/Source/WebCore/dom/EventContext.cpp
index 2a5c5210a..8094ba0bb 100644
--- a/Source/WebCore/dom/EventContext.cpp
+++ b/Source/WebCore/dom/EventContext.cpp
@@ -30,6 +30,7 @@
 #include "DOMWindow.h"
 #include "Document.h"
 #include "Event.h"
+#include "MouseEvent.h"
 #include "Node.h"
 
 namespace WebCore {
@@ -38,6 +39,7 @@ EventContext::EventContext(PassRefPtr<Node> node, PassRefPtr<EventTarget> curren
     : m_node(node)
     , m_currentTarget(currentTarget)
     , m_target(target)
+    , m_relatedTarget(0)
 {
 }
 
@@ -45,6 +47,8 @@ void EventContext::handleLocalEvents(Event* event) const
 {
     event->setTarget(m_target.get());
     event->setCurrentTarget(m_currentTarget.get());
+    if (m_relatedTarget.get() && event->isMouseEvent())
+        toMouseEvent(event)->setRelatedTarget(m_relatedTarget.get());
     m_node->handleLocalEvents(event);
 }
 
diff --git a/Source/WebCore/dom/EventContext.h b/Source/WebCore/dom/EventContext.h
index 5e7317f45..632581009 100644
--- a/Source/WebCore/dom/EventContext.h
+++ b/Source/WebCore/dom/EventContext.h
@@ -42,13 +42,16 @@ public:
 
     Node* node() const;
     EventTarget* target() const;
+    EventTarget* relatedTarget() const;
     bool currentTargetSameAsTarget() const;
     void handleLocalEvents(Event*) const;
+    void setRelatedTarget(PassRefPtr<EventTarget>);
 
 private:
     RefPtr<Node> m_node;
     RefPtr<EventTarget> m_currentTarget;
     RefPtr<EventTarget> m_target;
+    RefPtr<EventTarget> m_relatedTarget;
 };
 
 inline Node* EventContext::node() const
@@ -66,6 +69,16 @@ inline bool EventContext::currentTargetSameAsTarget() const
     return m_currentTarget.get() == m_target.get();
 }
 
+inline EventTarget* EventContext::relatedTarget() const
+{
+    return m_relatedTarget.get();
+}
+
+inline void EventContext::setRelatedTarget(PassRefPtr<EventTarget> relatedTarget)
+{
+    m_relatedTarget = relatedTarget;
+}
+
 }
 
 #endif // EventContext_h
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
index 1689e06b8..fcdc0e583 100644
--- a/Source/WebCore/dom/EventDispatcher.cpp
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -26,10 +26,13 @@
 #include "config.h"
 #include "EventDispatcher.h"
 
+#include "ComposedShadowTreeWalker.h"
+#include "ElementShadow.h"
 #include "EventContext.h"
 #include "EventDispatchMediator.h"
 #include "FrameView.h"
 #include "HTMLMediaElement.h"
+#include "InsertionPoint.h"
 #include "InspectorInstrumentation.h"
 #include "MouseEvent.h"
 #include "ScopedEventQueue.h"
@@ -47,6 +50,63 @@ namespace WebCore {
 
 static HashSet<Node*>* gNodesDispatchingSimulatedClicks = 0;
 
+EventRelatedTargetAdjuster::EventRelatedTargetAdjuster(PassRefPtr<Node> node, PassRefPtr<Node> relatedTarget)
+    : m_node(node)
+    , m_relatedTarget(relatedTarget)
+{
+    ASSERT(m_node);
+    ASSERT(m_relatedTarget);
+}
+
+void EventRelatedTargetAdjuster::adjust(Vector<EventContext>& ancestors)
+{
+    TreeScope* lastTreeScope = 0;
+    for (ComposedShadowTreeWalker walker(m_relatedTarget.get()); walker.get(); walker.parentIncludingInsertionPointAndShadowRoot()) {
+        TreeScope* scope = walker.get()->treeScope();
+        // Skips adding a node to the map if treeScope does not change.
+        if (scope != lastTreeScope)
+            m_relatedTargetMap.add(scope, walker.get());
+        lastTreeScope = scope;
+    }
+
+    lastTreeScope = 0;
+    EventTarget* adjustedRelatedTarget = 0;
+    for (Vector<EventContext>::iterator iter = ancestors.begin(); iter < ancestors.end(); ++iter) {
+        TreeScope* scope = iter->node()->treeScope();
+        if (scope == lastTreeScope) {
+            // Re-use the previous adjustedRelatedTarget if treeScope does not change.
+            iter->setRelatedTarget(adjustedRelatedTarget);
+        } else {
+            adjustedRelatedTarget = findRelatedTarget(scope);
+            iter->setRelatedTarget(adjustedRelatedTarget);
+        }
+        lastTreeScope = scope;
+        if (iter->target() == adjustedRelatedTarget) {
+            // Event dispatching should be stopped here.
+            ancestors.shrink(iter - ancestors.begin());
+            break;
+        }
+    }
+}
+
+EventTarget* EventRelatedTargetAdjuster::findRelatedTarget(TreeScope* scope)
+{
+    Vector<TreeScope*> parentTreeScopes;
+    EventTarget* relatedTarget = 0;
+    while (scope) {
+        parentTreeScopes.append(scope);
+        RelatedTargetMap::const_iterator found = m_relatedTargetMap.find(scope);
+        if (found != m_relatedTargetMap.end()) {
+            relatedTarget = found->second;
+            break;
+        }
+        scope = scope->parentTreeScope();
+    }
+    for (Vector<TreeScope*>::iterator iter = parentTreeScopes.begin(); iter < parentTreeScopes.end(); ++iter)
+      m_relatedTargetMap.add(*iter, relatedTarget);
+    return relatedTarget;
+}
+
 bool EventDispatcher::dispatchEvent(Node* node, PassRefPtr<EventDispatchMediator> mediator)
 {
     ASSERT(!eventDispatchForbidden());
@@ -116,104 +176,18 @@ void EventDispatcher::dispatchSimulatedClick(Node* node, PassRefPtr<Event> under
     gNodesDispatchingSimulatedClicks->remove(node);
 }
 
-PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Node> relatedTarget, const Vector<Node*> relatedTargetAncestors)
-{
-    Vector<EventContext>::const_iterator lowestCommonBoundary = m_ancestors.end();
-    // Assume divergent boundary is the relatedTarget itself (in other words, related target ancestor chain does not cross any shadow DOM boundaries).
-    Vector<Node*>::const_iterator firstDivergentBoundary = relatedTargetAncestors.begin();
-
-    Vector<EventContext>::const_iterator targetAncestor = m_ancestors.end();
-    // Walk down from the top, looking for lowest common ancestor, also monitoring shadow DOM boundaries.
-    bool diverged = false;
-    for (Vector<Node*>::const_iterator i = relatedTargetAncestors.end() - 1; i >= relatedTargetAncestors.begin(); --i) {
-        if (diverged) {
-            if ((*i)->isShadowRoot()) {
-                firstDivergentBoundary = i + 1;
-                break;
-            }
-            continue;
-        }
-
-        if (targetAncestor == m_ancestors.begin()) {
-            diverged = true;
-            continue;
-        }
-
-        targetAncestor--;
-
-        if ((*i)->isShadowRoot())
-            lowestCommonBoundary = targetAncestor;
-
-        if ((*i) != (*targetAncestor).node())
-            diverged = true;
-    }
-
-    if (!diverged) {
-        // The relatedTarget is an ancestor or shadowHost of the target.
-        // FIXME: Remove the first check once conversion to new shadow DOM is complete <http://webkit.org/b/48698>
-        if (m_node->shadowHost() == relatedTarget.get() || isShadowHost(relatedTarget.get())) {
-            Vector<EventContext>::const_iterator relatedTargetChild = targetAncestor - 1;
-            if (relatedTargetChild >= m_ancestors.begin() && relatedTargetChild->node()->isShadowRoot())
-                lowestCommonBoundary = relatedTargetChild;
-        }
-    } else if ((*firstDivergentBoundary) == m_node.get()) {
-        // Since ancestors does not contain target itself, we must account
-        // for the possibility that target is a shadowHost of relatedTarget
-        // and thus serves as the lowestCommonBoundary.
-        // Luckily, in this case the firstDivergentBoundary is target.
-        lowestCommonBoundary = m_ancestors.begin();
-        m_shouldPreventDispatch = true;
-    }
-
-    if (lowestCommonBoundary != m_ancestors.end()) {
-        // Trim ancestors to lowestCommonBoundary to keep events inside of the common shadow DOM subtree.
-        m_ancestors.shrink(lowestCommonBoundary - m_ancestors.begin());
-    }
-    // Set event's related target to the first encountered shadow DOM boundary in the divergent subtree.
-    return firstDivergentBoundary != relatedTargetAncestors.begin() ? *firstDivergentBoundary : relatedTarget;
-}
-
-inline static bool ancestorsCrossShadowBoundaries(const Vector<EventContext>& ancestors)
-{
-    return ancestors.isEmpty() || ancestors.first().node() == ancestors.last().node();
-}
 
-// FIXME: Once https://bugs.webkit.org/show_bug.cgi?id=52963 lands, this should
-// be greatly improved. See https://bugs.webkit.org/show_bug.cgi?id=54025.
-PassRefPtr<EventTarget> EventDispatcher::adjustRelatedTarget(Event* event, PassRefPtr<EventTarget> prpRelatedTarget)
+void EventDispatcher::adjustRelatedTarget(Event* event, PassRefPtr<EventTarget> prpRelatedTarget)
 {
     if (!prpRelatedTarget)
-        return 0;
-
+        return;
     RefPtr<Node> relatedTarget = prpRelatedTarget->toNode();
     if (!relatedTarget)
-        return 0;
-
-    Node* target = m_node.get();
-    if (!target)
-        return prpRelatedTarget;
-
+        return;
+    if (!m_node.get())
+        return;
     ensureEventAncestors(event);
-
-    // Calculate early if the common boundary is even possible by looking at
-    // ancestors size and if the retargeting has occured (indicating the presence of shadow DOM boundaries).
-    // If there are no boundaries detected, the target and related target can't have a common boundary.
-    bool noCommonBoundary = ancestorsCrossShadowBoundaries(m_ancestors);
-
-    Vector<Node*> relatedTargetAncestors;
-    Node* outermostShadowBoundary = relatedTarget.get();
-    for (Node* n = outermostShadowBoundary; n; n = n->parentOrHostNode()) {
-        if (n->isShadowRoot())
-            outermostShadowBoundary = n->parentOrHostNode();
-        if (!noCommonBoundary)
-            relatedTargetAncestors.append(n);
-    }
-
-    // Short-circuit the fast case when we know there is no need to calculate a common boundary.
-    if (noCommonBoundary)
-        return outermostShadowBoundary;
-
-    return adjustToShadowBoundaries(relatedTarget.release(), relatedTargetAncestors);
+    EventRelatedTargetAdjuster(m_node, relatedTarget.release()).adjust(m_ancestors);
 }
 
 EventDispatcher::EventDispatcher(Node* node)
@@ -227,30 +201,39 @@ EventDispatcher::EventDispatcher(Node* node)
 
 void EventDispatcher::ensureEventAncestors(Event* event)
 {
-    if (!m_node->inDocument())
-        return;
-
     if (m_ancestorsInitialized)
         return;
 
+    ComposedShadowTreeWalker ancestorWalker(m_node.get());
+    EventTarget* originalTarget = eventTargetRespectingSVGTargetRules(ancestorWalker.get());
+    m_ancestors.append(EventContext(m_node.get(), originalTarget, originalTarget));
     m_ancestorsInitialized = true;
 
-    Node* ancestor = m_node.get();
-    EventTarget* target = eventTargetRespectingSVGTargetRules(ancestor);
+    if (!m_node->inDocument())
+        return;
+
+    Vector<EventTarget*> targetStack;
+    targetStack.append(originalTarget);
     while (true) {
-        if (ancestor->isShadowRoot()) {
-            if (determineDispatchBehavior(event, ancestor) == StayInsideShadowDOM)
+        if (ancestorWalker.get()->isShadowRoot()) {
+            if (determineDispatchBehavior(event, ancestorWalker.get()) == StayInsideShadowDOM)
                 return;
-            ancestor = ancestor->shadowHost();
-            if (!m_node->isSVGElement())
-                target = ancestor;
-        } else
-            ancestor = ancestor->parentNodeGuaranteedHostFree();
-
-        if (!ancestor)
-            return;
-
-        m_ancestors.append(EventContext(ancestor, eventTargetRespectingSVGTargetRules(ancestor), target));
+            ancestorWalker.parentIncludingInsertionPointAndShadowRoot();
+            if (!ancestorWalker.get())
+                return;
+            if (!m_node->isSVGElement()) {
+                targetStack.removeLast();
+                if (targetStack.isEmpty())
+                    targetStack.append(ancestorWalker.get());
+            }
+        } else {
+            ancestorWalker.parentIncludingInsertionPointAndShadowRoot();
+            if (!ancestorWalker.get())
+                return;
+            if (isInsertionPoint(ancestorWalker.get()) && toInsertionPoint(ancestorWalker.get())->isActive())
+                targetStack.append(ancestorWalker.get());
+        }
+        m_ancestors.append(EventContext(ancestorWalker.get(), eventTargetRespectingSVGTargetRules(ancestorWalker.get()), targetStack.last()));
     }
 }
 
@@ -271,7 +254,7 @@ bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
 
     // Give the target node a chance to do some work before DOM event handlers get a crack.
     void* data = m_node->preDispatchEventHandler(event.get());
-    if (m_shouldPreventDispatch || event->propagationStopped())
+    if (m_ancestors.isEmpty() || m_shouldPreventDispatch || event->propagationStopped())
         goto doneDispatching;
 
     // Trigger capturing event handlers, starting at the top and working our way down.
@@ -280,8 +263,8 @@ bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
     if (windowContext.handleLocalEvents(event.get()) && event->propagationStopped())
         goto doneDispatching;
 
-    for (size_t i = m_ancestors.size(); i; --i) {
-        const EventContext& eventContext = m_ancestors[i-1];
+    for (size_t i = m_ancestors.size() - 1; i > 0; --i) {
+        const EventContext& eventContext = m_ancestors[i];
         if (eventContext.currentTargetSameAsTarget()) {
             if (event->bubbles())
                 continue;
@@ -296,7 +279,7 @@ bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
     event->setEventPhase(Event::AT_TARGET);
     event->setTarget(originalTarget.get());
     event->setCurrentTarget(eventTargetRespectingSVGTargetRules(m_node.get()));
-    m_node->handleLocalEvents(event.get());
+    m_ancestors[0].handleLocalEvents(event.get());
     if (event->propagationStopped())
         goto doneDispatching;
 
@@ -305,7 +288,7 @@ bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
         event->setEventPhase(Event::BUBBLING_PHASE);
 
         size_t size = m_ancestors.size();
-        for (size_t i = 0; i < size; ++i) {
+        for (size_t i = 1; i < size; ++i) {
             const EventContext& eventContext = m_ancestors[i];
             if (eventContext.currentTargetSameAsTarget())
                 event->setEventPhase(Event::AT_TARGET);
@@ -339,7 +322,7 @@ doneDispatching:
         // same order as the bubbling phase.
         if (event->bubbles()) {
             size_t size = m_ancestors.size();
-            for (size_t i = 0; i < size; ++i) {
+            for (size_t i = 1; i < size; ++i) {
                 m_ancestors[i].node()->defaultEventHandler(event.get());
                 ASSERT(!event->defaultPrevented());
                 if (event->defaultHandled())
@@ -379,11 +362,6 @@ EventDispatchBehavior EventDispatcher::determineDispatchBehavior(Event* event, N
     UNUSED_PARAM(shadowRoot);
 #endif
 
-    // Per XBL 2.0 spec, mutation events should never cross shadow DOM boundary:
-    // http://dev.w3.org/2006/xbl2/#event-flow-and-targeting-across-shadow-s
-    if (event->hasInterface(eventNames().interfaceForMutationEvent))
-        return StayInsideShadowDOM;
-
     // WebKit never allowed selectstart event to cross the the shadow DOM boundary.
     // Changing this breaks existing sites.
     // See https://bugs.webkit.org/show_bug.cgi?id=52195 for details.
diff --git a/Source/WebCore/dom/EventDispatcher.h b/Source/WebCore/dom/EventDispatcher.h
index 85aefc493..6f891c134 100644
--- a/Source/WebCore/dom/EventDispatcher.h
+++ b/Source/WebCore/dom/EventDispatcher.h
@@ -27,6 +27,7 @@
 #define EventDispatcher_h
 
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -40,12 +41,26 @@ class Node;
 class PlatformKeyboardEvent;
 class PlatformMouseEvent;
 class PlatformWheelEvent;
+class TreeScope;
 
 enum EventDispatchBehavior {
     RetargetEvent,
     StayInsideShadowDOM
 };
 
+class EventRelatedTargetAdjuster {
+public:
+    EventRelatedTargetAdjuster(PassRefPtr<Node>, PassRefPtr<Node> relatedTarget);
+    void adjust(Vector<EventContext>&);
+private:
+    typedef HashMap<TreeScope*, EventTarget*> RelatedTargetMap;
+    EventTarget* findRelatedTarget(TreeScope*);
+
+    RefPtr<Node> m_node;
+    RefPtr<Node> m_relatedTarget;
+    RelatedTargetMap m_relatedTargetMap;
+};
+
 class EventDispatcher {
 public:
     static bool dispatchEvent(Node*, PassRefPtr<EventDispatchMediator>);
@@ -54,13 +69,12 @@ public:
     static void dispatchSimulatedClick(Node*, PassRefPtr<Event> underlyingEvent, bool sendMouseEvents, bool showPressedLook);
 
     bool dispatchEvent(PassRefPtr<Event>);
-    PassRefPtr<EventTarget> adjustRelatedTarget(Event*, PassRefPtr<EventTarget>);
+    void adjustRelatedTarget(Event*, PassRefPtr<EventTarget> prpRelatedTarget);
     Node* node() const;
 
 private:
     EventDispatcher(Node*);
 
-    PassRefPtr<EventTarget> adjustToShadowBoundaries(PassRefPtr<Node> relatedTarget, const Vector<Node*> relatedTargetAncestors);
     EventDispatchBehavior determineDispatchBehavior(Event*, Node* shadowRoot);
     void ensureEventAncestors(Event*);
     const EventContext* topEventContext();
diff --git a/Source/WebCore/dom/MouseEvent.cpp b/Source/WebCore/dom/MouseEvent.cpp
index c3689c6dd..cf2e2660a 100644
--- a/Source/WebCore/dom/MouseEvent.cpp
+++ b/Source/WebCore/dom/MouseEvent.cpp
@@ -201,8 +201,8 @@ bool MouseEventDispatchMediator::dispatchEvent(EventDispatcher* dispatcher) cons
     if (event()->type().isEmpty())
         return false; // Shouldn't happen.
 
-    RefPtr<EventTarget> relatedTarget = dispatcher->adjustRelatedTarget(event(), event()->relatedTarget());
-    event()->setRelatedTarget(relatedTarget);
+    EventTarget* relatedTarget = event()->relatedTarget();
+    dispatcher->adjustRelatedTarget(event(), relatedTarget);
 
     dispatcher->dispatchEvent(event());
     bool swallowEvent = event()->defaultHandled() || event()->defaultPrevented();
diff --git a/Source/WebCore/dom/MouseEvent.h b/Source/WebCore/dom/MouseEvent.h
index 1fe6f9020..576b57379 100644
--- a/Source/WebCore/dom/MouseEvent.h
+++ b/Source/WebCore/dom/MouseEvent.h
@@ -121,6 +121,12 @@ private:
     virtual bool dispatchEvent(EventDispatcher*) const;
 };
 
+inline MouseEvent* toMouseEvent(Event* event)
+{
+    ASSERT(event && event->isMouseEvent());
+    return static_cast<MouseEvent*>(event);
+}
+
 } // namespace WebCore
 
 #endif // MouseEvent_h
diff --git a/Source/WebCore/dom/MouseRelatedEvent.cpp b/Source/WebCore/dom/MouseRelatedEvent.cpp
index caee58fe7..8df33cae3 100644
--- a/Source/WebCore/dom/MouseRelatedEvent.cpp
+++ b/Source/WebCore/dom/MouseRelatedEvent.cpp
@@ -196,7 +196,6 @@ void MouseRelatedEvent::computeRelativePosition()
 
 int MouseRelatedEvent::layerX()
 {
-    warnDeprecatedLayerXYUsage();
     if (!m_hasCachedRelativePosition)
         computeRelativePosition();
     return m_layerLocation.x();
@@ -204,7 +203,6 @@ int MouseRelatedEvent::layerX()
 
 int MouseRelatedEvent::layerY()
 {
-    warnDeprecatedLayerXYUsage();
     if (!m_hasCachedRelativePosition)
         computeRelativePosition();
     return m_layerLocation.y();
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 94b29d262..0daf079c1 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -112,11 +112,6 @@
 #include "InspectorController.h"
 #endif
 
-#if ENABLE(SVG)
-#include "SVGElementInstance.h"
-#include "SVGUseElement.h"
-#endif
-
 #if USE(JSC)
 #include <runtime/JSGlobalData.h>
 #endif
@@ -732,7 +727,7 @@ void Node::inspect()
 
 bool Node::rendererIsEditable(EditableLevel editableLevel) const
 {
-    if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable() && !shadowTreeRootNode())
+    if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable() && !shadowRoot())
         return true;
 
     // Ideally we'd call ASSERT(!needsStyleRecalc()) here, but
@@ -981,7 +976,7 @@ void Node::unregisterDynamicSubtreeNodeList(DynamicSubtreeNodeList* list)
     removeNodeListCacheIfPossible(this, data);
 }
 
-void Node::invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName& attrName)
+void Node::invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName& attrName, Element* attributeOwnerElement)
 {
     if (hasRareData() && isAttributeNode()) {
         NodeRareData* data = rareData();
@@ -989,18 +984,25 @@ void Node::invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName& at
         data->clearChildNodeListCache();
     }
 
-    // This list should be sync'ed with NodeListsNodeData.
+    // Modifications to attributes that are not associated with an Element can't invalidate NodeList caches.
+    if (!attributeOwnerElement)
+        return;
+
+    // FIXME: Move the list of attributes each NodeList type cares about to be a static on the
+    // appropriate NodeList class. Then use those lists here and in invalidateCachesThatDependOnAttributes
+    // to only invalidate the cache types that depend on the attribute that changed.
+    // FIXME: Keep track of when we have no caches of a given type so that we can avoid the for-loop
+    // below even if a related attribute changed (e.g. if we have no RadioNodeLists, we don't need
+    // to invalidate any caches when id attributes change.)
     if (attrName != classAttr
 #if ENABLE(MICRODATA)
         && attrName != itemscopeAttr
         && attrName != itempropAttr
         && attrName != itemtypeAttr
 #endif
-        && attrName != idAttr
-        && attrName != typeAttr
-        && attrName != checkedAttr
         && attrName != nameAttr
-        && attrName != forAttr)
+        && attrName != forAttr
+        && (attrName != idAttr || !attributeOwnerElement->isFormControlElement()))
         return;
 
     if (!treeScope()->hasNodeListCaches())
@@ -1092,33 +1094,26 @@ void Node::removeCachedChildNodeList()
     rareData()->setChildNodeList(0);
 }
 
-Node* Node::traverseNextNode(const Node* stayWithin) const
+Node* Node::traverseNextAncestorSibling() const
 {
-    if (firstChild())
-        return firstChild();
-    if (this == stayWithin)
-        return 0;
-    if (nextSibling())
-        return nextSibling();
-    const Node *n = this;
-    while (n && !n->nextSibling() && (!stayWithin || n->parentNode() != stayWithin))
-        n = n->parentNode();
-    if (n)
-        return n->nextSibling();
+    ASSERT(!nextSibling());
+    for (const Node* node = parentNode(); node; node = node->parentNode()) {
+        if (node->nextSibling())
+            return node->nextSibling();
+    }
     return 0;
 }
 
-Node* Node::traverseNextSibling(const Node* stayWithin) const
+Node* Node::traverseNextAncestorSibling(const Node* stayWithin) const
 {
-    if (this == stayWithin)
-        return 0;
-    if (nextSibling())
-        return nextSibling();
-    const Node *n = this;
-    while (n && !n->nextSibling() && (!stayWithin || n->parentNode() != stayWithin))
-        n = n->parentNode();
-    if (n)
-        return n->nextSibling();
+    ASSERT(!nextSibling());
+    ASSERT(this != stayWithin);
+    for (const Node* node = parentNode(); node; node = node->parentNode()) {
+        if (node == stayWithin)
+            return 0;
+        if (node->nextSibling())
+            return node->nextSibling();
+    }
     return 0;
 }
 
@@ -1346,8 +1341,22 @@ void Node::attach()
     clearNeedsStyleRecalc();
 }
 
+#ifndef NDEBUG
+static Node* detachingNode;
+
+bool Node::inDetach() const
+{
+    return detachingNode == this;
+}
+#endif
+
 void Node::detach()
 {
+#ifndef NDEBUG
+    ASSERT(!detachingNode);
+    detachingNode = this;
+#endif
+
     if (renderer())
         renderer()->destroyAndCleanupAnonymousWrappers();
     setRenderer(0);
@@ -1362,6 +1371,10 @@ void Node::detach()
     clearFlag(IsHoveredFlag);
     clearFlag(InActiveChainFlag);
     clearFlag(IsAttachedFlag);
+
+#ifndef NDEBUG
+    detachingNode = 0;
+#endif
 }
 
 // FIXME: This code is used by editing.  Seems like it could move over there and not pollute Node.
@@ -1489,18 +1502,18 @@ Node* Node::shadowAncestorNode() const
         return const_cast<Node*>(this);
 #endif
 
-    Node* root = shadowTreeRootNode();
-    if (root)
-        return root->shadowHost();
+    if (ShadowRoot* root = shadowRoot())
+        return root->host();
+
     return const_cast<Node*>(this);
 }
 
-Node* Node::shadowTreeRootNode() const
+ShadowRoot* Node::shadowRoot() const
 {
     Node* root = const_cast<Node*>(this);
     while (root) {
         if (root->isShadowRoot())
-            return root;
+            return toShadowRoot(root);
         root = root->parentNodeGuaranteedHostFree();
     }
     return 0;
@@ -1574,6 +1587,12 @@ Element *Node::enclosingBlockFlowElement() const
     return 0;
 }
 
+bool Node::isRootEditableElement() const
+{
+    return rendererIsEditable() && isElementNode() && (!parentNode() || !parentNode()->rendererIsEditable()
+        || !parentNode()->isElementNode() || hasTagName(bodyTag));
+}
+
 Element* Node::rootEditableElement(EditableType editableType) const
 {
     if (editableType == HasEditableAXRole)
@@ -2210,6 +2229,57 @@ void Node::showTreeForThis() const
     showTreeAndMark(this, "*");
 }
 
+void Node::showNodePathForThis() const
+{
+    Vector<const Node*, 16> chain;
+    const Node* node = this;
+    while (node->parentOrHostNode()) {
+        chain.append(node);
+        node = node->parentOrHostNode();
+    }
+    for (unsigned index = chain.size(); index > 0; --index) {
+        const Node* node = chain[index - 1];
+        if (node->isShadowRoot()) {
+            int count = 0;
+            for (ShadowRoot* shadowRoot = oldestShadowRootFor(node); shadowRoot && shadowRoot != node; shadowRoot = shadowRoot->youngerShadowRoot())
+                ++count;
+            fprintf(stderr, "/#shadow-root[%d]", count);
+            continue;
+        }
+
+        switch (node->nodeType()) {
+        case ELEMENT_NODE: {
+            fprintf(stderr, "/%s", node->nodeName().utf8().data());
+
+            const Element* element = toElement(node);
+            const AtomicString& idattr = element->getIdAttribute();
+            bool hasIdAttr = !idattr.isNull() && !idattr.isEmpty();
+            if (node->previousSibling() || node->nextSibling()) {
+                int count = 0;
+                for (Node* previous = node->previousSibling(); previous; previous = previous->previousSibling())
+                    if (previous->nodeName() == node->nodeName())
+                        ++count;
+                if (hasIdAttr)
+                    fprintf(stderr, "[@id=\"%s\" and position()=%d]", idattr.string().utf8().data(), count);
+                else
+                    fprintf(stderr, "[%d]", count);
+            } else if (hasIdAttr)
+                fprintf(stderr, "[@id=\"%s\"]", idattr.string().utf8().data());
+            break;
+        }
+        case TEXT_NODE:
+            fprintf(stderr, "/text()");
+            break;
+        case ATTRIBUTE_NODE:
+            fprintf(stderr, "/@%s", node->nodeName().utf8().data());
+            break;
+        default:
+            break;
+        }
+    }
+    fprintf(stderr, "\n");
+}
+
 static void traverseTreeAndMark(const String& baseIndent, const Node* rootNode, const Node* markedNode1, const char* markedLabel1, const Node* markedNode2, const char* markedLabel2)
 {
     for (const Node* node = rootNode; node; node = node->traverseNextNode()) {
@@ -2426,26 +2496,6 @@ void Node::didMoveToNewDocument(Document* oldDocument)
 #endif
 }
 
-#if ENABLE(SVG)
-static inline HashSet<SVGElementInstance*> instancesForSVGElement(Node* node)
-{
-    HashSet<SVGElementInstance*> instances;
- 
-    ASSERT(node);
-    if (!node->isSVGElement() || node->shadowTreeRootNode())
-        return HashSet<SVGElementInstance*>();
-
-    SVGElement* element = static_cast<SVGElement*>(node);
-    if (!element->isStyled())
-        return HashSet<SVGElementInstance*>();
-
-    SVGStyledElement* styledElement = static_cast<SVGStyledElement*>(element);
-    ASSERT(!styledElement->instanceUpdatesBlocked());
-
-    return styledElement->instancesForElement();
-}
-#endif
-
 static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
     if (!targetNode->EventTarget::addEventListener(eventType, listener, useCapture))
@@ -2458,42 +2508,13 @@ static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eve
         else if (eventNames().isTouchEventType(eventType))
             document->didAddTouchEventHandler();
     }
-        
+
     return true;
 }
 
 bool Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-#if !ENABLE(SVG)
     return tryAddEventListener(this, eventType, listener, useCapture);
-#else
-    if (!isSVGElement())
-        return tryAddEventListener(this, eventType, listener, useCapture);
-
-    HashSet<SVGElementInstance*> instances = instancesForSVGElement(this);
-    if (instances.isEmpty())
-        return tryAddEventListener(this, eventType, listener, useCapture);
-
-    RefPtr<EventListener> listenerForRegularTree = listener;
-    RefPtr<EventListener> listenerForShadowTree = listenerForRegularTree;
-
-    // Add event listener to regular DOM element
-    if (!tryAddEventListener(this, eventType, listenerForRegularTree.release(), useCapture))
-        return false;
-
-    // Add event listener to all shadow tree DOM element instances
-    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
-    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
-        ASSERT((*it)->shadowTreeElement());
-        ASSERT((*it)->correspondingElement() == this);
-
-        RefPtr<EventListener> listenerForCurrentShadowTreeElement = listenerForShadowTree;
-        bool result = tryAddEventListener((*it)->shadowTreeElement(), eventType, listenerForCurrentShadowTreeElement.release(), useCapture);
-        ASSERT_UNUSED(result, result);
-    }
-
-    return true;
-#endif
 }
 
 static inline bool tryRemoveEventListener(Node* targetNode, const AtomicString& eventType, EventListener* listener, bool useCapture)
@@ -2509,61 +2530,13 @@ static inline bool tryRemoveEventListener(Node* targetNode, const AtomicString&
         else if (eventNames().isTouchEventType(eventType))
             document->didRemoveTouchEventHandler();
     }
-    
+
     return true;
 }
 
 bool Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-#if !ENABLE(SVG)
     return tryRemoveEventListener(this, eventType, listener, useCapture);
-#else
-    if (!isSVGElement())
-        return tryRemoveEventListener(this, eventType, listener, useCapture);
-
-    HashSet<SVGElementInstance*> instances = instancesForSVGElement(this);
-    if (instances.isEmpty())
-        return tryRemoveEventListener(this, eventType, listener, useCapture);
-
-    // EventTarget::removeEventListener creates a PassRefPtr around the given EventListener
-    // object when creating a temporary RegisteredEventListener object used to look up the
-    // event listener in a cache. If we want to be able to call removeEventListener() multiple
-    // times on different nodes, we have to delay its immediate destruction, which would happen
-    // after the first call below.
-    RefPtr<EventListener> protector(listener);
-
-    // Remove event listener from regular DOM element
-    if (!tryRemoveEventListener(this, eventType, listener, useCapture))
-        return false;
-
-    // Remove event listener from all shadow tree DOM element instances
-    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
-    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
-        ASSERT((*it)->correspondingElement() == this);
-
-        SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
-        ASSERT(shadowTreeElement);
-
-        if (tryRemoveEventListener(shadowTreeElement, eventType, listener, useCapture))
-            continue;
-
-        // This case can only be hit for event listeners created from markup
-        ASSERT(listener->wasCreatedFromMarkup());
-
-        // If the event listener 'listener' has been created from markup and has been fired before
-        // then JSLazyEventListener::parseCode() has been called and m_jsFunction of that listener
-        // has been created (read: it's not 0 anymore). During shadow tree creation, the event
-        // listener DOM attribute has been cloned, and another event listener has been setup in
-        // the shadow tree. If that event listener has not been used yet, m_jsFunction is still 0,
-        // and tryRemoveEventListener() above will fail. Work around that very seldom problem.
-        EventTargetData* data = shadowTreeElement->eventTargetData();
-        ASSERT(data);
-
-        data->eventListenerMap.removeFirstEventListenerCreatedFromMarkup(eventType);
-    }
-
-    return true;
-#endif
 }
 
 EventTargetData* Node::eventTargetData()
@@ -3000,4 +2973,10 @@ void showTree(const WebCore::Node* node)
         node->showTreeForThis();
 }
 
+void showNodePath(const WebCore::Node* node)
+{
+    if (node)
+        node->showNodePathForThis();
+}
+
 #endif
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 875c82afa..d56e2ff2e 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -82,6 +82,7 @@ class RenderBox;
 class RenderBoxModelObject;
 class RenderObject;
 class RenderStyle;
+class ShadowRoot;
 class TagNodeList;
 class TreeScope;
 
@@ -213,15 +214,15 @@ public:
     bool isStyledElement() const { return getFlag(IsStyledElementFlag); }
     virtual bool isAttributeNode() const { return false; }
     virtual bool isCharacterDataNode() const { return false; }
+    virtual bool isFrameOwnerElement() const { return false; }
     bool isDocumentNode() const;
     bool isShadowRoot() const { return getFlag(IsShadowRootFlag); }
     bool inNamedFlow() const { return getFlag(InNamedFlowFlag); }
     bool hasAttrList() const { return getFlag(HasAttrListFlag); }
-    bool isFrameOwnerElement() const { return getFlag(IsFrameOwnerElementFlag); }
+    bool hasCustomCallbacks() const { return getFlag(HasCustomCallbacksFlag); }
 
     Node* shadowAncestorNode() const;
-    // Returns 0, a ShadowRoot, or a legacy shadow root.
-    Node* shadowTreeRootNode() const;
+    ShadowRoot* shadowRoot() const;
     // Returns 0, a child of ShadowRoot, or a legacy shadow root.
     Node* nonBoundaryShadowTreeRootNode();
     bool isInShadowTree() const;
@@ -271,7 +272,8 @@ public:
 
     // enclosingBlockFlowElement() is deprecated. Use enclosingBlock instead.
     Element* enclosingBlockFlowElement() const;
-    
+
+    bool isRootEditableElement() const;
     Element* rootEditableElement() const;
     Element* rootEditableElement(EditableType) const;
 
@@ -431,10 +433,12 @@ public:
     // This uses the same order that tags appear in the source file. If the stayWithin
     // argument is non-null, the traversal will stop once the specified node is reached.
     // This can be used to restrict traversal to a particular sub-tree.
-    Node* traverseNextNode(const Node* stayWithin = 0) const;
+    Node* traverseNextNode() const;
+    Node* traverseNextNode(const Node* stayWithin) const;
 
     // Like traverseNextNode, but skips children and starts with the next sibling.
-    Node* traverseNextSibling(const Node* stayWithin = 0) const;
+    Node* traverseNextSibling() const;
+    Node* traverseNextSibling(const Node* stayWithin) const;
 
     // Does a reverse pre-order traversal to find the node that comes before the current one in document order
     Node* traversePreviousNode(const Node* stayWithin = 0) const;
@@ -493,6 +497,10 @@ public:
     // the node's rendering object from the rendering tree and delete it.
     virtual void detach();
 
+#ifndef NDEBUG
+    bool inDetach() const;
+#endif
+
     void reattach();
     void reattachIfAttached();
     void createRendererIfNeeded();
@@ -543,13 +551,14 @@ public:
 
     void showNode(const char* prefix = "") const;
     void showTreeForThis() const;
+    void showNodePathForThis() const;
     void showTreeAndMark(const Node* markedNode1, const char* markedLabel1, const Node* markedNode2 = 0, const char* markedLabel2 = 0) const;
     void showTreeForThisAcrossFrame() const;
 #endif
 
     void registerDynamicSubtreeNodeList(DynamicSubtreeNodeList*);
     void unregisterDynamicSubtreeNodeList(DynamicSubtreeNodeList*);
-    void invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName&);
+    void invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName&, Element* attributeOwnerElement);
     void invalidateNodeListsCacheAfterChildrenChanged();
     void removeCachedClassNodeList(ClassNodeList*, const String&);
 
@@ -679,24 +688,22 @@ private:
         StyleChangeMask = 1 << nodeStyleChangeShift | 1 << (nodeStyleChangeShift + 1),
 
         SelfOrAncestorHasDirAutoFlag = 1 << 22,
-        HasCustomWillOrDidRecalcStyleFlag = 1 << 23,
-        HasCustomStyleForRendererFlag = 1 << 24,
 
-        HasNameFlag = 1 << 25,
+        HasNameFlag = 1 << 23,
 
-        AttributeStyleDirtyFlag = 1 << 26,
+        AttributeStyleDirtyFlag = 1 << 24,
 
 #if ENABLE(SVG)
         DefaultNodeFlags = IsParsingChildrenFinishedFlag | IsStyleAttributeValidFlag | AreSVGAttributesValidFlag,
 #else
         DefaultNodeFlags = IsParsingChildrenFinishedFlag | IsStyleAttributeValidFlag,
 #endif
-        InNamedFlowFlag = 1 << 28,
-        HasAttrListFlag = 1 << 29,
-        IsFrameOwnerElementFlag = 1 << 30
+        InNamedFlowFlag = 1 << 26,
+        HasAttrListFlag = 1 << 27,
+        HasCustomCallbacksFlag = 1 << 28
     };
 
-    // 2 bits remaining
+    // 4 bits remaining
 
     bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; }
     void setFlag(bool f, NodeFlags mask) const { m_nodeFlags = (m_nodeFlags & ~mask) | (-(int32_t)f & mask); } 
@@ -712,7 +719,7 @@ protected:
         CreateShadowRoot = CreateContainer | IsShadowRootFlag,
         CreateStyledElement = CreateElement | IsStyledElementFlag, 
         CreateHTMLElement = CreateStyledElement | IsHTMLFlag, 
-        CreateFrameOwnerElement = CreateHTMLElement | IsFrameOwnerElementFlag,
+        CreateFrameOwnerElement = CreateHTMLElement | HasCustomCallbacksFlag,
         CreateSVGElement = CreateStyledElement | IsSVGFlag,
         CreateDocument = CreateContainer | InDocumentFlag
     };
@@ -730,12 +737,7 @@ protected:
     NodeRareData* ensureRareData();
     void clearRareData();
 
-    bool hasCustomWillOrDidRecalcStyle() const { return getFlag(HasCustomWillOrDidRecalcStyleFlag); }
-    void setHasCustomWillOrDidRecalcStyle() { setFlag(true, HasCustomWillOrDidRecalcStyleFlag); }
-    
-    bool hasCustomStyleForRenderer() const { return getFlag(HasCustomStyleForRendererFlag); }
-    void setHasCustomStyleForRenderer() { setFlag(true, HasCustomStyleForRendererFlag); }
-    void clearHasCustomStyleForRenderer() { clearFlag(HasCustomStyleForRendererFlag); }
+    void setHasCustomCallbacks() { setFlag(true, HasCustomCallbacksFlag); }
 
 private:
     // These API should be only used for a tree scope migration.
@@ -767,6 +769,9 @@ private:
 
     Element* ancestorElement() const;
 
+    Node* traverseNextAncestorSibling() const;
+    Node* traverseNextAncestorSibling(const Node* stayWithin) const;
+
     // Use Node::parentNode as the consistent way of querying a parent node.
     // This method is made private to ensure a compiler error on call sites that
     // don't follow this rule.
@@ -786,15 +791,17 @@ private:
     Node* m_next;
     RenderObject* m_renderer;
 
-protected:
-    bool isParsingChildrenFinished() const { return getFlag(IsParsingChildrenFinishedFlag); }
-    void setIsParsingChildrenFinished() { setFlag(IsParsingChildrenFinishedFlag); }
-    void clearIsParsingChildrenFinished() { clearFlag(IsParsingChildrenFinishedFlag); }
+public:
     bool isStyleAttributeValid() const { return getFlag(IsStyleAttributeValidFlag); }
     void setIsStyleAttributeValid(bool f) { setFlag(f, IsStyleAttributeValidFlag); }
     void setIsStyleAttributeValid() const { setFlag(IsStyleAttributeValidFlag); }
     void clearIsStyleAttributeValid() { clearFlag(IsStyleAttributeValidFlag); }
 
+protected:
+    bool isParsingChildrenFinished() const { return getFlag(IsParsingChildrenFinishedFlag); }
+    void setIsParsingChildrenFinished() { setFlag(IsParsingChildrenFinishedFlag); }
+    void clearIsParsingChildrenFinished() { clearFlag(IsParsingChildrenFinishedFlag); }
+
 #if ENABLE(SVG)
     bool areSVGAttributesValid() const { return getFlag(AreSVGAttributesValidFlag); }
     void setAreSVGAttributesValid() const { setFlag(AreSVGAttributesValidFlag); }
@@ -855,6 +862,7 @@ inline void Node::reattachIfAttached()
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 void showTree(const WebCore::Node*);
+void showNodePath(const WebCore::Node*);
 #endif
 
 #endif
diff --git a/Source/WebCore/dom/NodeRenderingContext.cpp b/Source/WebCore/dom/NodeRenderingContext.cpp
index 5898419a6..c679bc8c4 100644
--- a/Source/WebCore/dom/NodeRenderingContext.cpp
+++ b/Source/WebCore/dom/NodeRenderingContext.cpp
@@ -27,10 +27,10 @@
 #include "NodeRenderingContext.h"
 
 #include "ContainerNode.h"
+#include "ContentDistributor.h"
 #include "ElementShadow.h"
 #include "FlowThreadController.h"
 #include "HTMLContentElement.h"
-#include "HTMLContentSelector.h"
 #include "HTMLNames.h"
 #include "HTMLShadowElement.h"
 #include "Node.h"
@@ -78,7 +78,7 @@ NodeRenderingContext::NodeRenderingContext(Node* node)
 
         if (m_visualParentShadow) {
             if ((m_insertionPoint = m_visualParentShadow->insertionPointFor(m_node))) {
-                if (toShadowRoot(m_insertionPoint->shadowTreeRootNode())->isUsedForRendering()) {
+                if (m_insertionPoint->shadowRoot()->isUsedForRendering()) {
                     m_phase = AttachingDistributed;
                     m_parentNodeForRenderingAndStyle = NodeRenderingContext(m_insertionPoint).parentNodeForRenderingAndStyle();
                     return;
@@ -91,13 +91,13 @@ NodeRenderingContext::NodeRenderingContext(Node* node)
         }
 
         if (isShadowBoundary(parent)) {
-            if (!toShadowRoot(parent->shadowTreeRootNode())->isUsedForRendering()) {
+            if (!parent->shadowRoot()->isUsedForRendering()) {
                 m_phase = AttachingNotDistributed;
                 m_parentNodeForRenderingAndStyle = parent;
                 return;
             }
 
-            if (toInsertionPoint(parent)->hasSelection())
+            if (toInsertionPoint(parent)->hasDistribution())
                 m_phase = AttachingNotFallbacked;
             else
                 m_phase = AttachingFallbacked;
@@ -142,12 +142,12 @@ PassRefPtr<RenderStyle> NodeRenderingContext::releaseStyle()
 
 static inline RenderObject* nextRendererOfInsertionPoint(InsertionPoint* parent, Node* current)
 {
-    HTMLContentSelection* currentSelection = parent->selections()->find(current);
-    if (!currentSelection)
+    size_t start = parent->indexOf(current);
+    if (notFound == start)
         return 0;
 
-    for (HTMLContentSelection* selection = currentSelection->next(); selection; selection = selection->next()) {
-        if (RenderObject* renderer = selection->node()->renderer())
+    for (size_t i = start + 1; i < parent->size(); ++i) {
+        if (RenderObject* renderer = parent->at(i)->renderer())
             return renderer;
     }
 
@@ -158,10 +158,10 @@ static inline RenderObject* previousRendererOfInsertionPoint(InsertionPoint* par
 {
     RenderObject* lastRenderer = 0;
 
-    for (HTMLContentSelection* selection = parent->selections()->first(); selection; selection = selection->next()) {
-        if (selection->node() == current)
+    for (size_t i = 0; i < parent->size(); ++i) {
+        if (parent->at(i) == current)
             break;
-        if (RenderObject* renderer = selection->node()->renderer())
+        if (RenderObject* renderer = parent->at(i)->renderer())
             lastRenderer = renderer;
     }
 
@@ -170,13 +170,10 @@ static inline RenderObject* previousRendererOfInsertionPoint(InsertionPoint* par
 
 static inline RenderObject* firstRendererOfInsertionPoint(InsertionPoint* parent)
 {
-    if (parent->hasSelection()) {
-        for (HTMLContentSelection* selection = parent->selections()->first(); selection; selection = selection->next()) {
-            if (RenderObject* renderer = selection->node()->renderer())
-                return renderer;
-        }
-
-        return 0;
+    size_t size = parent->size();
+    for (size_t i = 0; i < size; ++i) {
+        if (RenderObject* renderer = parent->at(i)->renderer())
+            return renderer;
     }
 
     return firstRendererOf(parent->firstChild());
@@ -184,13 +181,10 @@ static inline RenderObject* firstRendererOfInsertionPoint(InsertionPoint* parent
 
 static inline RenderObject* lastRendererOfInsertionPoint(InsertionPoint* parent)
 {
-    if (parent->hasSelection()) {
-        for (HTMLContentSelection* selection = parent->selections()->last(); selection; selection = selection->previous()) {
-            if (RenderObject* renderer = selection->node()->renderer())
-                return renderer;
-        }
-
-        return 0;
+    size_t size = parent->size();
+    for (size_t i = 0; i < size; ++i) {
+        if (RenderObject* renderer = parent->at(size - 1 - i)->renderer())
+            return renderer;
     }
 
     return lastRendererOf(parent->lastChild());
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index 38bd49657..61a7c1129 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -1651,9 +1651,9 @@ Node* Range::firstNode() const
     return m_start.container()->traverseNextSibling();
 }
 
-Node* Range::shadowTreeRootNode() const
+ShadowRoot* Range::shadowRoot() const
 {
-    return startContainer() ? startContainer()->shadowTreeRootNode() : 0;
+    return startContainer() ? startContainer()->shadowRoot() : 0;
 }
 
 Node* Range::pastLastNode() const
diff --git a/Source/WebCore/dom/Range.h b/Source/WebCore/dom/Range.h
index 8d69b14bb..9ac4c49bd 100644
--- a/Source/WebCore/dom/Range.h
+++ b/Source/WebCore/dom/Range.h
@@ -111,7 +111,7 @@ public:
     Node* firstNode() const;
     Node* pastLastNode() const;
 
-    Node* shadowTreeRootNode() const;
+    ShadowRoot* shadowRoot() const;
 
     IntRect boundingBox();
     
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 7b246c0b1..464beae48 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "ShadowRoot.h"
 
+#include "ContentDistributor.h"
 #include "DOMSelection.h"
 #include "DOMWindow.h"
 #include "Document.h"
@@ -34,7 +35,6 @@
 #include "Element.h"
 #include "ElementShadow.h"
 #include "HTMLContentElement.h"
-#include "HTMLContentSelector.h"
 #include "HTMLNames.h"
 #include "InsertionPoint.h"
 #include "NodeRareData.h"
@@ -149,13 +149,6 @@ void ShadowRoot::setInnerHTML(const String& markup, ExceptionCode& ec)
         replaceChildrenWithFragment(this, fragment.release(), ec);
 }
 
-DOMSelection* ShadowRoot::selection()
-{
-    if (document() && document()->domWindow())
-        return document()->domWindow()->getSelection();
-    return 0;
-}
-
 bool ShadowRoot::childTypeAllowed(NodeType type) const
 {
     switch (type) {
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index c0024c716..23867e73b 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -38,8 +38,6 @@ namespace WebCore {
 
 class Document;
 class DOMSelection;
-class HTMLContentElement;
-class HTMLContentSelector;
 class InsertionPoint;
 class ElementShadow;
 
@@ -60,9 +58,9 @@ public:
 
     void recalcShadowTreeStyle(StyleChange);
 
-    void setNeedsReattachHostChildrenAndShadow();
-    void clearNeedsReattachHostChildrenAndShadow();
-    bool needsReattachHostChildrenAndShadow();
+    void setNeedsRedistributing();
+    void clearNeedsRedistributing();
+    bool needsRedistributing();
 
     InsertionPoint* insertionPointFor(Node*) const;
     void hostChildrenChanged();
@@ -78,8 +76,6 @@ public:
 
     Element* activeElement() const;
 
-    DOMSelection* selection();
-
     ShadowRoot* youngerShadowRoot() const { return prev(); }
     ShadowRoot* olderShadowRoot() const { return next(); }
 
diff --git a/Source/WebCore/dom/ShadowRoot.idl b/Source/WebCore/dom/ShadowRoot.idl
index 55057b680..a93333bc1 100644
--- a/Source/WebCore/dom/ShadowRoot.idl
+++ b/Source/WebCore/dom/ShadowRoot.idl
@@ -34,12 +34,12 @@ module core {
     ] ShadowRoot : DocumentFragment {
         readonly attribute Element host;
         readonly attribute Element activeElement;
-        readonly attribute DOMSelection selection;
         attribute boolean applyAuthorStyles;
 
         attribute [TreatNullAs=NullString] DOMString innerHTML
             setter raises(DOMException);
 
+        DOMSelection getSelection();
         Element getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
         NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString className);
         NodeList getElementsByTagName(in [Optional=DefaultIsUndefined] DOMString tagName);
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index 007c3af0c..d55b00993 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -136,16 +136,16 @@ CSSStyleDeclaration* StyledElement::style()
     return ensureAttributeData()->ensureMutableInlineStyle(this)->ensureInlineCSSStyleDeclaration(this); 
 }
 
-void StyledElement::attributeChanged(Attribute* attr)
+void StyledElement::attributeChanged(const Attribute& attribute)
 {
-    parseAttribute(attr);
+    parseAttribute(attribute);
 
-    if (isPresentationAttribute(attr->name())) {
+    if (isPresentationAttribute(attribute.name())) {
         setAttributeStyleDirty();
         setNeedsStyleRecalc(InlineStyleChange);
     }
 
-    Element::attributeChanged(attr);
+    Element::attributeChanged(attribute);
 }
 
 void StyledElement::classAttributeChanged(const AtomicString& newClassString)
@@ -168,19 +168,25 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
     setNeedsStyleRecalc();
 }
 
-void StyledElement::parseAttribute(Attribute* attr)
+void StyledElement::styleAttributeChanged(const AtomicString& newStyleString, ShouldReparseStyleAttribute shouldReparse)
 {
-    if (attr->name() == classAttr)
-        classAttributeChanged(attr->value());
-    else if (attr->name() == styleAttr) {
-        if (attr->isNull())
+    if (shouldReparse) {
+        if (newStyleString.isNull())
             destroyInlineStyle();
         else if (document()->contentSecurityPolicy()->allowInlineStyle())
-            ensureAttributeData()->updateInlineStyleAvoidingMutation(this, attr->value());
+            ensureAttributeData()->updateInlineStyleAvoidingMutation(this, newStyleString);
         setIsStyleAttributeValid();
-        setNeedsStyleRecalc();
-        InspectorInstrumentation::didInvalidateStyleAttr(document(), this);
     }
+    setNeedsStyleRecalc();
+    InspectorInstrumentation::didInvalidateStyleAttr(document(), this);
+}
+
+void StyledElement::parseAttribute(const Attribute& attribute)
+{
+    if (attribute.name() == classAttr)
+        classAttributeChanged(attribute.value());
+    else if (attribute.name() == styleAttr)
+        styleAttributeChanged(attribute.value());
 }
 
 void StyledElement::inlineStyleChanged()
@@ -296,7 +302,7 @@ void StyledElement::updateAttributeStyle()
         unsigned size = attributeCount();
         for (unsigned i = 0; i < size; ++i) {
             Attribute* attribute = attributeItem(i);
-            collectStyleForAttribute(attribute, style.get());
+            collectStyleForAttribute(*attribute, style.get());
         }
     }
     clearAttributeStyleDirty();
diff --git a/Source/WebCore/dom/StyledElement.h b/Source/WebCore/dom/StyledElement.h
index 1cf2987a8..6cf4145f2 100644
--- a/Source/WebCore/dom/StyledElement.h
+++ b/Source/WebCore/dom/StyledElement.h
@@ -55,7 +55,11 @@ public:
 
     const SpaceSplitString& classNames() const;
 
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) { }
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) { }
+
+    // May be called by ElementAttributeData::cloneDataFrom().
+    enum ShouldReparseStyleAttribute { DoNotReparseStyleAttribute = 0, ReparseStyleAttribute = 1 };
+    void styleAttributeChanged(const AtomicString& newStyleString, ShouldReparseStyleAttribute = ReparseStyleAttribute);
 
 protected:
     StyledElement(const QualifiedName& name, Document* document, ConstructionType type)
@@ -63,9 +67,8 @@ protected:
     {
     }
 
-    virtual void attributeChanged(Attribute*) OVERRIDE;
-    virtual void parseAttribute(Attribute*);
-    virtual void copyNonAttributeProperties(const Element*);
+    virtual void attributeChanged(const Attribute&) OVERRIDE;
+    virtual void parseAttribute(const Attribute&);
 
     virtual bool isPresentationAttribute(const QualifiedName&) const { return false; }
 
diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
index 1bcabae57..f173fca3c 100644
--- a/Source/WebCore/dom/Text.cpp
+++ b/Source/WebCore/dom/Text.cpp
@@ -252,7 +252,7 @@ void Text::attach()
 
 void Text::recalcTextStyle(StyleChange change)
 {
-    if (hasCustomWillOrDidRecalcStyle())
+    if (hasCustomCallbacks())
         willRecalcTextStyle(change);
 
     if (change != NoChange && parentNode() && parentNode()->renderer()) {
@@ -292,6 +292,11 @@ PassRefPtr<Text> Text::createWithLengthLimit(Document* document, const String& d
     return result;
 }
 
+void Text::willRecalcTextStyle(StyleChange)
+{
+    ASSERT_NOT_REACHED();
+}
+
 #ifndef NDEBUG
 void Text::formatForDebugger(char *buffer, unsigned length) const
 {
diff --git a/Source/WebCore/dom/Text.h b/Source/WebCore/dom/Text.h
index deb18a5ea..daf382240 100644
--- a/Source/WebCore/dom/Text.h
+++ b/Source/WebCore/dom/Text.h
@@ -53,7 +53,7 @@ protected:
     {
     }
 
-    virtual void willRecalcTextStyle(StyleChange) { ASSERT_NOT_REACHED(); }
+    virtual void willRecalcTextStyle(StyleChange);
 
 private:
     virtual String nodeName() const;
diff --git a/Source/WebCore/dom/TreeScope.cpp b/Source/WebCore/dom/TreeScope.cpp
index 998264532..07409f066 100644
--- a/Source/WebCore/dom/TreeScope.cpp
+++ b/Source/WebCore/dom/TreeScope.cpp
@@ -27,6 +27,8 @@
 #include "TreeScope.h"
 
 #include "ContainerNode.h"
+#include "DOMSelection.h"
+#include "DOMWindow.h"
 #include "Document.h"
 #include "Element.h"
 #include "FocusController.h"
@@ -36,6 +38,7 @@
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
 #include "Page.h"
+#include "RuntimeEnabledFeatures.h"
 #include "TreeScopeAdopter.h"
 #include <wtf/text/AtomicString.h>
 #include <wtf/text/CString.h>
@@ -54,6 +57,10 @@ TreeScope::TreeScope(ContainerNode* rootNode)
 
 TreeScope::~TreeScope()
 {
+    if (m_selection) {
+        m_selection->clearTreeScope();
+        m_selection = 0;
+    }
 }
 
 void TreeScope::destroyTreeScopeData()
@@ -89,6 +96,19 @@ void TreeScope::removeElementById(const AtomicString& elementId, Element* elemen
     m_elementsById.remove(elementId.impl(), element);
 }
 
+Node* TreeScope::ancestorInThisScope(Node* node) const
+{
+    while (node) {
+        if (node->treeScope() == this)
+            return node;
+        if (!node->isInShadowTree())
+            return 0;
+        node = node->shadowAncestorNode();
+    }
+
+    return 0;
+}
+
 void TreeScope::addImageMap(HTMLMapElement* imageMap)
 {
     AtomicStringImpl* name = imageMap->getName().impl();
@@ -116,6 +136,31 @@ HTMLMapElement* TreeScope::getImageMap(const String& url) const
     return static_cast<HTMLMapElement*>(m_imageMapsByName.getElementByMapName(AtomicString(name).impl(), this));
 }
 
+DOMSelection* TreeScope::getSelection() const
+{
+    if (!rootNode()->document()->frame())
+        return 0;
+
+    if (m_selection)
+        return m_selection.get();
+
+    // FIXME: The correct selection in Shadow DOM requires that Position can have a ShadowRoot
+    // as a container. It is now enabled only if runtime Shadow DOM feature is enabled.
+    // See https://bugs.webkit.org/show_bug.cgi?id=82697
+#if ENABLE(SHADOW_DOM)
+    if (RuntimeEnabledFeatures::shadowDOMEnabled()) {
+        m_selection = DOMSelection::create(this);
+        return m_selection.get();
+    }
+#endif
+
+    if (this != rootNode()->document())
+        return rootNode()->document()->getSelection();
+
+    m_selection = DOMSelection::create(rootNode()->document());
+    return m_selection.get();
+}
+
 Element* TreeScope::findAnchor(const String& name)
 {
     if (name.isEmpty())
diff --git a/Source/WebCore/dom/TreeScope.h b/Source/WebCore/dom/TreeScope.h
index 76c12e5c9..e4c4ef3b2 100644
--- a/Source/WebCore/dom/TreeScope.h
+++ b/Source/WebCore/dom/TreeScope.h
@@ -33,6 +33,7 @@
 namespace WebCore {
 
 class ContainerNode;
+class DOMSelection;
 class Element;
 class HTMLMapElement;
 class Node;
@@ -54,6 +55,8 @@ public:
     void addElementById(const AtomicString& elementId, Element*);
     void removeElementById(const AtomicString& elementId, Element*);
 
+    Node* ancestorInThisScope(Node*) const;
+
     void addImageMap(HTMLMapElement*);
     void removeImageMap(HTMLMapElement*);
     HTMLMapElement* getImageMap(const String& url) const;
@@ -62,6 +65,8 @@ public:
     void removeNodeListCache() { ASSERT(m_numNodeListCaches > 0); --m_numNodeListCaches; }
     bool hasNodeListCaches() const { return m_numNodeListCaches; }
 
+    DOMSelection* getSelection() const;
+
     // Find first anchor with the given name.
     // First searches for an element with the given ID, but if that fails, then looks
     // for an anchor with the given name. ID matching is always case sensitive, but
@@ -90,6 +95,8 @@ private:
     DocumentOrderedMap m_imageMapsByName;
 
     unsigned m_numNodeListCaches;
+
+    mutable RefPtr<DOMSelection> m_selection;
 };
 
 inline bool TreeScope::hasElementWithId(AtomicStringImpl* id) const
diff --git a/Source/WebCore/dom/TreeScopeAdjuster.cpp b/Source/WebCore/dom/TreeScopeAdjuster.cpp
deleted file mode 100644
index 2982f13f3..000000000
--- a/Source/WebCore/dom/TreeScopeAdjuster.cpp
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "TreeScopeAdjuster.h"
-
-#include "Node.h"
-#include "TreeScope.h"
-
-namespace WebCore {
-
-TreeScopeAdjuster::TreeScopeAdjuster(TreeScope* treeScope)
-    : m_treeScope(treeScope)
-{
-}
-
-Node* TreeScopeAdjuster::ancestorInThisScope(Node* node)
-{
-    do {
-        if (node->treeScope() == treeScope())
-            return node;
-        if (!node->isInShadowTree())
-            return 0;
-    } while ((node = node->shadowAncestorNode()));
-
-    return 0;
-}
-
-Position TreeScopeAdjuster::adjustPositionBefore(const Position& currentPosition)
-{
-    if (Node* ancestor = ancestorInThisScope(currentPosition.anchorNode()))
-        return positionBeforeNode(ancestor);
-
-    if (Node* lastChild = treeScope()->rootNode()->lastChild())
-        return positionAfterNode(lastChild);
-
-    return Position();
-}
-
-Position TreeScopeAdjuster::adjustPositionAfter(const Position& currentPosition)
-{
-    if (Node* ancestor = ancestorInThisScope(currentPosition.anchorNode()))
-        return positionAfterNode(ancestor);
-
-    if (Node* firstChild = treeScope()->rootNode()->firstChild())
-        return positionBeforeNode(firstChild);
-
-    return Position();
-}
-
-} // namespace WebCore
-
diff --git a/Source/WebCore/dom/UIEvent.cpp b/Source/WebCore/dom/UIEvent.cpp
index ff3ff4afc..9e73316fb 100644
--- a/Source/WebCore/dom/UIEvent.cpp
+++ b/Source/WebCore/dom/UIEvent.cpp
@@ -78,13 +78,11 @@ int UIEvent::charCode() const
 
 int UIEvent::layerX()
 {
-    warnDeprecatedLayerXYUsage();
     return 0;
 }
 
 int UIEvent::layerY()
 {
-    warnDeprecatedLayerXYUsage();
     return 0;
 }
 
@@ -103,13 +101,6 @@ int UIEvent::which() const
     return 0;
 }
 
-void UIEvent::warnDeprecatedLayerXYUsage()
-{
-    DEFINE_STATIC_LOCAL(String, consoleMessage , ("event.layerX and event.layerY are broken and deprecated in WebKit. They will be removed from the engine in the near future."));
-    if (m_view)
-        m_view->console()->addMessage(JSMessageSource, LogMessageType, WarningMessageLevel, consoleMessage);
-}
-
 PassRefPtr<FocusInEventDispatchMediator> FocusInEventDispatchMediator::create(PassRefPtr<Event> event, PassRefPtr<Node> oldFocusedNode)
 {
     return adoptRef(new FocusInEventDispatchMediator(event, oldFocusedNode));
diff --git a/Source/WebCore/dom/UIEvent.h b/Source/WebCore/dom/UIEvent.h
index d1294c952..207eb7b04 100644
--- a/Source/WebCore/dom/UIEvent.h
+++ b/Source/WebCore/dom/UIEvent.h
@@ -67,9 +67,6 @@ namespace WebCore {
         UIEvent();
         UIEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>, int detail);
 
-        // layerX and layerY are deprecated. This reports a message to the console until we remove them.
-        void warnDeprecatedLayerXYUsage();
-
     private:
         RefPtr<AbstractView> m_view;
         int m_detail;
diff --git a/Source/WebCore/dom/make_names.pl b/Source/WebCore/dom/make_names.pl
index 8ab33d55e..a6dc623e9 100755
--- a/Source/WebCore/dom/make_names.pl
+++ b/Source/WebCore/dom/make_names.pl
@@ -1035,12 +1035,12 @@ END
         } elsif ($wrapperFactoryType eq "V8") {
             if ($enabledTags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
                 print F <<END
-static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate)
 {
     Settings* settings = element->document()->settings();
     if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
-        return V8$parameters{namespace}Element::wrap(element);
-    return toV8(static_cast<${JSInterfaceName}*>(element));
+        return V8$parameters{namespace}Element::wrap(element, isolate);
+    return toV8(static_cast<${JSInterfaceName}*>(element), isolate);
 }
 
 END
@@ -1048,28 +1048,28 @@ END
             } elsif ($enabledTags{$tagName}{runtimeConditional}) {
                 my $runtimeConditional = $enabledTags{$tagName}{runtimeConditional};
                 print F <<END
-static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate)
 {
     if (!RuntimeEnabledFeatures::${runtimeConditional}Enabled())
-        return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element));
-    return toV8(static_cast<${JSInterfaceName}*>(element));
+        return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element), isolate);
+    return toV8(static_cast<${JSInterfaceName}*>(element), isolate);
 }
 END
 ;
             } elsif (${JSInterfaceName} eq "HTMLElement") {
                 print F <<END
-static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate)
 {
-    return V8$parameters{namespace}Element::wrap(element);
+    return V8$parameters{namespace}Element::wrap(element, isolate);
 }
 
 END
 ;
              } else {
             print F <<END
-static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate)
 {
-    return toV8(static_cast<${JSInterfaceName}*>(element));
+    return toV8(static_cast<${JSInterfaceName}*>(element), isolate);
 }
 
 
@@ -1151,7 +1151,7 @@ END
 ;
     } elsif ($wrapperFactoryType eq "V8") {
         print F <<END
-typedef v8::Handle<v8::Value> (*Create$parameters{namespace}ElementWrapperFunction)($parameters{namespace}Element*);
+typedef v8::Handle<v8::Value> (*Create$parameters{namespace}ElementWrapperFunction)($parameters{namespace}Element*, v8::Isolate*);
 
 END
 ;
@@ -1170,7 +1170,7 @@ END
 ;
     } elsif ($wrapperFactoryType eq "V8") {
         print F <<END
-v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element* element, bool forceNewObject)
+v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element* element, v8::Isolate* isolate, bool forceNewObject)
 {
     typedef HashMap<WTF::AtomicStringImpl*, Create$parameters{namespace}ElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
@@ -1211,7 +1211,7 @@ END
 ;
     } elsif ($wrapperFactoryType eq "V8") {
         print F <<END
-        return createWrapperFunction(element);
+        return createWrapperFunction(element, isolate);
     return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element), 0, forceNewObject);
 END
 ;
@@ -1272,7 +1272,7 @@ namespace WebCore {
 
     class $parameters{namespace}Element;
 
-    v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element*, bool);
+    v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element*, v8::Isolate*, bool);
 }
 END
 ;
diff --git a/Source/WebCore/editing/ApplyBlockElementCommand.cpp b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
index 952dc097b..901cd1784 100644
--- a/Source/WebCore/editing/ApplyBlockElementCommand.cpp
+++ b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
@@ -80,9 +80,9 @@ void ApplyBlockElementCommand::doApply()
     VisiblePosition endOfSelection = selection.visibleEnd();
     ASSERT(!startOfSelection.isNull());
     ASSERT(!endOfSelection.isNull());
-    RefPtr<Element> startScope;
+    RefPtr<ContainerNode> startScope;
     int startIndex = indexForVisiblePosition(startOfSelection, startScope);
-    RefPtr<Element> endScope;
+    RefPtr<ContainerNode> endScope;
     int endIndex = indexForVisiblePosition(endOfSelection, endScope);
 
     formatSelection(startOfSelection, endOfSelection);
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index 72b8027dd..968f44d87 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -977,8 +977,8 @@ void ApplyStyleCommand::pushDownInlineStyleAroundNode(EditingStyle* style, Node*
     while (current != targetNode) {
         ASSERT(current);
         ASSERT(current->contains(targetNode));
-        Node* child = current->firstChild();
-        Node* lastChild = current->lastChild();
+        NodeVector currentChildren;
+        getChildNodes(current, currentChildren);
         RefPtr<StyledElement> styledElement;
         if (current->isStyledElement() && isStyledInlineElementToRemove(static_cast<Element*>(current))) {
             styledElement = static_cast<StyledElement*>(current);
@@ -991,9 +991,10 @@ void ApplyStyleCommand::pushDownInlineStyleAroundNode(EditingStyle* style, Node*
 
         // The inner loop will go through children on each level
         // FIXME: we should aggregate inline child elements together so that we don't wrap each child separately.
-        while (child) {
-            Node* nextChild = child->nextSibling();
-
+        for (size_t i = 0; i < currentChildren.size(); ++i) {
+            Node* child = currentChildren[i].get();
+            if (!child->parentNode())
+                continue;
             if (!child->contains(targetNode) && elementsToPushDown.size()) {
                 for (size_t i = 0; i < elementsToPushDown.size(); i++) {
                     RefPtr<Element> wrapper = elementsToPushDown[i]->cloneElementWithoutChildren();
@@ -1011,10 +1012,6 @@ void ApplyStyleCommand::pushDownInlineStyleAroundNode(EditingStyle* style, Node*
             // When reached targetNode, stop the outer loop upon the completion of the current inner loop
             if (child == targetNode || child->contains(targetNode))
                 current = child;
-
-            if (child == lastChild || child->contains(lastChild))
-                break;
-            child = nextChild;
         }
     }
 }
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index 1743713bf..5a8a44e6f 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -971,7 +971,7 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
     RefPtr<Node> lastNode;
     RefPtr<Node> outerNode = passedOuterNode;
 
-    if (outerNode == outerNode->rootEditableElement()) {
+    if (outerNode->isRootEditableElement()) {
         topNode = blockElement;
         lastNode = blockElement;
     } else {
diff --git a/Source/WebCore/editing/DeleteSelectionCommand.cpp b/Source/WebCore/editing/DeleteSelectionCommand.cpp
index 4b07363d6..a59ed6182 100644
--- a/Source/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/Source/WebCore/editing/DeleteSelectionCommand.cpp
@@ -352,7 +352,7 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         }
     }
     
-    if (isTableStructureNode(node.get()) || node == node->rootEditableElement()) {
+    if (isTableStructureNode(node.get()) || node->isRootEditableElement()) {
         // Do not remove an element of table structure; remove its contents.
         // Likewise for the root editable element.
         Node* child = node->firstChild();
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index 6e441c83d..3bbdbf1c7 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -1493,7 +1493,7 @@ PassRefPtr<StylePropertySet> getPropertiesNotIn(StylePropertySet* styleWithRedun
     diffTextDecorations(result.get(), CSSPropertyTextDecoration, baseTextDecorationsInEffect.get());
     diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, baseTextDecorationsInEffect.get());
 
-    if (baseStyle->getPropertyCSSValueInternal(CSSPropertyFontSize) && fontWeightIsBold(result.get()) == fontWeightIsBold(baseStyle))
+    if (baseStyle->getPropertyCSSValueInternal(CSSPropertyFontWeight) && fontWeightIsBold(result.get()) == fontWeightIsBold(baseStyle))
         result->removeProperty(CSSPropertyFontWeight);
 
     if (baseStyle->getPropertyCSSValueInternal(CSSPropertyColor) && getRGBAFontColor(result.get()) == getRGBAFontColor(baseStyle))
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 73acc57af..cde883e1c 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -74,6 +74,7 @@
 #include "RenderedPosition.h"
 #include "ReplaceSelectionCommand.h"
 #include "Settings.h"
+#include "ShadowRoot.h"
 #include "SimplifyMarkupCommand.h"
 #include "Sound.h"
 #include "SpellChecker.h"
@@ -840,7 +841,7 @@ void Editor::reappliedEditing(PassRefPtr<EditCommandComposition> cmd)
 }
 
 Editor::Editor(Frame* frame)
-    : m_frame(frame)
+    : FrameDestructionObserver(frame)
     , m_deleteButtonController(adoptPtr(new DeleteButtonController(frame)))
     , m_ignoreCompositionSelectionChange(false)
     , m_shouldStartNewKillRingSequence(false)
@@ -944,9 +945,11 @@ bool Editor::insertLineBreak()
     if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
+    VisiblePosition caret = m_frame->selection()->selection().visibleStart();
+    bool alignToEdge = isEndOfDocument(caret);
     bool autocorrectionIsApplied = m_alternativeTextController->applyAutocorrectionBeforeTypingIfAppropriate();
     TypingCommand::insertLineBreak(m_frame->document(), autocorrectionIsApplied ? TypingCommand::RetainAutocorrectionIndicator : 0);
-    revealSelectionAfterEditingOperation();
+    revealSelectionAfterEditingOperation(alignToEdge ? ScrollAlignment::alignToEdgeIfNeeded : ScrollAlignment::alignCenterIfNeeded);
 
     return true;
 }
@@ -962,9 +965,11 @@ bool Editor::insertParagraphSeparator()
     if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
+    VisiblePosition caret = m_frame->selection()->selection().visibleStart();
+    bool alignToEdge = isEndOfDocument(caret);
     bool autocorrectionIsApplied = m_alternativeTextController->applyAutocorrectionBeforeTypingIfAppropriate();
     TypingCommand::insertParagraphSeparator(m_frame->document(), autocorrectionIsApplied ? TypingCommand::RetainAutocorrectionIndicator : 0);
-    revealSelectionAfterEditingOperation();
+    revealSelectionAfterEditingOperation(alignToEdge ? ScrollAlignment::alignToEdgeIfNeeded : ScrollAlignment::alignCenterIfNeeded);
 
     return true;
 }
@@ -2282,12 +2287,12 @@ PassRefPtr<Range> Editor::rangeForPoint(const IntPoint& windowPoint)
     return avoidIntersectionWithNode(selection.toNormalizedRange().get(), m_deleteButtonController->containerElement());
 }
 
-void Editor::revealSelectionAfterEditingOperation()
+void Editor::revealSelectionAfterEditingOperation(const ScrollAlignment& alignment)
 {
     if (m_ignoreCompositionSelectionChange)
         return;
 
-    m_frame->selection()->revealSelection(ScrollAlignment::alignCenterIfNeeded);
+    m_frame->selection()->revealSelection(alignment);
 }
 
 void Editor::setIgnoreCompositionSelectionChange(bool ignore)
@@ -2518,12 +2523,12 @@ PassRefPtr<Range> Editor::nextVisibleRange(Range* currentRange, const String& ta
         else
             searchRange->setEndBefore(resultRange->startContainer(), ec);
 
-        Node* shadowTreeRoot = searchRange->shadowTreeRootNode();
-        if (searchRange->collapsed(ec) && shadowTreeRoot) {
+        ShadowRoot* shadowRoot = searchRange->shadowRoot();
+        if (searchRange->collapsed(ec) && shadowRoot) {
             if (forward)
-                searchRange->setEnd(shadowTreeRoot, shadowTreeRoot->childNodeCount(), ec);
+                searchRange->setEnd(shadowRoot, shadowRoot->childNodeCount(), ec);
             else
-                searchRange->setStartBefore(shadowTreeRoot, ec);
+                searchRange->setStartBefore(shadowRoot, ec);
         }
         
         if (searchRange->startContainer()->isDocumentNode() && searchRange->endContainer()->isDocumentNode())
@@ -2881,7 +2886,7 @@ unsigned Editor::countMatchesForText(const String& target, Range* range, FindOpt
         // text nodes. 
         searchRange->setStart(resultRange->endContainer(exception), resultRange->endOffset(exception), exception);
 
-        Node* shadowTreeRoot = searchRange->shadowTreeRootNode();
+        Node* shadowTreeRoot = searchRange->shadowRoot();
         if (searchRange->collapsed(exception) && shadowTreeRoot)
             searchRange->setEnd(shadowTreeRoot, shadowTreeRoot->childNodeCount(), exception);
     } while (true);
@@ -2951,21 +2956,14 @@ void Editor::respondToChangedSelection(const VisibleSelection& oldSelection, Fra
             }
         }
 
-#if !PLATFORM(MAC) || (PLATFORM(MAC) && (defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)))
-#if PLATFORM(CHROMIUM)
-        if (!m_frame->settings() || !m_frame->settings()->asynchronousSpellCheckingEnabled()) {
+        if (!textChecker() || textChecker()->shouldEraseMarkersAfterChangeSelection(TextCheckingTypeSpelling)) {
             if (RefPtr<Range> wordRange = newAdjacentWords.toNormalizedRange())
                 m_frame->document()->markers()->removeMarkers(wordRange.get(), DocumentMarker::Spelling);
         }
-#else
-        // This only erases markers that are in the first unit (word or sentence) of the selection.
-        // Perhaps peculiar, but it matches AppKit on these Mac OS X versions.
-        if (RefPtr<Range> wordRange = newAdjacentWords.toNormalizedRange())
-            m_frame->document()->markers()->removeMarkers(wordRange.get(), DocumentMarker::Spelling);
-#endif
-#endif
-        if (RefPtr<Range> sentenceRange = newSelectedSentence.toNormalizedRange())
-            m_frame->document()->markers()->removeMarkers(sentenceRange.get(), DocumentMarker::Grammar);
+        if (!textChecker() || textChecker()->shouldEraseMarkersAfterChangeSelection(TextCheckingTypeGrammar)) {
+            if (RefPtr<Range> sentenceRange = newSelectedSentence.toNormalizedRange())
+                m_frame->document()->markers()->removeMarkers(sentenceRange.get(), DocumentMarker::Grammar);
+        }
     }
 
     // When continuous spell checking is off, existing markers disappear after the selection changes.
@@ -3059,4 +3057,10 @@ bool Editor::unifiedTextCheckerEnabled() const
     return WebCore::unifiedTextCheckerEnabled(m_frame);
 }
 
+void Editor::willDetachPage()
+{
+    if (EditorClient* editorClient = client())
+        editorClient->frameWillDetachPage(frame());
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index 7c875e874..ec6d9753a 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -35,6 +35,7 @@
 #include "EditingStyle.h"
 #include "EditorInsertAction.h"
 #include "FindOptions.h"
+#include "FrameDestructionObserver.h"
 #include "FrameSelection.h"
 #include "TextChecking.h"
 #include "VisibleSelection.h"
@@ -83,7 +84,7 @@ struct CompositionUnderline {
 enum EditorCommandSource { CommandFromMenuOrKeyBinding, CommandFromDOM, CommandFromDOMWithUserInterface };
 enum EditorParagraphSeparator { EditorParagraphSeparatorIsDiv, EditorParagraphSeparatorIsP };
 
-class Editor {
+class Editor : public FrameDestructionObserver {
 public:
     Editor(Frame*);
     ~Editor();
@@ -398,7 +399,8 @@ public:
     void setDefaultParagraphSeparator(EditorParagraphSeparator separator) { m_defaultParagraphSeparator = separator; }
 
 private:
-    Frame* m_frame;
+    virtual void willDetachPage() OVERRIDE;
+
     OwnPtr<DeleteButtonController> m_deleteButtonController;
     RefPtr<CompositeEditCommand> m_lastEditCommand;
     RefPtr<Node> m_removedAnchor;
@@ -421,7 +423,7 @@ private:
     PassRefPtr<Clipboard> newGeneralClipboard(ClipboardAccessPolicy, Frame*);
     void pasteAsPlainTextWithPasteboard(Pasteboard*);
     void pasteWithPasteboard(Pasteboard*, bool allowPlainText);
-    void revealSelectionAfterEditingOperation();
+    void revealSelectionAfterEditingOperation(const ScrollAlignment& = ScrollAlignment::alignCenterIfNeeded);
     void markMisspellingsOrBadGrammar(const VisibleSelection&, bool checkSpelling, RefPtr<Range>& firstMisspellingRange);
     TextCheckingTypeMask resolveTextCheckingTypeMask(TextCheckingTypeMask);
 
diff --git a/Source/WebCore/editing/InsertListCommand.cpp b/Source/WebCore/editing/InsertListCommand.cpp
index e4e357826..b5e7d51cb 100644
--- a/Source/WebCore/editing/InsertListCommand.cpp
+++ b/Source/WebCore/editing/InsertListCommand.cpp
@@ -152,7 +152,7 @@ void InsertListCommand::doApply()
                 // FIXME: This is an inefficient way to keep selection alive because indexForVisiblePosition walks from
                 // the beginning of the document to the endOfSelection everytime this code is executed.
                 // But not using index is hard because there are so many ways we can lose selection inside doApplyForSingleParagraph.
-                RefPtr<Element> scope;
+                RefPtr<ContainerNode> scope;
                 int indexForEndOfSelection = indexForVisiblePosition(endOfSelection, scope);
                 doApplyForSingleParagraph(forceCreateList, listTag, currentSelection.get());
                 if (endOfSelection.isNull() || endOfSelection.isOrphan() || startOfLastParagraph.isNull() || startOfLastParagraph.isOrphan()) {
diff --git a/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 6531bf367..2d628873e 100644
--- a/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -201,7 +201,7 @@ void InsertParagraphSeparatorCommand::doApply()
 
     // Create block to be inserted.
     RefPtr<Element> blockToInsert;
-    if (startBlock == startBlock->rootEditableElement()) {
+    if (startBlock->isRootEditableElement()) {
         blockToInsert = createDefaultParagraphElement(document());
         nestNewBlock = true;
     } else if (shouldUseDefaultParagraphElement(startBlock.get())) 
diff --git a/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp b/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
index 1ef83d4d9..871230409 100644
--- a/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
+++ b/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
@@ -64,7 +64,7 @@ static void swapInNodePreservingAttributesAndChildren(HTMLElement* newNode, HTML
     }
 
     // FIXME: Fix this to send the proper MutationRecords when MutationObservers are present.
-    newNode->setAttributesFromElement(*nodeToReplace);
+    newNode->cloneDataFromElement(*nodeToReplace);
 
     parentNode->removeChild(nodeToReplace, ec);
     ASSERT(!ec);
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index 85b559514..3f2000d41 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -39,6 +39,7 @@
 #include "RenderTableRow.h"
 #include "RenderTextControl.h"
 #include "RenderTextFragment.h"
+#include "ShadowRoot.h"
 #include "TextBoundaries.h"
 #include "TextBreakIterator.h"
 #include "VisiblePosition.h"
@@ -663,7 +664,7 @@ bool TextIterator::handleReplacedElement()
 
     if (m_entersTextControls && renderer->isTextControl()) {
         if (HTMLElement* innerTextElement = toRenderTextControl(renderer)->textFormControlElement()->innerTextElement()) {
-            m_node = innerTextElement->shadowTreeRootNode();
+            m_node = innerTextElement->shadowRoot();
             pushFullyClippedState(m_fullyClippedStack, m_node);
             m_offset = 0;
             return false;
@@ -2402,7 +2403,7 @@ PassRefPtr<Range> TextIterator::subrange(Range* entireRange, int characterOffset
     return characterSubrange(entireRangeIterator, characterOffset, characterCount);
 }
 
-PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element* scope, int rangeLocation, int rangeLength, bool forSelectionPreservation)
+PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(ContainerNode* scope, int rangeLocation, int rangeLength, bool forSelectionPreservation)
 {
     RefPtr<Range> resultRange = scope->document()->createRange();
 
diff --git a/Source/WebCore/editing/TextIterator.h b/Source/WebCore/editing/TextIterator.h
index bfcfae356..3a77ee851 100644
--- a/Source/WebCore/editing/TextIterator.h
+++ b/Source/WebCore/editing/TextIterator.h
@@ -100,7 +100,7 @@ public:
     Node* node() const;
      
     static int rangeLength(const Range*, bool spacesForReplacedElements = false);
-    static PassRefPtr<Range> rangeFromLocationAndLength(Element* scope, int rangeLocation, int rangeLength, bool spacesForReplacedElements = false);
+    static PassRefPtr<Range> rangeFromLocationAndLength(ContainerNode* scope, int rangeLocation, int rangeLength, bool spacesForReplacedElements = false);
     static bool getLocationAndLengthFromRange(Element* scope, const Range*, size_t& location, size_t& length);
     static PassRefPtr<Range> subrange(Range* entireRange, int characterOffset, int characterCount);
     
diff --git a/Source/WebCore/editing/VisibleSelection.cpp b/Source/WebCore/editing/VisibleSelection.cpp
index 09bef9026..6e68c350b 100644
--- a/Source/WebCore/editing/VisibleSelection.cpp
+++ b/Source/WebCore/editing/VisibleSelection.cpp
@@ -30,7 +30,6 @@
 #include "Element.h"
 #include "htmlediting.h"
 #include "TextIterator.h"
-#include "TreeScopeAdjuster.h"
 #include "VisiblePosition.h"
 #include "visible_units.h"
 #include "Range.h"
@@ -411,6 +410,28 @@ void VisibleSelection::updateSelectionType()
         m_affinity = DOWNSTREAM;
 }
 
+Position VisibleSelection::adjustPositionBefore(TreeScope* treeScope, const Position& currentPosition)
+{
+    if (Node* ancestor = treeScope->ancestorInThisScope(currentPosition.anchorNode()))
+        return positionBeforeNode(ancestor);
+
+    if (Node* lastChild = treeScope->rootNode()->lastChild())
+        return positionAfterNode(lastChild);
+
+    return Position();
+}
+
+Position VisibleSelection::adjustPositionAfter(TreeScope* treeScope, const Position& currentPosition)
+{
+    if (Node* ancestor = treeScope->ancestorInThisScope(currentPosition.anchorNode()))
+        return positionAfterNode(ancestor);
+
+    if (Node* firstChild = treeScope->rootNode()->firstChild())
+        return positionBeforeNode(firstChild);
+
+    return Position();
+}
+
 void VisibleSelection::validate(TextGranularity granularity)
 {
     setBaseAndExtentToDeepEquivalents();
@@ -466,10 +487,10 @@ void VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries()
         return;
 
     if (m_baseIsFirst) {
-        m_extent = TreeScopeAdjuster(m_start.anchorNode()->treeScope()).adjustPositionBefore(m_end);
+        m_extent = adjustPositionBefore(m_start.anchorNode()->treeScope(), m_end);
         m_end = m_extent;
     } else {
-        m_extent = TreeScopeAdjuster(m_end.anchorNode()->treeScope()).adjustPositionAfter(m_start);
+        m_extent = adjustPositionAfter(m_end.anchorNode()->treeScope(), m_start);
         m_start = m_extent;
     }
 
diff --git a/Source/WebCore/editing/VisibleSelection.h b/Source/WebCore/editing/VisibleSelection.h
index 8c810da4d..21999bb3c 100644
--- a/Source/WebCore/editing/VisibleSelection.h
+++ b/Source/WebCore/editing/VisibleSelection.h
@@ -122,6 +122,9 @@ private:
     void adjustSelectionToAvoidCrossingEditingBoundaries();
     void updateSelectionType();
 
+    Position adjustPositionBefore(TreeScope*, const Position&);
+    Position adjustPositionAfter(TreeScope*, const Position&);
+
     // We need to store these as Positions because VisibleSelection is
     // used to store values in editing commands for use when
     // undoing the command. We need to be able to create a selection that, while currently
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index 3b1d44c02..6674fa167 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -45,10 +45,11 @@
 #include "PositionIterator.h"
 #include "RenderObject.h"
 #include "Range.h"
-#include "VisibleSelection.h"
+#include "ShadowRoot.h"
 #include "Text.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
+#include "VisibleSelection.h"
 #include "visible_units.h"
 #include <wtf/Assertions.h>
 #include <wtf/StdLibExtras.h>
@@ -298,7 +299,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
 // Whether or not content before and after this node will collapse onto the same line as it.
 bool isBlock(const Node* node)
 {
-    return node && node->renderer() && !node->renderer()->isInline();
+    return node && node->renderer() && !node->renderer()->isInline() && !node->renderer()->isRubyText();
 }
 
 bool isInline(const Node* node)
@@ -1084,20 +1085,19 @@ VisibleSelection selectionForParagraphIteration(const VisibleSelection& original
 // opertion is unreliable. TextIterator's TextIteratorEmitsCharactersBetweenAllVisiblePositions mode needs to be fixed, 
 // or these functions need to be changed to iterate using actual VisiblePositions.
 // FIXME: Deploy these functions everywhere that TextIterators are used to convert between VisiblePositions and indices.
-int indexForVisiblePosition(const VisiblePosition& visiblePosition, RefPtr<Element>& scope)
+ 
+int indexForVisiblePosition(const VisiblePosition& visiblePosition, RefPtr<ContainerNode>& scope)
 {
     if (visiblePosition.isNull())
         return 0;
 
     Position p(visiblePosition.deepEquivalent());
     Document* document = p.anchorNode()->document();
-    Node* shadowRoot = p.anchorNode()->shadowTreeRootNode();
+    ShadowRoot* shadowRoot = p.anchorNode()->shadowRoot();
 
-    if (shadowRoot) {
-        // Use the shadow root for form elements, since TextIterators will not enter shadow content.
-        ASSERT(shadowRoot->isElementNode());
-        scope = static_cast<Element*>(shadowRoot);
-    } else
+    if (shadowRoot)
+        scope = shadowRoot;
+    else
         scope = document->documentElement();
 
     RefPtr<Range> range = Range::create(document, firstPositionInNode(scope.get()), p.parentAnchoredEquivalent());
@@ -1105,7 +1105,7 @@ int indexForVisiblePosition(const VisiblePosition& visiblePosition, RefPtr<Eleme
     return TextIterator::rangeLength(range.get(), true);
 }
 
-VisiblePosition visiblePositionForIndex(int index, Element *scope)
+VisiblePosition visiblePositionForIndex(int index, ContainerNode* scope)
 {
     RefPtr<Range> range = TextIterator::rangeFromLocationAndLength(scope, index, 0, true);
     // Check for an invalid index. Certain editing operations invalidate indices because 
diff --git a/Source/WebCore/editing/htmlediting.h b/Source/WebCore/editing/htmlediting.h
index c2cf4563b..a819c492c 100644
--- a/Source/WebCore/editing/htmlediting.h
+++ b/Source/WebCore/editing/htmlediting.h
@@ -180,8 +180,8 @@ bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
     
 int comparePositions(const VisiblePosition&, const VisiblePosition&);
 
-int indexForVisiblePosition(const VisiblePosition&, RefPtr<Element>& scope);
-VisiblePosition visiblePositionForIndex(int index, Element *scope);
+int indexForVisiblePosition(const VisiblePosition&, RefPtr<ContainerNode>& scope);
+VisiblePosition visiblePositionForIndex(int index, ContainerNode* scope);
 
 // -------------------------------------------------------------------------
 // Range
diff --git a/Source/WebCore/editing/visible_units.cpp b/Source/WebCore/editing/visible_units.cpp
index f225d0b49..622455987 100644
--- a/Source/WebCore/editing/visible_units.cpp
+++ b/Source/WebCore/editing/visible_units.cpp
@@ -60,29 +60,6 @@ static Node* previousLeafWithSameEditability(Node* node, EditableType editableTy
     return 0;
 }
 
-static Node* enclosingNodeWithNonInlineRenderer(Node* node)
-{
-    for (; node; node = node->parentNode()) {
-        if (node->renderer() && !node->renderer()->isInline())
-            return node;
-    }
-    return 0;
-}
-
-static Node* nextLeafWithSameEditability(Node* node, int offset)
-{
-    bool editable = node->rendererIsEditable();
-    ASSERT(offset >= 0);
-    Node* child = node->childNode(offset);
-    node = child ? child->nextLeafNode() : node->lastDescendant()->nextLeafNode();
-    while (node) {
-        if (editable == node->rendererIsEditable())
-            return node;
-        node = node->nextLeafNode();
-    }
-    return 0;
-}
-
 static Node* nextLeafWithSameEditability(Node* node, EditableType editableType = ContentIsEditable)
 {
     if (!node)
@@ -99,69 +76,49 @@ static Node* nextLeafWithSameEditability(Node* node, EditableType editableType =
 }
 
 // FIXME: consolidate with code in previousLinePosition.
-static const RootInlineBox* previousRootInlineBox(const InlineBox* box, const VisiblePosition& visiblePosition)
+static Position previousRootInlineBoxCandidatePosition(Node* node, const VisiblePosition& visiblePosition, EditableType editableType)
 {
-    Node* highestRoot = highestEditableRoot(visiblePosition.deepEquivalent(), ContentIsEditable);
-
-    if (!box->renderer() || !box->renderer()->node())
-        return 0;
-
-    Node* node = box->renderer()->node();
-    Node* enclosingBlockNode = enclosingNodeWithNonInlineRenderer(node);
-    Node* previousNode = previousLeafWithSameEditability(node, ContentIsEditable);
+    Node* highestRoot = highestEditableRoot(visiblePosition.deepEquivalent(), editableType);
+    Node* previousNode = previousLeafWithSameEditability(node, editableType);
 
-    while (previousNode && enclosingBlockNode == enclosingNodeWithNonInlineRenderer(previousNode))
-        previousNode = previousLeafWithSameEditability(previousNode, ContentIsEditable);
+    while (previousNode && inSameLine(firstPositionInOrBeforeNode(previousNode), visiblePosition))
+        previousNode = previousLeafWithSameEditability(previousNode, editableType);
   
     while (previousNode && !previousNode->isShadowRoot()) {
-        if (highestEditableRoot(firstPositionInOrBeforeNode(previousNode), ContentIsEditable) != highestRoot)
+        if (highestEditableRoot(firstPositionInOrBeforeNode(previousNode), editableType) != highestRoot)
             break;
 
         Position pos = previousNode->hasTagName(brTag) ? positionBeforeNode(previousNode) :
             createLegacyEditingPosition(previousNode, caretMaxOffset(previousNode));
         
-        if (pos.isCandidate()) {
-            RenderedPosition renderedPos(pos, DOWNSTREAM);
-            RootInlineBox* root = renderedPos.rootBox();
-            if (root)
-                return root;
-        }
+        if (pos.isCandidate())
+            return pos;
 
-        previousNode = previousLeafWithSameEditability(previousNode, ContentIsEditable);
+        previousNode = previousLeafWithSameEditability(previousNode, editableType);
     }
-    return 0;
+    return Position();
 }
 
-static const RootInlineBox* nextRootInlineBox(const InlineBox* box, const VisiblePosition& visiblePosition)
+static Position nextRootInlineBoxCandidatePosition(Node* node, const VisiblePosition& visiblePosition, EditableType editableType)
 {
-    Node* highestRoot = highestEditableRoot(visiblePosition.deepEquivalent(), ContentIsEditable);
-
-    if (!box->renderer() || !box->renderer()->node())
-        return 0;
-
-    Node* node = box->renderer()->node();
-    Node* enclosingBlockNode = enclosingNodeWithNonInlineRenderer(node);
-    Node* nextNode = nextLeafWithSameEditability(node, ContentIsEditable);
-    while (nextNode && enclosingBlockNode == enclosingNodeWithNonInlineRenderer(nextNode))
+    Node* highestRoot = highestEditableRoot(visiblePosition.deepEquivalent(), editableType);
+    Node* nextNode = nextLeafWithSameEditability(node, editableType);
+    while (nextNode && inSameLine(firstPositionInOrBeforeNode(nextNode), visiblePosition))
         nextNode = nextLeafWithSameEditability(nextNode, ContentIsEditable);
   
     while (nextNode && !nextNode->isShadowRoot()) {
-        if (highestEditableRoot(firstPositionInOrBeforeNode(nextNode), ContentIsEditable) != highestRoot)
+        if (highestEditableRoot(firstPositionInOrBeforeNode(nextNode), editableType) != highestRoot)
             break;
 
         Position pos;
         pos = createLegacyEditingPosition(nextNode, caretMinOffset(nextNode));
         
-        if (pos.isCandidate()) {
-            RenderedPosition renderedPos(pos, DOWNSTREAM);
-            RootInlineBox* root = renderedPos.rootBox();
-            if (root)
-                return root;
-        }
+        if (pos.isCandidate())
+            return pos;
 
-        nextNode = nextLeafWithSameEditability(nextNode, ContentIsEditable);
+        nextNode = nextLeafWithSameEditability(nextNode, editableType);
     }
-    return 0;
+    return Position();
 }
 
 class CachedLogicallyOrderedLeafBoxes {
@@ -257,8 +214,17 @@ static const InlineTextBox* logicallyPreviousBox(const VisiblePosition& visibleP
     if (previousBox)
         return previousBox;
 
-    while (1) { 
-        const RootInlineBox* previousRoot = previousRootInlineBox(startBox, visiblePosition);
+    while (1) {
+        Node* startNode = startBox->renderer() ? startBox->renderer()->node() : 0;
+        if (!startNode)
+            break;
+
+        Position position = previousRootInlineBoxCandidatePosition(startNode, visiblePosition, ContentIsEditable);
+        if (position.isNull())
+            break;
+
+        RenderedPosition renderedPosition(position, DOWNSTREAM);
+        RootInlineBox* previousRoot = renderedPosition.rootBox();
         if (!previousRoot)
             break;
 
@@ -289,8 +255,17 @@ static const InlineTextBox* logicallyNextBox(const VisiblePosition& visiblePosit
     if (nextBox)
         return nextBox;
 
-    while (1) { 
-        const RootInlineBox* nextRoot = nextRootInlineBox(startBox, visiblePosition);
+    while (1) {
+        Node* startNode = startBox->renderer() ? startBox->renderer()->node() : 0;
+        if (!startNode)
+            break;
+
+        Position position = nextRootInlineBoxCandidatePosition(startNode, visiblePosition, ContentIsEditable);
+        if (position.isNull())
+            break;
+
+        RenderedPosition renderedPosition(position, DOWNSTREAM);
+        RootInlineBox* nextRoot = renderedPosition.rootBox();
         if (!nextRoot)
             break;
 
@@ -951,7 +926,6 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
 {
     Position p = visiblePosition.deepEquivalent();
     Node* node = p.deprecatedNode();
-    Node* highestRoot = highestEditableRoot(p, editableType);
 
     if (!node)
         return VisiblePosition();
@@ -975,28 +949,12 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
     }
 
     if (!root) {
-        // This containing editable block does not have a previous line.
-        // Need to move back to previous containing editable block in this root editable
-        // block and find the last root line box in that block.
-        Node* startBlock = enclosingNodeWithNonInlineRenderer(node);
-        Node* n = previousLeafWithSameEditability(node, editableType);
-        while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
-            n = previousLeafWithSameEditability(n, editableType);
-        while (n) {
-            if (highestEditableRoot(firstPositionInOrBeforeNode(n), editableType) != highestRoot)
-                break;
-            Position pos = n->hasTagName(brTag) ? positionBeforeNode(n) : createLegacyEditingPosition(n, caretMaxOffset(n));
-            if (pos.isCandidate()) {
-                pos.getInlineBoxAndOffset(DOWNSTREAM, box, ignoredCaretOffset);
-                if (box) {
-                    // previous root line box found
-                    root = box->root();
-                    break;
-                }
-
-                return VisiblePosition(pos, DOWNSTREAM);
-            }
-            n = previousLeafWithSameEditability(n, editableType);
+        Position position = previousRootInlineBoxCandidatePosition(node, visiblePosition, editableType);
+        if (position.isNotNull()) {
+            RenderedPosition renderedPosition(position);
+            root = renderedPosition.rootBox();
+            if (!root)
+                return position;
         }
     }
     
@@ -1019,12 +977,10 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
     return VisiblePosition(firstPositionInNode(rootElement), DOWNSTREAM);
 }
 
-
 VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int lineDirectionPoint, EditableType editableType)
 {
     Position p = visiblePosition.deepEquivalent();
     Node* node = p.deprecatedNode();
-    Node* highestRoot = highestEditableRoot(p, editableType);
 
     if (!node)
         return VisiblePosition();
@@ -1048,29 +1004,15 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int lin
     }
 
     if (!root) {
-        // This containing editable block does not have a next line.
-        // Need to move forward to next containing editable block in this root editable
-        // block and find the first root line box in that block.
-        Node* startBlock = enclosingNodeWithNonInlineRenderer(node);
-        Node* n = nextLeafWithSameEditability(node, p.deprecatedEditingOffset());
-        while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
-            n = nextLeafWithSameEditability(n, editableType);
-        while (n) {
-            if (highestEditableRoot(firstPositionInOrBeforeNode(n), editableType) != highestRoot)
-                break;
-            Position pos = createLegacyEditingPosition(n, caretMinOffset(n));
-            if (pos.isCandidate()) {
-                ASSERT(n->renderer());
-                pos.getInlineBoxAndOffset(DOWNSTREAM, box, ignoredCaretOffset);
-                if (box) {
-                    // next root line box found
-                    root = box->root();
-                    break;
-                }
-
-                return VisiblePosition(pos, DOWNSTREAM);
-            }
-            n = nextLeafWithSameEditability(n, editableType);
+        // FIXME: We need do the same in previousLinePosition.
+        Node* child = node->childNode(p.deprecatedEditingOffset());
+        node = child ? child : node->lastDescendant();
+        Position position = nextRootInlineBoxCandidatePosition(node, visiblePosition, editableType);
+        if (position.isNotNull()) {
+            RenderedPosition renderedPosition(position);
+            root = renderedPosition.rootBox();
+            if (!root)
+                return position;
         }
     }
     
diff --git a/Source/WebCore/fileapi/File.cpp b/Source/WebCore/fileapi/File.cpp
index 905291b2d..f2afa3454 100644
--- a/Source/WebCore/fileapi/File.cpp
+++ b/Source/WebCore/fileapi/File.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "File.h"
 
+#include "FileMetadata.h"
 #include "FileSystem.h"
 #include "MIMETypeRegistry.h"
 #include <wtf/CurrentTime.h>
@@ -33,6 +34,15 @@
 
 namespace WebCore {
 
+static String getContentTypeFromFileName(const String& name)
+{
+    String type;
+    int index = name.reverseFind('.');
+    if (index != -1)
+        type = MIMETypeRegistry::getWellKnownMIMETypeForExtension(name.substring(index + 1));
+    return type;
+}
+
 static PassOwnPtr<BlobData> createBlobDataForFileWithType(const String& path, const String& contentType)
 {
     OwnPtr<BlobData> blobData = BlobData::create();
@@ -43,22 +53,24 @@ static PassOwnPtr<BlobData> createBlobDataForFileWithType(const String& path, co
 
 static PassOwnPtr<BlobData> createBlobDataForFile(const String& path)
 {
-    String type;
-    int index = path.reverseFind('.');
-    if (index != -1)
-        type = MIMETypeRegistry::getMIMETypeForExtension(path.substring(index + 1));
-    return createBlobDataForFileWithType(path, type);
+    return createBlobDataForFileWithType(path, getContentTypeFromFileName(path));
 }
 
 static PassOwnPtr<BlobData> createBlobDataForFileWithName(const String& path, const String& fileSystemName)
 {
-    String type;
-    int index = fileSystemName.reverseFind('.');
-    if (index != -1)
-        type = MIMETypeRegistry::getWellKnownMIMETypeForExtension(fileSystemName.substring(index + 1));
-    return createBlobDataForFileWithType(path, type);
+    return createBlobDataForFileWithType(path, getContentTypeFromFileName(fileSystemName));
 }
 
+#if ENABLE(FILE_SYSTEM)
+static PassOwnPtr<BlobData> createBlobDataForFileWithMetadata(const String& fileSystemName, const FileMetadata& metadata)
+{
+    OwnPtr<BlobData> blobData = BlobData::create();
+    blobData->setContentType(getContentTypeFromFileName(fileSystemName));
+    blobData->appendFile(metadata.platformPath, 0, metadata.length, metadata.modificationTime);
+    return blobData.release();
+}
+#endif
+
 #if ENABLE(DIRECTORY_UPLOAD)
 PassRefPtr<File> File::createWithRelativePath(const String& path, const String& relativePath)
 {
@@ -72,12 +84,20 @@ File::File(const String& path)
     : Blob(createBlobDataForFile(path), -1)
     , m_path(path)
     , m_name(pathGetFileName(path))
+#if ENABLE(FILE_SYSTEM)
+    , m_snapshotSize(-1)
+    , m_snapshotModificationTime(0)
+#endif
 {
 }
 
 File::File(const String& path, const KURL& url, const String& type)
     : Blob(url, type, -1)
     , m_path(path)
+#if ENABLE(FILE_SYSTEM)
+    , m_snapshotSize(-1)
+    , m_snapshotModificationTime(0)
+#endif
 {
     m_name = pathGetFileName(path);
     // FIXME: File object serialization/deserialization does not include
@@ -89,11 +109,31 @@ File::File(const String& path, const String& name)
     : Blob(createBlobDataForFileWithName(path, name), -1)
     , m_path(path)
     , m_name(name)
+#if ENABLE(FILE_SYSTEM)
+    , m_snapshotSize(-1)
+    , m_snapshotModificationTime(0)
+#endif
+{
+}
+
+#if ENABLE(FILE_SYSTEM)
+File::File(const String& name, const FileMetadata& metadata)
+    : Blob(createBlobDataForFileWithMetadata(name, metadata), metadata.length)
+    , m_path(metadata.platformPath)
+    , m_name(name)
+    , m_snapshotSize(metadata.length)
+    , m_snapshotModificationTime(metadata.modificationTime)
 {
 }
+#endif
 
 double File::lastModifiedDate() const
 {
+#if ENABLE(FILE_SYSTEM)
+    if (m_snapshotSize >= 0 && m_snapshotModificationTime)
+        return m_snapshotModificationTime * 1000.0;
+#endif
+
     time_t modificationTime;
     if (!getFileModificationTime(m_path, modificationTime))
         return 0;
@@ -104,6 +144,11 @@ double File::lastModifiedDate() const
 
 unsigned long long File::size() const
 {
+#if ENABLE(FILE_SYSTEM)
+    if (m_snapshotSize >= 0 && m_snapshotModificationTime)
+        return m_snapshotSize;
+#endif
+
     // FIXME: JavaScript cannot represent sizes as large as unsigned long long, we need to
     // come up with an exception to throw if file size is not representable.
     long long size;
@@ -114,6 +159,14 @@ unsigned long long File::size() const
 
 void File::captureSnapshot(long long& snapshotSize, double& snapshotModificationTime) const
 {
+#if ENABLE(FILE_SYSTEM)
+    if (m_snapshotSize >= 0 && m_snapshotModificationTime) {
+        snapshotSize = m_snapshotSize;
+        snapshotModificationTime = m_snapshotModificationTime;
+        return;
+    }
+#endif
+
     // Obtains a snapshot of the file by capturing its current size and modification time. This is used when we slice a file for the first time.
     // If we fail to retrieve the size or modification time, probably due to that the file has been deleted, 0 size is returned.
     // FIXME: Combine getFileSize and getFileModificationTime into one file system call.
diff --git a/Source/WebCore/fileapi/File.h b/Source/WebCore/fileapi/File.h
index 83756711c..6331a2d49 100644
--- a/Source/WebCore/fileapi/File.h
+++ b/Source/WebCore/fileapi/File.h
@@ -33,6 +33,7 @@
 
 namespace WebCore {
 
+struct FileMetadata;
 class KURL;
 
 class File : public Blob {
@@ -52,6 +53,16 @@ public:
     static PassRefPtr<File> createWithRelativePath(const String& path, const String& relativePath);
 #endif
 
+#if ENABLE(FILE_SYSTEM)
+    // If filesystem files live in the remote filesystem, the port might pass the valid metadata (non-zero modificationTime and non-negative file size) and cache in the File object.
+    //
+    // Otherwise calling size(), lastModifiedTime() and webkitSlice() will synchronously query the file metadata.
+    static PassRefPtr<File> createForFileSystemFile(const String& name, const FileMetadata& metadata)
+    {
+        return adoptRef(new File(name, metadata));
+    }
+#endif
+
     // Create a file with a name exposed to the author (via File.name and associated DOM properties) that differs from the one provided in the path.
     static PassRefPtr<File> createWithName(const String& path, const String& name)
     {
@@ -81,8 +92,20 @@ private:
     File(const String& path, const KURL& srcURL, const String& type);
     File(const String& path, const String& name);
 
+# if ENABLE(FILE_SYSTEM)
+    File(const String& name, const FileMetadata&);
+#endif
+
     String m_path;
     String m_name;
+
+#if ENABLE(FILE_SYSTEM)
+    // If non-zero modificationTime and non-negative file size are given at construction time we use them in size(), lastModifiedTime() and webkitSlice().
+    // By default we initialize m_snapshotSize to -1 and m_snapshotModificationTime to 0 (so that we don't use them unless they are given).
+    const long long m_snapshotSize;
+    const double m_snapshotModificationTime;
+#endif
+
 #if ENABLE(DIRECTORY_UPLOAD)
     String m_relativePath;
 #endif
diff --git a/Source/WebCore/history/PageCache.cpp b/Source/WebCore/history/PageCache.cpp
index 1a4eada19..8c379eb24 100644
--- a/Source/WebCore/history/PageCache.cpp
+++ b/Source/WebCore/history/PageCache.cpp
@@ -361,7 +361,7 @@ bool PageCache::canCachePageContainingThisFrame(Frame* frame)
         && frameLoader->client()->canCachePage();
 }
     
-bool PageCache::canCache(Page* page)
+bool PageCache::canCache(Page* page) const
 {
     if (!page)
         return false;
@@ -377,7 +377,8 @@ bool PageCache::canCache(Page* page)
     // over it again when we leave that page.
     FrameLoadType loadType = page->mainFrame()->loader()->loadType();
     
-    return canCachePageContainingThisFrame(page->mainFrame())
+    return m_capacity > 0
+        && canCachePageContainingThisFrame(page->mainFrame())
         && page->backForward()->isActive()
         && page->settings()->usesPageCache()
 #if ENABLE(DEVICE_ORIENTATION)
diff --git a/Source/WebCore/history/PageCache.h b/Source/WebCore/history/PageCache.h
index 1cba03f5b..d69eac51a 100644
--- a/Source/WebCore/history/PageCache.h
+++ b/Source/WebCore/history/PageCache.h
@@ -43,7 +43,7 @@ namespace WebCore {
     public:
         friend PageCache* pageCache();
         
-        static bool canCache(Page*);
+        bool canCache(Page*) const;
 
         void setCapacity(int); // number of pages to cache
         int capacity() { return m_capacity; }
diff --git a/Source/WebCore/html/DOMURL.idl b/Source/WebCore/html/DOMURL.idl
index df747c295..44bb63849 100644
--- a/Source/WebCore/html/DOMURL.idl
+++ b/Source/WebCore/html/DOMURL.idl
@@ -34,9 +34,9 @@ module html {
         InterfaceName=URL
     ] DOMURL {
 #if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
-        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] static DOMString createObjectURL(in MediaStream stream);
+        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(in MediaStream stream);
 #endif
-        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] static DOMString createObjectURL(in Blob blob);
+        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(in Blob blob);
         [CallWith=ScriptExecutionContext] static void revokeObjectURL(in DOMString url);
     };
 }
diff --git a/Source/WebCore/html/EmailInputType.cpp b/Source/WebCore/html/EmailInputType.cpp
index f00ae40f7..07b01a047 100644
--- a/Source/WebCore/html/EmailInputType.cpp
+++ b/Source/WebCore/html/EmailInputType.cpp
@@ -96,7 +96,7 @@ String EmailInputType::sanitizeValue(const String& proposedValue) const
 {
     String noLineBreakValue = proposedValue.removeCharacters(isHTMLLineBreak);
     if (!element()->multiple())
-        return noLineBreakValue;
+        return stripLeadingAndTrailingHTMLSpaces(noLineBreakValue);
     Vector<String> addresses;
     noLineBreakValue.split(',', true, addresses);
     StringBuilder strippedValue;
diff --git a/Source/WebCore/html/FormAssociatedElement.cpp b/Source/WebCore/html/FormAssociatedElement.cpp
index 665efa76a..76dd0d159 100644
--- a/Source/WebCore/html/FormAssociatedElement.cpp
+++ b/Source/WebCore/html/FormAssociatedElement.cpp
@@ -157,6 +157,69 @@ void FormAssociatedElement::formAttributeChanged()
         resetFormOwner();
 }
 
+bool FormAssociatedElement::customError() const
+{
+    const HTMLElement* element = toHTMLElement(this);
+    return element->willValidate() && !m_customValidationMessage.isEmpty();
+}
+
+bool FormAssociatedElement::patternMismatch() const
+{
+    return false;
+}
+
+bool FormAssociatedElement::rangeOverflow() const
+{
+    return false;
+}
+
+bool FormAssociatedElement::rangeUnderflow() const
+{
+    return false;
+}
+
+bool FormAssociatedElement::stepMismatch() const
+{
+    return false;
+}
+
+bool FormAssociatedElement::tooLong() const
+{
+    return false;
+}
+
+bool FormAssociatedElement::typeMismatch() const
+{
+    return false;
+}
+
+bool FormAssociatedElement::valid() const
+{
+    bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow()
+        || tooLong() || patternMismatch() || valueMissing() || customError();
+    return !someError;
+}
+
+bool FormAssociatedElement::valueMissing() const
+{
+    return false;
+}
+
+String FormAssociatedElement::customValidationMessage() const
+{
+    return m_customValidationMessage;
+}
+
+String FormAssociatedElement::validationMessage() const
+{
+    return customError() ? m_customValidationMessage : String();
+}
+
+void FormAssociatedElement::setCustomValidity(const String& error)
+{
+    m_customValidationMessage = error;
+}
+
 const HTMLElement* toHTMLElement(const FormAssociatedElement* associatedElement)
 {
     if (associatedElement->isFormControlElement())
diff --git a/Source/WebCore/html/FormAssociatedElement.h b/Source/WebCore/html/FormAssociatedElement.h
index 284e298fd..92eb8d7ef 100644
--- a/Source/WebCore/html/FormAssociatedElement.h
+++ b/Source/WebCore/html/FormAssociatedElement.h
@@ -60,6 +60,22 @@ public:
 
     void formRemovedFromTree(const Node* formRoot);
 
+    // ValidityState attribute implementations
+    bool customError() const;
+
+    // Override functions for patterMismatch, rangeOverflow, rangerUnderflow,
+    // stepMismatch, tooLong and valueMissing must call willValidate method.
+    virtual bool patternMismatch() const;
+    virtual bool rangeOverflow() const;
+    virtual bool rangeUnderflow() const;
+    virtual bool stepMismatch() const;
+    virtual bool tooLong() const;
+    virtual bool typeMismatch() const;
+    virtual bool valueMissing() const;
+    virtual String validationMessage() const;
+    bool valid() const;
+    virtual void setCustomValidity(const String&);
+
 protected:
     FormAssociatedElement();
 
@@ -76,6 +92,8 @@ protected:
     virtual void willChangeForm();
     virtual void didChangeForm();
 
+    String customValidationMessage() const;
+
 private:
     virtual const AtomicString& formControlName() const = 0;
 
@@ -84,6 +102,7 @@ private:
 
     HTMLFormElement* m_form;
     OwnPtr<ValidityState> m_validityState;
+    String m_customValidationMessage;
 };
 
 HTMLElement* toHTMLElement(FormAssociatedElement*);
diff --git a/Source/WebCore/html/HTMLAnchorElement.cpp b/Source/WebCore/html/HTMLAnchorElement.cpp
index a5b3e0899..d31188f12 100644
--- a/Source/WebCore/html/HTMLAnchorElement.cpp
+++ b/Source/WebCore/html/HTMLAnchorElement.cpp
@@ -210,15 +210,15 @@ void HTMLAnchorElement::setActive(bool down, bool pause)
     ContainerNode::setActive(down, pause);
 }
 
-void HTMLAnchorElement::parseAttribute(Attribute* attr)
+void HTMLAnchorElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == hrefAttr) {
+    if (attribute.name() == hrefAttr) {
         bool wasLink = isLink();
-        setIsLink(!attr->isNull());
+        setIsLink(!attribute.isNull());
         if (wasLink != isLink())
             setNeedsStyleRecalc();
         if (isLink()) {
-            String parsedURL = stripLeadingAndTrailingHTMLSpaces(attr->value());
+            String parsedURL = stripLeadingAndTrailingHTMLSpaces(attribute.value());
             if (document()->isDNSPrefetchEnabled()) {
                 if (protocolIs(parsedURL, "http") || protocolIs(parsedURL, "https") || parsedURL.startsWith("//"))
                     prefetchDNS(document()->completeURL(parsedURL).host());
@@ -231,12 +231,12 @@ void HTMLAnchorElement::parseAttribute(Attribute* attr)
             }
         }
         invalidateCachedVisitedLinkHash();
-    } else if (attr->name() == nameAttr || attr->name() == titleAttr) {
+    } else if (attribute.name() == nameAttr || attribute.name() == titleAttr) {
         // Do nothing.
-    } else if (attr->name() == relAttr)
-        setRel(attr->value());
+    } else if (attribute.name() == relAttr)
+        setRel(attribute.value());
     else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 void HTMLAnchorElement::accessKeyAction(bool sendMouseEvents)
diff --git a/Source/WebCore/html/HTMLAnchorElement.h b/Source/WebCore/html/HTMLAnchorElement.h
index baebdc67b..9a875c25b 100644
--- a/Source/WebCore/html/HTMLAnchorElement.h
+++ b/Source/WebCore/html/HTMLAnchorElement.h
@@ -103,7 +103,7 @@ public:
 protected:
     HTMLAnchorElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
 private:
     virtual bool supportsFocus() const;
diff --git a/Source/WebCore/html/HTMLAppletElement.cpp b/Source/WebCore/html/HTMLAppletElement.cpp
index 2274d8dda..9c7eb5d55 100644
--- a/Source/WebCore/html/HTMLAppletElement.cpp
+++ b/Source/WebCore/html/HTMLAppletElement.cpp
@@ -47,17 +47,17 @@ PassRefPtr<HTMLAppletElement> HTMLAppletElement::create(const QualifiedName& tag
     return adoptRef(new HTMLAppletElement(tagName, document));
 }
 
-void HTMLAppletElement::parseAttribute(Attribute* attr)
+void HTMLAppletElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == altAttr ||
-        attr->name() == archiveAttr ||
-        attr->name() == codeAttr ||
-        attr->name() == codebaseAttr ||
-        attr->name() == mayscriptAttr ||
-        attr->name() == objectAttr) {
+    if (attribute.name() == altAttr
+        || attribute.name() == archiveAttr
+        || attribute.name() == codeAttr
+        || attribute.name() == codebaseAttr
+        || attribute.name() == mayscriptAttr
+        || attribute.name() == objectAttr) {
         // Do nothing.
     } else
-        HTMLPlugInElement::parseAttribute(attr);
+        HTMLPlugInElement::parseAttribute(attribute);
 }
 
 bool HTMLAppletElement::rendererIsNeeded(const NodeRenderingContext& context)
@@ -115,10 +115,11 @@ RenderWidget* HTMLAppletElement::renderWidgetForJSBindings()
     if (!canEmbedJava())
         return 0;
 
-    RenderApplet* applet = toRenderApplet(renderer());
-    if (applet)
-        applet->createWidgetIfNecessary();
+    if (!renderer() || !renderer()->isApplet())
+        return 0;
 
+    RenderApplet* applet = toRenderApplet(renderer());
+    applet->createWidgetIfNecessary();
     return applet;
 }
 
diff --git a/Source/WebCore/html/HTMLAppletElement.h b/Source/WebCore/html/HTMLAppletElement.h
index 49e29b5e0..d3ff6438f 100644
--- a/Source/WebCore/html/HTMLAppletElement.h
+++ b/Source/WebCore/html/HTMLAppletElement.h
@@ -34,7 +34,7 @@ public:
 private:
     HTMLAppletElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/html/HTMLAreaElement.cpp b/Source/WebCore/html/HTMLAreaElement.cpp
index d3ea24258..6e7f99ddc 100644
--- a/Source/WebCore/html/HTMLAreaElement.cpp
+++ b/Source/WebCore/html/HTMLAreaElement.cpp
@@ -53,25 +53,25 @@ PassRefPtr<HTMLAreaElement> HTMLAreaElement::create(const QualifiedName& tagName
     return adoptRef(new HTMLAreaElement(tagName, document));
 }
 
-void HTMLAreaElement::parseAttribute(Attribute* attr)
+void HTMLAreaElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == shapeAttr) {
-        if (equalIgnoringCase(attr->value(), "default"))
+    if (attribute.name() == shapeAttr) {
+        if (equalIgnoringCase(attribute.value(), "default"))
             m_shape = Default;
-        else if (equalIgnoringCase(attr->value(), "circle"))
+        else if (equalIgnoringCase(attribute.value(), "circle"))
             m_shape = Circle;
-        else if (equalIgnoringCase(attr->value(), "poly"))
+        else if (equalIgnoringCase(attribute.value(), "poly"))
             m_shape = Poly;
-        else if (equalIgnoringCase(attr->value(), "rect"))
+        else if (equalIgnoringCase(attribute.value(), "rect"))
             m_shape = Rect;
         invalidateCachedRegion();
-    } else if (attr->name() == coordsAttr) {
-        m_coords = newCoordsArray(attr->value().string(), m_coordsLen);
+    } else if (attribute.name() == coordsAttr) {
+        m_coords = newCoordsArray(attribute.value().string(), m_coordsLen);
         invalidateCachedRegion();
-    } else if (attr->name() == altAttr || attr->name() == accesskeyAttr) {
+    } else if (attribute.name() == altAttr || attribute.name() == accesskeyAttr) {
         // Do nothing.
     } else
-        HTMLAnchorElement::parseAttribute(attr);
+        HTMLAnchorElement::parseAttribute(attribute);
 }
 
 void HTMLAreaElement::invalidateCachedRegion()
diff --git a/Source/WebCore/html/HTMLAreaElement.h b/Source/WebCore/html/HTMLAreaElement.h
index ed67bd0b3..c7a04fdb5 100644
--- a/Source/WebCore/html/HTMLAreaElement.h
+++ b/Source/WebCore/html/HTMLAreaElement.h
@@ -50,7 +50,7 @@ public:
 private:
     HTMLAreaElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool supportsFocus() const;
     virtual String target() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
diff --git a/Source/WebCore/html/HTMLBRElement.cpp b/Source/WebCore/html/HTMLBRElement.cpp
index 57253af0e..31b02ef29 100644
--- a/Source/WebCore/html/HTMLBRElement.cpp
+++ b/Source/WebCore/html/HTMLBRElement.cpp
@@ -56,19 +56,19 @@ bool HTMLBRElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLBRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLBRElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == clearAttr) {
+    if (attribute.name() == clearAttr) {
         // If the string is empty, then don't add the clear property.
         // <br clear> and <br clear=""> are just treated like <br> by Gecko, Mac IE, etc. -dwh
-        if (!attr->isEmpty()) {
-            if (equalIgnoringCase(attr->value(), "all"))
+        if (!attribute.isEmpty()) {
+            if (equalIgnoringCase(attribute.value(), "all"))
                 addPropertyToAttributeStyle(style, CSSPropertyClear, CSSValueBoth);
             else
-                addPropertyToAttributeStyle(style, CSSPropertyClear, attr->value());
+                addPropertyToAttributeStyle(style, CSSPropertyClear, attribute.value());
         }
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 RenderObject* HTMLBRElement::createRenderer(RenderArena* arena, RenderStyle* style)
diff --git a/Source/WebCore/html/HTMLBRElement.h b/Source/WebCore/html/HTMLBRElement.h
index a7e60f321..d6855d837 100644
--- a/Source/WebCore/html/HTMLBRElement.h
+++ b/Source/WebCore/html/HTMLBRElement.h
@@ -39,7 +39,7 @@ private:
     HTMLBRElement(const QualifiedName&, Document*);
 
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 };
diff --git a/Source/WebCore/html/HTMLBaseElement.cpp b/Source/WebCore/html/HTMLBaseElement.cpp
index b76b61a90..e970f4069 100644
--- a/Source/WebCore/html/HTMLBaseElement.cpp
+++ b/Source/WebCore/html/HTMLBaseElement.cpp
@@ -42,9 +42,9 @@ PassRefPtr<HTMLBaseElement> HTMLBaseElement::create(const QualifiedName& tagName
     return adoptRef(new HTMLBaseElement(tagName, document));
 }
 
-void HTMLBaseElement::parseAttribute(Attribute* attribute)
+void HTMLBaseElement::parseAttribute(const Attribute& attribute)
 {
-    if (attribute->name() == hrefAttr || attribute->name() == targetAttr)
+    if (attribute.name() == hrefAttr || attribute.name() == targetAttr)
         document()->processBaseElement();
     else
         HTMLElement::parseAttribute(attribute);
diff --git a/Source/WebCore/html/HTMLBaseElement.h b/Source/WebCore/html/HTMLBaseElement.h
index 97343ac3d..3b8a81c30 100644
--- a/Source/WebCore/html/HTMLBaseElement.h
+++ b/Source/WebCore/html/HTMLBaseElement.h
@@ -36,7 +36,7 @@ private:
 
     virtual String target() const;
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void removedFrom(Node*) OVERRIDE;
 };
diff --git a/Source/WebCore/html/HTMLBodyElement.cpp b/Source/WebCore/html/HTMLBodyElement.cpp
index 4c3862d89..735006b45 100644
--- a/Source/WebCore/html/HTMLBodyElement.cpp
+++ b/Source/WebCore/html/HTMLBodyElement.cpp
@@ -68,45 +68,45 @@ bool HTMLBodyElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLBodyElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLBodyElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == backgroundAttr) {
-        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
+    if (attribute.name() == backgroundAttr) {
+        String url = stripLeadingAndTrailingHTMLSpaces(attribute.value());
         if (!url.isEmpty())
             style->setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document()->completeURL(url).string())));
-    } else if (attr->name() == marginwidthAttr || attr->name() == leftmarginAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
-    } else if (attr->name() == marginheightAttr || attr->name() == topmarginAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
-    } else if (attr->name() == bgcolorAttr) {
-        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
-    } else if (attr->name() == textAttr) {
-        addHTMLColorToStyle(style, CSSPropertyColor, attr->value());
-    } else if (attr->name() == bgpropertiesAttr) {
-        if (equalIgnoringCase(attr->value(), "fixed"))
+    } else if (attribute.name() == marginwidthAttr || attribute.name() == leftmarginAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attribute.value());
+    } else if (attribute.name() == marginheightAttr || attribute.name() == topmarginAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attribute.value());
+    } else if (attribute.name() == bgcolorAttr) {
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attribute.value());
+    } else if (attribute.name() == textAttr) {
+        addHTMLColorToStyle(style, CSSPropertyColor, attribute.value());
+    } else if (attribute.name() == bgpropertiesAttr) {
+        if (equalIgnoringCase(attribute.value(), "fixed"))
            addPropertyToAttributeStyle(style, CSSPropertyBackgroundAttachment, CSSValueFixed);
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLBodyElement::parseAttribute(Attribute* attr)
+void HTMLBodyElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == vlinkAttr || attr->name() == alinkAttr || attr->name() == linkAttr) {
-        if (attr->isNull()) {
-            if (attr->name() == linkAttr)
+    if (attribute.name() == vlinkAttr || attribute.name() == alinkAttr || attribute.name() == linkAttr) {
+        if (attribute.isNull()) {
+            if (attribute.name() == linkAttr)
                 document()->resetLinkColor();
-            else if (attr->name() == vlinkAttr)
+            else if (attribute.name() == vlinkAttr)
                 document()->resetVisitedLinkColor();
             else
                 document()->resetActiveLinkColor();
         } else {
             RGBA32 color;
-            if (CSSParser::parseColor(color, attr->value(), !document()->inQuirksMode())) {
-                if (attr->name() == linkAttr)
+            if (CSSParser::parseColor(color, attribute.value(), !document()->inQuirksMode())) {
+                if (attribute.name() == linkAttr)
                     document()->setLinkColor(color);
-                else if (attr->name() == vlinkAttr)
+                else if (attribute.name() == vlinkAttr)
                     document()->setVisitedLinkColor(color);
                 else
                     document()->setActiveLinkColor(color);
@@ -114,42 +114,42 @@ void HTMLBodyElement::parseAttribute(Attribute* attr)
         }
 
         setNeedsStyleRecalc();
-    } else if (attr->name() == onloadAttr)
-        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onbeforeunloadAttr)
-        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onunloadAttr)
-        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onpagehideAttr)
-        document()->setWindowAttributeEventListener(eventNames().pagehideEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onpageshowAttr)
-        document()->setWindowAttributeEventListener(eventNames().pageshowEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onpopstateAttr)
-        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onblurAttr)
-        document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onfocusAttr)
-        document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
+    } else if (attribute.name() == onloadAttr)
+        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onbeforeunloadAttr)
+        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onunloadAttr)
+        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onpagehideAttr)
+        document()->setWindowAttributeEventListener(eventNames().pagehideEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onpageshowAttr)
+        document()->setWindowAttributeEventListener(eventNames().pageshowEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onpopstateAttr)
+        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onblurAttr)
+        document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onfocusAttr)
+        document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attribute));
 #if ENABLE(ORIENTATION_EVENTS)
-    else if (attr->name() == onorientationchangeAttr)
-        document()->setWindowAttributeEventListener(eventNames().orientationchangeEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attribute.name() == onorientationchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().orientationchangeEvent, createAttributeEventListener(document()->frame(), attribute));
 #endif
-    else if (attr->name() == onhashchangeAttr)
-        document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onresizeAttr)
-        document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onscrollAttr)
-        document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onselectionchangeAttr)
-        document()->setAttributeEventListener(eventNames().selectionchangeEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onstorageAttr)
-        document()->setWindowAttributeEventListener(eventNames().storageEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == ononlineAttr)
-        document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onofflineAttr)
-        document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attribute.name() == onhashchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onresizeAttr)
+        document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onscrollAttr)
+        document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onselectionchangeAttr)
+        document()->setAttributeEventListener(eventNames().selectionchangeEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onstorageAttr)
+        document()->setWindowAttributeEventListener(eventNames().storageEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == ononlineAttr)
+        document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onofflineAttr)
+        document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attribute));
     else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 Node::InsertionNotificationRequest HTMLBodyElement::insertedInto(Node* insertionPoint)
diff --git a/Source/WebCore/html/HTMLBodyElement.h b/Source/WebCore/html/HTMLBodyElement.h
index bdebda956..1089f70f1 100644
--- a/Source/WebCore/html/HTMLBodyElement.h
+++ b/Source/WebCore/html/HTMLBodyElement.h
@@ -70,9 +70,9 @@ public:
 private:
     HTMLBodyElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void didNotifyDescendantInseretions(Node*) OVERRIDE;
diff --git a/Source/WebCore/html/HTMLButtonElement.cpp b/Source/WebCore/html/HTMLButtonElement.cpp
index 24ee7769b..87207e700 100644
--- a/Source/WebCore/html/HTMLButtonElement.cpp
+++ b/Source/WebCore/html/HTMLButtonElement.cpp
@@ -90,18 +90,18 @@ bool HTMLButtonElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLFormControlElement::isPresentationAttribute(name);
 }
 
-void HTMLButtonElement::parseAttribute(Attribute* attr)
+void HTMLButtonElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == typeAttr) {
-        if (equalIgnoringCase(attr->value(), "reset"))
+    if (attribute.name() == typeAttr) {
+        if (equalIgnoringCase(attribute.value(), "reset"))
             m_type = RESET;
-        else if (equalIgnoringCase(attr->value(), "button"))
+        else if (equalIgnoringCase(attribute.value(), "button"))
             m_type = BUTTON;
         else
             m_type = SUBMIT;
         setNeedsWillValidateCheck();
     } else
-        HTMLFormControlElement::parseAttribute(attr);
+        HTMLFormControlElement::parseAttribute(attribute);
 }
 
 void HTMLButtonElement::defaultEventHandler(Event* event)
diff --git a/Source/WebCore/html/HTMLButtonElement.h b/Source/WebCore/html/HTMLButtonElement.h
index 8ddb03efe..c8dd27edf 100644
--- a/Source/WebCore/html/HTMLButtonElement.h
+++ b/Source/WebCore/html/HTMLButtonElement.h
@@ -43,7 +43,7 @@ private:
         
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
     virtual bool appendFormData(FormDataList&, bool);
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index e8bf41fd2..8db3df2f3 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -116,12 +116,11 @@ HTMLCanvasElement::~HTMLCanvasElement()
     m_context.clear(); // Ensure this goes away before the ImageBuffer.
 }
 
-void HTMLCanvasElement::parseAttribute(Attribute* attr)
+void HTMLCanvasElement::parseAttribute(const Attribute& attribute)
 {
-    const QualifiedName& attrName = attr->name();
-    if (attrName == widthAttr || attrName == heightAttr)
+    if (attribute.name() == widthAttr || attribute.name() == heightAttr)
         reset();
-    HTMLElement::parseAttribute(attr);
+    HTMLElement::parseAttribute(attribute);
 }
 
 RenderObject* HTMLCanvasElement::createRenderer(RenderArena* arena, RenderStyle* style)
diff --git a/Source/WebCore/html/HTMLCanvasElement.h b/Source/WebCore/html/HTMLCanvasElement.h
index 6872021fa..b83162083 100644
--- a/Source/WebCore/html/HTMLCanvasElement.h
+++ b/Source/WebCore/html/HTMLCanvasElement.h
@@ -140,7 +140,7 @@ public:
 private:
     HTMLCanvasElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     void reset();
diff --git a/Source/WebCore/html/HTMLDetailsElement.cpp b/Source/WebCore/html/HTMLDetailsElement.cpp
index 6101501ef..4d0652a4b 100644
--- a/Source/WebCore/html/HTMLDetailsElement.cpp
+++ b/Source/WebCore/html/HTMLDetailsElement.cpp
@@ -127,15 +127,15 @@ Element* HTMLDetailsElement::findMainSummary() const
     return static_cast<DetailsSummaryElement*>(shadow()->oldestShadowRoot()->firstChild())->fallbackSummary();
 }
 
-void HTMLDetailsElement::parseAttribute(Attribute* attr)
+void HTMLDetailsElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == openAttr) {
+    if (attribute.name() == openAttr) {
         bool oldValue = m_isOpen;
-        m_isOpen =  !attr->value().isNull();
+        m_isOpen =  !attribute.isNull();
         if (oldValue != m_isOpen)
             reattachIfAttached();
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 bool HTMLDetailsElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
diff --git a/Source/WebCore/html/HTMLDetailsElement.h b/Source/WebCore/html/HTMLDetailsElement.h
index 94e88334d..ca6397c5b 100644
--- a/Source/WebCore/html/HTMLDetailsElement.h
+++ b/Source/WebCore/html/HTMLDetailsElement.h
@@ -37,7 +37,7 @@ private:
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     void createShadowSubtree();
 
diff --git a/Source/WebCore/html/HTMLDivElement.cpp b/Source/WebCore/html/HTMLDivElement.cpp
index 24efd8646..6b2036e5e 100644
--- a/Source/WebCore/html/HTMLDivElement.cpp
+++ b/Source/WebCore/html/HTMLDivElement.cpp
@@ -55,19 +55,19 @@ bool HTMLDivElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLDivElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLDivElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == alignAttr) {
-        if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
+    if (attribute.name() == alignAttr) {
+        if (equalIgnoringCase(attribute.value(), "middle") || equalIgnoringCase(attribute.value(), "center"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitCenter);
-        else if (equalIgnoringCase(attr->value(), "left"))
+        else if (equalIgnoringCase(attribute.value(), "left"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitLeft);
-        else if (equalIgnoringCase(attr->value(), "right"))
+        else if (equalIgnoringCase(attribute.value(), "right"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitRight);
         else
-            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attribute.value());
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLDivElement.h b/Source/WebCore/html/HTMLDivElement.h
index 6a3dac3b3..b916dd8d1 100644
--- a/Source/WebCore/html/HTMLDivElement.h
+++ b/Source/WebCore/html/HTMLDivElement.h
@@ -37,7 +37,7 @@ protected:
 
 private:
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index d367f9bba..1fa249601 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -130,29 +130,27 @@ static inline int unicodeBidiAttributeForDirAuto(HTMLElement* element)
     return CSSValueWebkitIsolate;
 }
 
-static unsigned parseBorderWidthAttribute(Attribute* attr)
+static unsigned parseBorderWidthAttribute(const Attribute& attribute)
 {
-    ASSERT(attr && attr->name() == borderAttr);
-
+    ASSERT(attribute.name() == borderAttr);
     unsigned borderWidth = 0;
-    if (!attr->value().isEmpty())
-        parseHTMLNonNegativeInteger(attr->value(), borderWidth);
-
+    if (!attribute.isEmpty())
+        parseHTMLNonNegativeInteger(attribute.value(), borderWidth);
     return borderWidth;
 }
 
-void HTMLElement::applyBorderAttributeToStyle(Attribute* attr, StylePropertySet* style)
+void HTMLElement::applyBorderAttributeToStyle(const Attribute& attribute, StylePropertySet* style)
 {
-    addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, parseBorderWidthAttribute(attr), CSSPrimitiveValue::CSS_PX);
+    addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, parseBorderWidthAttribute(attribute), CSSPrimitiveValue::CSS_PX);
     addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
 }
 
-void HTMLElement::mapLanguageAttributeToLocale(Attribute* attribute, StylePropertySet* style)
+void HTMLElement::mapLanguageAttributeToLocale(const Attribute& attribute, StylePropertySet* style)
 {
-    ASSERT(attribute && (attribute->name() == langAttr || attribute->name().matches(XMLNames::langAttr)));
-    if (!attribute->isEmpty()) {
+    ASSERT((attribute.name() == langAttr || attribute.name().matches(XMLNames::langAttr)));
+    if (!attribute.isEmpty()) {
         // Have to quote so the locale id is treated as a string instead of as a CSS keyword.
-        addPropertyToAttributeStyle(style, CSSPropertyWebkitLocale, quoteCSSString(attribute->value()));
+        addPropertyToAttributeStyle(style, CSSPropertyWebkitLocale, quoteCSSString(attribute.value()));
     } else {
         // The empty string means the language is explicitly unknown.
         addPropertyToAttributeStyle(style, CSSPropertyWebkitLocale, CSSValueAuto);
@@ -166,168 +164,168 @@ bool HTMLElement::isPresentationAttribute(const QualifiedName& name) const
     return StyledElement::isPresentationAttribute(name);
 }
 
-void HTMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == alignAttr) {
-        if (equalIgnoringCase(attr->value(), "middle"))
+    if (attribute.name() == alignAttr) {
+        if (equalIgnoringCase(attribute.value(), "middle"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueCenter);
         else
-            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
-    } else if (attr->name() == contenteditableAttr) {
-        if (attr->isEmpty() || equalIgnoringCase(attr->value(), "true")) {
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attribute.value());
+    } else if (attribute.name() == contenteditableAttr) {
+        if (attribute.isEmpty() || equalIgnoringCase(attribute.value(), "true")) {
             addPropertyToAttributeStyle(style, CSSPropertyWebkitUserModify, CSSValueReadWrite);
             addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueBreakWord);
             addPropertyToAttributeStyle(style, CSSPropertyWebkitNbspMode, CSSValueSpace);
             addPropertyToAttributeStyle(style, CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
-        } else if (equalIgnoringCase(attr->value(), "plaintext-only")) {
+        } else if (equalIgnoringCase(attribute.value(), "plaintext-only")) {
             addPropertyToAttributeStyle(style, CSSPropertyWebkitUserModify, CSSValueReadWritePlaintextOnly);
             addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueBreakWord);
             addPropertyToAttributeStyle(style, CSSPropertyWebkitNbspMode, CSSValueSpace);
             addPropertyToAttributeStyle(style, CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
-        } else if (equalIgnoringCase(attr->value(), "false"))
+        } else if (equalIgnoringCase(attribute.value(), "false"))
             addPropertyToAttributeStyle(style, CSSPropertyWebkitUserModify, CSSValueReadOnly);
-    } else if (attr->name() == hiddenAttr) {
+    } else if (attribute.name() == hiddenAttr) {
         addPropertyToAttributeStyle(style, CSSPropertyDisplay, CSSValueNone);
-    } else if (attr->name() == draggableAttr) {
-        if (equalIgnoringCase(attr->value(), "true")) {
+    } else if (attribute.name() == draggableAttr) {
+        if (equalIgnoringCase(attribute.value(), "true")) {
             addPropertyToAttributeStyle(style, CSSPropertyWebkitUserDrag, CSSValueElement);
             addPropertyToAttributeStyle(style, CSSPropertyWebkitUserSelect, CSSValueNone);
-        } else if (equalIgnoringCase(attr->value(), "false"))
+        } else if (equalIgnoringCase(attribute.value(), "false"))
             addPropertyToAttributeStyle(style, CSSPropertyWebkitUserDrag, CSSValueNone);
-    } else if (attr->name() == dirAttr) {
-        if (equalIgnoringCase(attr->value(), "auto"))
+    } else if (attribute.name() == dirAttr) {
+        if (equalIgnoringCase(attribute.value(), "auto"))
             addPropertyToAttributeStyle(style, CSSPropertyUnicodeBidi, unicodeBidiAttributeForDirAuto(this));
         else {
-            addPropertyToAttributeStyle(style, CSSPropertyDirection, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyDirection, attribute.value());
             if (!hasTagName(bdiTag) && !hasTagName(bdoTag) && !hasTagName(outputTag))
                 addPropertyToAttributeStyle(style, CSSPropertyUnicodeBidi, CSSValueEmbed);
         }
-    } else if (attr->name().matches(XMLNames::langAttr)) {
-        mapLanguageAttributeToLocale(attr, style);
-    } else if (attr->name() == langAttr) {
+    } else if (attribute.name().matches(XMLNames::langAttr)) {
+        mapLanguageAttributeToLocale(attribute, style);
+    } else if (attribute.name() == langAttr) {
         // xml:lang has a higher priority than lang.
         if (!fastHasAttribute(XMLNames::langAttr))
-            mapLanguageAttributeToLocale(attr, style);
+            mapLanguageAttributeToLocale(attribute, style);
     } else
-        StyledElement::collectStyleForAttribute(attr, style);
+        StyledElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLElement::parseAttribute(Attribute* attr)
+void HTMLElement::parseAttribute(const Attribute& attribute)
 {
-    if (isIdAttributeName(attr->name()) || attr->name() == classAttr || attr->name() == styleAttr)
-        return StyledElement::parseAttribute(attr);
+    if (isIdAttributeName(attribute.name()) || attribute.name() == classAttr || attribute.name() == styleAttr)
+        return StyledElement::parseAttribute(attribute);
 
-    if (attr->name() == dirAttr)
-        dirAttributeChanged(attr);
-    else if (attr->name() == tabindexAttr) {
+    if (attribute.name() == dirAttr)
+        dirAttributeChanged(attribute);
+    else if (attribute.name() == tabindexAttr) {
         int tabindex = 0;
-        if (attr->isEmpty())
+        if (attribute.isEmpty())
             clearTabIndexExplicitly();
-        else if (parseHTMLInteger(attr->value(), tabindex)) {
+        else if (parseHTMLInteger(attribute.value(), tabindex)) {
             // Clamp tabindex to the range of 'short' to match Firefox's behavior.
             setTabIndexExplicitly(max(static_cast<int>(std::numeric_limits<short>::min()), min(tabindex, static_cast<int>(std::numeric_limits<short>::max()))));
         }
 #if ENABLE(MICRODATA)
-    } else if (attr->name() == itempropAttr) {
-        setItemProp(attr->value());
-    } else if (attr->name() == itemrefAttr) {
-        setItemRef(attr->value());
-    } else if (attr->name() == itemtypeAttr) {
-        setItemType(attr->value());
+    } else if (attribute.name() == itempropAttr) {
+        setItemProp(attribute.value());
+    } else if (attribute.name() == itemrefAttr) {
+        setItemRef(attribute.value());
+    } else if (attribute.name() == itemtypeAttr) {
+        setItemType(attribute.value());
 #endif
     }
 // standard events
-    else if (attr->name() == onclickAttr) {
-        setAttributeEventListener(eventNames().clickEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == oncontextmenuAttr) {
-        setAttributeEventListener(eventNames().contextmenuEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ondblclickAttr) {
-        setAttributeEventListener(eventNames().dblclickEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onmousedownAttr) {
-        setAttributeEventListener(eventNames().mousedownEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onmousemoveAttr) {
-        setAttributeEventListener(eventNames().mousemoveEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onmouseoutAttr) {
-        setAttributeEventListener(eventNames().mouseoutEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onmouseoverAttr) {
-        setAttributeEventListener(eventNames().mouseoverEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onmouseupAttr) {
-        setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onmousewheelAttr) {
-        setAttributeEventListener(eventNames().mousewheelEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onfocusAttr) {
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onfocusinAttr) {
-        setAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onfocusoutAttr) {
-        setAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onblurAttr) {
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onkeydownAttr) {
-        setAttributeEventListener(eventNames().keydownEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onkeypressAttr) {
-        setAttributeEventListener(eventNames().keypressEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onkeyupAttr) {
-        setAttributeEventListener(eventNames().keyupEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onscrollAttr) {
-        setAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onbeforecutAttr) {
-        setAttributeEventListener(eventNames().beforecutEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == oncutAttr) {
-        setAttributeEventListener(eventNames().cutEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onbeforecopyAttr) {
-        setAttributeEventListener(eventNames().beforecopyEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == oncopyAttr) {
-        setAttributeEventListener(eventNames().copyEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onbeforepasteAttr) {
-        setAttributeEventListener(eventNames().beforepasteEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onpasteAttr) {
-        setAttributeEventListener(eventNames().pasteEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ondragenterAttr) {
-        setAttributeEventListener(eventNames().dragenterEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ondragoverAttr) {
-        setAttributeEventListener(eventNames().dragoverEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ondragleaveAttr) {
-        setAttributeEventListener(eventNames().dragleaveEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ondropAttr) {
-        setAttributeEventListener(eventNames().dropEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ondragstartAttr) {
-        setAttributeEventListener(eventNames().dragstartEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ondragAttr) {
-        setAttributeEventListener(eventNames().dragEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ondragendAttr) {
-        setAttributeEventListener(eventNames().dragendEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onselectstartAttr) {
-        setAttributeEventListener(eventNames().selectstartEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onsubmitAttr) {
-        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onerrorAttr) {
-        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onwebkitanimationstartAttr) {
-        setAttributeEventListener(eventNames().webkitAnimationStartEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onwebkitanimationiterationAttr) {
-        setAttributeEventListener(eventNames().webkitAnimationIterationEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onwebkitanimationendAttr) {
-        setAttributeEventListener(eventNames().webkitAnimationEndEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onwebkittransitionendAttr) {
-        setAttributeEventListener(eventNames().webkitTransitionEndEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == oninputAttr) {
-        setAttributeEventListener(eventNames().inputEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == oninvalidAttr) {
-        setAttributeEventListener(eventNames().invalidEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ontouchstartAttr) {
-        setAttributeEventListener(eventNames().touchstartEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ontouchmoveAttr) {
-        setAttributeEventListener(eventNames().touchmoveEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ontouchendAttr) {
-        setAttributeEventListener(eventNames().touchendEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == ontouchcancelAttr) {
-        setAttributeEventListener(eventNames().touchcancelEvent, createAttributeEventListener(this, attr));
+    else if (attribute.name() == onclickAttr) {
+        setAttributeEventListener(eventNames().clickEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == oncontextmenuAttr) {
+        setAttributeEventListener(eventNames().contextmenuEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ondblclickAttr) {
+        setAttributeEventListener(eventNames().dblclickEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onmousedownAttr) {
+        setAttributeEventListener(eventNames().mousedownEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onmousemoveAttr) {
+        setAttributeEventListener(eventNames().mousemoveEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onmouseoutAttr) {
+        setAttributeEventListener(eventNames().mouseoutEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onmouseoverAttr) {
+        setAttributeEventListener(eventNames().mouseoverEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onmouseupAttr) {
+        setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onmousewheelAttr) {
+        setAttributeEventListener(eventNames().mousewheelEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onfocusAttr) {
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onfocusinAttr) {
+        setAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onfocusoutAttr) {
+        setAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onblurAttr) {
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onkeydownAttr) {
+        setAttributeEventListener(eventNames().keydownEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onkeypressAttr) {
+        setAttributeEventListener(eventNames().keypressEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onkeyupAttr) {
+        setAttributeEventListener(eventNames().keyupEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onscrollAttr) {
+        setAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onbeforecutAttr) {
+        setAttributeEventListener(eventNames().beforecutEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == oncutAttr) {
+        setAttributeEventListener(eventNames().cutEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onbeforecopyAttr) {
+        setAttributeEventListener(eventNames().beforecopyEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == oncopyAttr) {
+        setAttributeEventListener(eventNames().copyEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onbeforepasteAttr) {
+        setAttributeEventListener(eventNames().beforepasteEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onpasteAttr) {
+        setAttributeEventListener(eventNames().pasteEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ondragenterAttr) {
+        setAttributeEventListener(eventNames().dragenterEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ondragoverAttr) {
+        setAttributeEventListener(eventNames().dragoverEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ondragleaveAttr) {
+        setAttributeEventListener(eventNames().dragleaveEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ondropAttr) {
+        setAttributeEventListener(eventNames().dropEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ondragstartAttr) {
+        setAttributeEventListener(eventNames().dragstartEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ondragAttr) {
+        setAttributeEventListener(eventNames().dragEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ondragendAttr) {
+        setAttributeEventListener(eventNames().dragendEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onselectstartAttr) {
+        setAttributeEventListener(eventNames().selectstartEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onsubmitAttr) {
+        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onerrorAttr) {
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onwebkitanimationstartAttr) {
+        setAttributeEventListener(eventNames().webkitAnimationStartEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onwebkitanimationiterationAttr) {
+        setAttributeEventListener(eventNames().webkitAnimationIterationEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onwebkitanimationendAttr) {
+        setAttributeEventListener(eventNames().webkitAnimationEndEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onwebkittransitionendAttr) {
+        setAttributeEventListener(eventNames().webkitTransitionEndEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == oninputAttr) {
+        setAttributeEventListener(eventNames().inputEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == oninvalidAttr) {
+        setAttributeEventListener(eventNames().invalidEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ontouchstartAttr) {
+        setAttributeEventListener(eventNames().touchstartEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ontouchmoveAttr) {
+        setAttributeEventListener(eventNames().touchmoveEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ontouchendAttr) {
+        setAttributeEventListener(eventNames().touchendEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == ontouchcancelAttr) {
+        setAttributeEventListener(eventNames().touchcancelEvent, createAttributeEventListener(this, attribute));
 #if ENABLE(FULLSCREEN_API)
-    } else if (attr->name() == onwebkitfullscreenchangeAttr) {
-        setAttributeEventListener(eventNames().webkitfullscreenchangeEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onwebkitfullscreenerrorAttr) {
-        setAttributeEventListener(eventNames().webkitfullscreenerrorEvent, createAttributeEventListener(this, attr));
+    } else if (attribute.name() == onwebkitfullscreenchangeAttr) {
+        setAttributeEventListener(eventNames().webkitfullscreenchangeEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == onwebkitfullscreenerrorAttr) {
+        setAttributeEventListener(eventNames().webkitfullscreenerrorEvent, createAttributeEventListener(this, attribute));
 #endif
     }
 }
@@ -600,14 +598,14 @@ void HTMLElement::insertAdjacentText(const String& where, const String& text, Ex
     insertAdjacent(where, textNode.get(), ec);
 }
 
-void HTMLElement::applyAlignmentAttributeToStyle(Attribute* attr, StylePropertySet* style)
+void HTMLElement::applyAlignmentAttributeToStyle(const Attribute& attribute, StylePropertySet* style)
 {
     // Vertical alignment with respect to the current baseline of the text
     // right or left means floating images.
     int floatValue = CSSValueInvalid;
     int verticalAlignValue = CSSValueInvalid;
 
-    const AtomicString& alignment = attr->value();
+    const AtomicString& alignment = attribute.value();
     if (equalIgnoringCase(alignment, "absmiddle"))
         verticalAlignValue = CSSValueMiddle;
     else if (equalIgnoringCase(alignment, "absbottom"))
@@ -890,14 +888,14 @@ TextDirection HTMLElement::directionality(Node** strongDirectionalityTextNode) c
     return LTR;
 }
 
-void HTMLElement::dirAttributeChanged(Attribute* attribute)
+void HTMLElement::dirAttributeChanged(const Attribute& attribute)
 {
     Element* parent = parentElement();
 
     if (parent && parent->isHTMLElement() && parent->selfOrAncestorHasDirAutoAttribute())
         toHTMLElement(parent)->adjustDirectionalityIfNeededAfterChildAttributeChanged(this);
 
-    if (equalIgnoringCase(attribute->value(), "auto"))
+    if (equalIgnoringCase(attribute.value(), "auto"))
         calculateAndAdjustDirectionality();
 }
 
@@ -1110,25 +1108,6 @@ void HTMLElement::addHTMLColorToStyle(StylePropertySet* style, CSSPropertyID pro
     style->setProperty(propertyID, cssValuePool().createColorValue(parsedColor.rgb()));
 }
 
-void StyledElement::copyNonAttributeProperties(const Element* sourceElement)
-{
-    ASSERT(sourceElement);
-    ASSERT(sourceElement->isStyledElement());
-
-    const StyledElement* source = static_cast<const StyledElement*>(sourceElement);
-    if (!source->inlineStyle())
-        return;
-
-    StylePropertySet* inlineStyle = ensureAttributeData()->ensureMutableInlineStyle(this);
-    inlineStyle->copyPropertiesFrom(*source->inlineStyle());
-    inlineStyle->setCSSParserMode(source->inlineStyle()->cssParserMode());
-
-    setIsStyleAttributeValid(source->isStyleAttributeValid());
-
-    Element::copyNonAttributeProperties(sourceElement);
-}
-
-
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index 2529d2bf1..4eeab8cf6 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -111,12 +111,12 @@ protected:
     void addHTMLLengthToStyle(StylePropertySet*, CSSPropertyID, const String& value);
     void addHTMLColorToStyle(StylePropertySet*, CSSPropertyID, const String& color);
 
-    void applyAlignmentAttributeToStyle(Attribute*, StylePropertySet*);
-    void applyBorderAttributeToStyle(Attribute*, StylePropertySet*);
+    void applyAlignmentAttributeToStyle(const Attribute&, StylePropertySet*);
+    void applyBorderAttributeToStyle(const Attribute&, StylePropertySet*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     void calculateAndAdjustDirectionality();
@@ -126,14 +126,14 @@ protected:
 private:
     virtual String nodeName() const;
 
-    void mapLanguageAttributeToLocale(Attribute*, StylePropertySet*);
+    void mapLanguageAttributeToLocale(const Attribute&, StylePropertySet*);
 
     virtual HTMLFormElement* virtualForm() const;
 
     Node* insertAdjacent(const String& where, Node* newChild, ExceptionCode&);
     PassRefPtr<DocumentFragment> textToFragment(const String&, ExceptionCode&);
 
-    void dirAttributeChanged(Attribute*);
+    void dirAttributeChanged(const Attribute&);
     void adjustDirectionalityIfNeededAfterChildAttributeChanged(Element* child);
     void adjustDirectionalityIfNeededAfterChildrenChanged(Node* beforeChange, int childCountDelta);
     TextDirection directionality(Node** strongDirectionalityTextNode= 0) const;
diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index ffaabcd2a..b9c6e41da 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -81,39 +81,37 @@ bool HTMLEmbedElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLPlugInImageElement::isPresentationAttribute(name);
 }
 
-void HTMLEmbedElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLEmbedElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == hiddenAttr) {
-        if (equalIgnoringCase(attr->value(), "yes") || equalIgnoringCase(attr->value(), "true")) {
+    if (attribute.name() == hiddenAttr) {
+        if (equalIgnoringCase(attribute.value(), "yes") || equalIgnoringCase(attribute.value(), "true")) {
             addPropertyToAttributeStyle(style, CSSPropertyWidth, 0, CSSPrimitiveValue::CSS_PX);
             addPropertyToAttributeStyle(style, CSSPropertyHeight, 0, CSSPrimitiveValue::CSS_PX);
         }
     } else
-        HTMLPlugInImageElement::collectStyleForAttribute(attr, style);
+        HTMLPlugInImageElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLEmbedElement::parseAttribute(Attribute* attr)
+void HTMLEmbedElement::parseAttribute(const Attribute& attribute)
 {
-    const AtomicString& value = attr->value();
-  
-    if (attr->name() == typeAttr) {
-        m_serviceType = value.string().lower();
+    if (attribute.name() == typeAttr) {
+        m_serviceType = attribute.value().string().lower();
         size_t pos = m_serviceType.find(";");
         if (pos != notFound)
             m_serviceType = m_serviceType.left(pos);
         if (!isImageType() && m_imageLoader)
             m_imageLoader.clear();
-    } else if (attr->name() == codeAttr)
-        m_url = stripLeadingAndTrailingHTMLSpaces(value.string());
-    else if (attr->name() == srcAttr) {
-        m_url = stripLeadingAndTrailingHTMLSpaces(value.string());
+    } else if (attribute.name() == codeAttr)
+        m_url = stripLeadingAndTrailingHTMLSpaces(attribute.value());
+    else if (attribute.name() == srcAttr) {
+        m_url = stripLeadingAndTrailingHTMLSpaces(attribute.value());
         if (renderer() && isImageType()) {
             if (!m_imageLoader)
                 m_imageLoader = adoptPtr(new HTMLImageLoader(this));
             m_imageLoader->updateFromElementIgnoringPreviousError();
         }
     } else
-        HTMLPlugInImageElement::parseAttribute(attr);
+        HTMLPlugInImageElement::parseAttribute(attribute);
 }
 
 void HTMLEmbedElement::parametersForPlugin(Vector<String>& paramNames, Vector<String>& paramValues)
diff --git a/Source/WebCore/html/HTMLEmbedElement.h b/Source/WebCore/html/HTMLEmbedElement.h
index 8597dfdf2..ba828a172 100644
--- a/Source/WebCore/html/HTMLEmbedElement.h
+++ b/Source/WebCore/html/HTMLEmbedElement.h
@@ -34,9 +34,9 @@ public:
 private:
     HTMLEmbedElement(const QualifiedName&, Document*, bool createdByParser);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
diff --git a/Source/WebCore/html/HTMLFontElement.cpp b/Source/WebCore/html/HTMLFontElement.cpp
index 9582fff7d..d6559d614 100644
--- a/Source/WebCore/html/HTMLFontElement.cpp
+++ b/Source/WebCore/html/HTMLFontElement.cpp
@@ -168,19 +168,19 @@ bool HTMLFontElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLFontElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLFontElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == sizeAttr) {
+    if (attribute.name() == sizeAttr) {
         int size = 0;
-        if (cssValueFromFontSizeNumber(attr->value(), size))
+        if (cssValueFromFontSizeNumber(attribute.value(), size))
             addPropertyToAttributeStyle(style, CSSPropertyFontSize, size);
-    } else if (attr->name() == colorAttr)
-        addHTMLColorToStyle(style, CSSPropertyColor, attr->value());
-    else if (attr->name() == faceAttr) {
-        if (RefPtr<CSSValueList> fontFaceValue = cssValuePool().createFontFaceValue(attr->value()))
+    } else if (attribute.name() == colorAttr)
+        addHTMLColorToStyle(style, CSSPropertyColor, attribute.value());
+    else if (attribute.name() == faceAttr) {
+        if (RefPtr<CSSValueList> fontFaceValue = cssValuePool().createFontFaceValue(attribute.value()))
             style->setProperty(CSSProperty(CSSPropertyFontFamily, fontFaceValue.release()));
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLFontElement.h b/Source/WebCore/html/HTMLFontElement.h
index 5ebbae9cb..a21d99a57 100644
--- a/Source/WebCore/html/HTMLFontElement.h
+++ b/Source/WebCore/html/HTMLFontElement.h
@@ -38,7 +38,7 @@ private:
     HTMLFontElement(const QualifiedName&, Document*);
 
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index 2f9f225bc..f195ec027 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -63,7 +63,7 @@ HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Doc
     , m_hasAutofocused(false)
 {
     setForm(form ? form : findFormAncestor());
-    setHasCustomWillOrDidRecalcStyle();
+    setHasCustomCallbacks();
 }
 
 HTMLFormControlElement::~HTMLFormControlElement()
@@ -116,30 +116,30 @@ void HTMLFormControlElement::updateFieldSetAndLegendAncestor() const
     m_fieldSetAncestorValid = true;
 }
 
-void HTMLFormControlElement::parseAttribute(Attribute* attr)
+void HTMLFormControlElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == formAttr)
+    if (attribute.name() == formAttr)
         formAttributeChanged();
-    else if (attr->name() == disabledAttr) {
+    else if (attribute.name() == disabledAttr) {
         bool oldDisabled = m_disabled;
-        m_disabled = !attr->isNull();
+        m_disabled = !attribute.isNull();
         if (oldDisabled != m_disabled)
             disabledAttributeChanged();
-    } else if (attr->name() == readonlyAttr) {
+    } else if (attribute.name() == readonlyAttr) {
         bool oldReadOnly = m_readOnly;
-        m_readOnly = !attr->isNull();
+        m_readOnly = !attribute.isNull();
         if (oldReadOnly != m_readOnly) {
             setNeedsStyleRecalc();
             if (renderer() && renderer()->style()->hasAppearance())
                 renderer()->theme()->stateChanged(renderer(), ReadOnlyState);
         }
-    } else if (attr->name() == requiredAttr) {
+    } else if (attribute.name() == requiredAttr) {
         bool oldRequired = m_required;
-        m_required = !attr->isNull();
+        m_required = !attribute.isNull();
         if (oldRequired != m_required)
             requiredAttributeChanged();
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
     setNeedsWillValidateCheck();
 }
 
@@ -397,11 +397,6 @@ void HTMLFormControlElement::setNeedsWillValidateCheck()
         hideVisibleValidationMessage();
 }
 
-String HTMLFormControlElement::validationMessage()
-{
-    return validity()->validationMessage();
-}
-
 void HTMLFormControlElement::updateVisibleValidationMessage()
 {
     Page* page = document()->page();
@@ -484,7 +479,8 @@ void HTMLFormControlElement::setNeedsValidityCheck()
 
 void HTMLFormControlElement::setCustomValidity(const String& error)
 {
-    validity()->setCustomErrorMessage(error);
+    FormAssociatedElement::setCustomValidity(error);
+    setNeedsValidityCheck();
 }
 
 void HTMLFormControlElement::dispatchBlurEvent(PassRefPtr<Node> newFocusedNode)
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index 608411f36..d4bdd679b 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -95,13 +95,12 @@ public:
     virtual void setActivatedSubmit(bool) { }
 
     virtual bool willValidate() const;
-    String validationMessage();
     void updateVisibleValidationMessage();
     void hideVisibleValidationMessage();
     bool checkValidity(Vector<RefPtr<FormAssociatedElement> >* unhandledInvalidControls = 0);
     // This must be called when a validation constraint or control value is changed.
     void setNeedsValidityCheck();
-    void setCustomValidity(const String&);
+    virtual void setCustomValidity(const String&) OVERRIDE;
 
     bool readOnly() const { return m_readOnly; }
 
@@ -116,7 +115,7 @@ public:
 protected:
     HTMLFormControlElement(const QualifiedName& tagName, Document*, HTMLFormElement*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void requiredAttributeChanged();
     virtual void disabledAttributeChanged();
     virtual void attach();
@@ -128,7 +127,7 @@ protected:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
 
-    virtual void didRecalcStyle(StyleChange);
+    virtual void didRecalcStyle(StyleChange) OVERRIDE;
 
     virtual void dispatchBlurEvent(PassRefPtr<Node> newFocusedNode);
     virtual void detach();
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index 774be4c14..472d80430 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -398,29 +398,29 @@ void HTMLFormElement::reset()
     m_isInResetFunction = false;
 }
 
-void HTMLFormElement::parseAttribute(Attribute* attr)
-{
-    if (attr->name() == actionAttr)
-        m_attributes.parseAction(attr->value());
-    else if (attr->name() == targetAttr)
-        m_attributes.setTarget(attr->value());
-    else if (attr->name() == methodAttr)
-        m_attributes.updateMethodType(attr->value());
-    else if (attr->name() == enctypeAttr)
-        m_attributes.updateEncodingType(attr->value());
-    else if (attr->name() == accept_charsetAttr)
-        m_attributes.setAcceptCharset(attr->value());
-    else if (attr->name() == autocompleteAttr) {
+void HTMLFormElement::parseAttribute(const Attribute& attribute)
+{
+    if (attribute.name() == actionAttr)
+        m_attributes.parseAction(attribute.value());
+    else if (attribute.name() == targetAttr)
+        m_attributes.setTarget(attribute.value());
+    else if (attribute.name() == methodAttr)
+        m_attributes.updateMethodType(attribute.value());
+    else if (attribute.name() == enctypeAttr)
+        m_attributes.updateEncodingType(attribute.value());
+    else if (attribute.name() == accept_charsetAttr)
+        m_attributes.setAcceptCharset(attribute.value());
+    else if (attribute.name() == autocompleteAttr) {
         if (!shouldAutocomplete())
             document()->registerForPageCacheSuspensionCallbacks(this);
         else
             document()->unregisterForPageCacheSuspensionCallbacks(this);
-    } else if (attr->name() == onsubmitAttr)
-        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onresetAttr)
-        setAttributeEventListener(eventNames().resetEvent, createAttributeEventListener(this, attr));
+    } else if (attribute.name() == onsubmitAttr)
+        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onresetAttr)
+        setAttributeEventListener(eventNames().resetEvent, createAttributeEventListener(this, attribute));
     else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 template<class T, size_t n> static void removeFromVector(Vector<T*, n> & vec, T* item)
diff --git a/Source/WebCore/html/HTMLFormElement.h b/Source/WebCore/html/HTMLFormElement.h
index 6bfe5cb88..b7bb05448 100644
--- a/Source/WebCore/html/HTMLFormElement.h
+++ b/Source/WebCore/html/HTMLFormElement.h
@@ -123,7 +123,7 @@ private:
 
     virtual void handleLocalEvents(Event*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
 
     virtual void documentDidResumeFromPageCache();
diff --git a/Source/WebCore/html/HTMLFrameElement.cpp b/Source/WebCore/html/HTMLFrameElement.cpp
index b346494c4..3d15c8b5f 100644
--- a/Source/WebCore/html/HTMLFrameElement.cpp
+++ b/Source/WebCore/html/HTMLFrameElement.cpp
@@ -82,17 +82,17 @@ void HTMLFrameElement::attach()
     }
 }
 
-void HTMLFrameElement::parseAttribute(Attribute* attr)
+void HTMLFrameElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == frameborderAttr) {
-        m_frameBorder = attr->value().toInt();
-        m_frameBorderSet = !attr->isNull();
+    if (attribute.name() == frameborderAttr) {
+        m_frameBorder = attribute.value().toInt();
+        m_frameBorderSet = !attribute.isNull();
         // FIXME: If we are already attached, this has no effect.
-    } else if (attr->name() == noresizeAttr) {
+    } else if (attribute.name() == noresizeAttr) {
         if (renderer())
             renderer()->updateFromElement();
     } else
-        HTMLFrameElementBase::parseAttribute(attr);
+        HTMLFrameElementBase::parseAttribute(attribute);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLFrameElement.h b/Source/WebCore/html/HTMLFrameElement.h
index f43ea8c8a..86e608da0 100644
--- a/Source/WebCore/html/HTMLFrameElement.h
+++ b/Source/WebCore/html/HTMLFrameElement.h
@@ -44,7 +44,7 @@ private:
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
 #if ENABLE(FULLSCREEN_API)
     virtual bool allowFullScreen() const { return false; }
diff --git a/Source/WebCore/html/HTMLFrameElementBase.cpp b/Source/WebCore/html/HTMLFrameElementBase.cpp
index 3b6037dcd..8e1cb6f9a 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.cpp
+++ b/Source/WebCore/html/HTMLFrameElementBase.cpp
@@ -102,47 +102,47 @@ void HTMLFrameElementBase::openURL(bool lockHistory, bool lockBackForwardList)
         contentFrame()->setInViewSourceMode(viewSourceMode());
 }
 
-void HTMLFrameElementBase::parseAttribute(Attribute* attr)
+void HTMLFrameElementBase::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == srcdocAttr)
+    if (attribute.name() == srcdocAttr)
         setLocation("about:srcdoc");
-    else if (attr->name() == srcAttr && !fastHasAttribute(srcdocAttr))
-        setLocation(stripLeadingAndTrailingHTMLSpaces(attr->value()));
-    else if (isIdAttributeName(attr->name())) {
+    else if (attribute.name() == srcAttr && !fastHasAttribute(srcdocAttr))
+        setLocation(stripLeadingAndTrailingHTMLSpaces(attribute.value()));
+    else if (isIdAttributeName(attribute.name())) {
         // Important to call through to base for the id attribute so the hasID bit gets set.
-        HTMLFrameOwnerElement::parseAttribute(attr);
-        m_frameName = attr->value();
-    } else if (attr->name() == nameAttr) {
-        m_frameName = attr->value();
+        HTMLFrameOwnerElement::parseAttribute(attribute);
+        m_frameName = attribute.value();
+    } else if (attribute.name() == nameAttr) {
+        m_frameName = attribute.value();
         // FIXME: If we are already attached, this doesn't actually change the frame's name.
         // FIXME: If we are already attached, this doesn't check for frame name
         // conflicts and generate a unique frame name.
-    } else if (attr->name() == marginwidthAttr) {
-        m_marginWidth = attr->value().toInt();
+    } else if (attribute.name() == marginwidthAttr) {
+        m_marginWidth = attribute.value().toInt();
         // FIXME: If we are already attached, this has no effect.
-    } else if (attr->name() == marginheightAttr) {
-        m_marginHeight = attr->value().toInt();
+    } else if (attribute.name() == marginheightAttr) {
+        m_marginHeight = attribute.value().toInt();
         // FIXME: If we are already attached, this has no effect.
-    } else if (attr->name() == scrollingAttr) {
+    } else if (attribute.name() == scrollingAttr) {
         // Auto and yes both simply mean "allow scrolling." No means "don't allow scrolling."
-        if (equalIgnoringCase(attr->value(), "auto") || equalIgnoringCase(attr->value(), "yes"))
+        if (equalIgnoringCase(attribute.value(), "auto") || equalIgnoringCase(attribute.value(), "yes"))
             m_scrolling = document()->frameElementsShouldIgnoreScrolling() ? ScrollbarAlwaysOff : ScrollbarAuto;
-        else if (equalIgnoringCase(attr->value(), "no"))
+        else if (equalIgnoringCase(attribute.value(), "no"))
             m_scrolling = ScrollbarAlwaysOff;
         // FIXME: If we are already attached, this has no effect.
-    } else if (attr->name() == viewsourceAttr) {
-        m_viewSource = !attr->isNull();
+    } else if (attribute.name() == viewsourceAttr) {
+        m_viewSource = !attribute.isNull();
         if (contentFrame())
             contentFrame()->setInViewSourceMode(viewSourceMode());
-    } else if (attr->name() == onloadAttr)
-        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onbeforeloadAttr)
-        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onbeforeunloadAttr) {
+    } else if (attribute.name() == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onbeforeunloadAttr) {
         // FIXME: should <frame> elements have beforeunload handlers?
-        setAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(this, attr));
+        setAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(this, attribute));
     } else
-        HTMLFrameOwnerElement::parseAttribute(attr);
+        HTMLFrameOwnerElement::parseAttribute(attribute);
 }
 
 void HTMLFrameElementBase::setNameAndOpenURL()
diff --git a/Source/WebCore/html/HTMLFrameElementBase.h b/Source/WebCore/html/HTMLFrameElementBase.h
index 081b446fa..91c719606 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.h
+++ b/Source/WebCore/html/HTMLFrameElementBase.h
@@ -53,7 +53,7 @@ protected:
 
     bool isURLAllowed() const;
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void didNotifyDescendantInseretions(Node*) OVERRIDE;
     virtual void attach();
diff --git a/Source/WebCore/html/HTMLFrameOwnerElement.cpp b/Source/WebCore/html/HTMLFrameOwnerElement.cpp
index 58f385b29..6b706602d 100644
--- a/Source/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/Source/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -51,6 +51,7 @@ RenderPart* HTMLFrameOwnerElement::renderPart() const
 
 void HTMLFrameOwnerElement::disconnectContentFrame()
 {
+    ASSERT(hasCustomCallbacks());
     // This causes an unload event thus cannot be a part of removedFrom().
     if (Frame* frame = contentFrame()) {
         RefPtr<Frame> protect(frame);
diff --git a/Source/WebCore/html/HTMLFrameOwnerElement.h b/Source/WebCore/html/HTMLFrameOwnerElement.h
index 227622f17..5e2426a7d 100644
--- a/Source/WebCore/html/HTMLFrameOwnerElement.h
+++ b/Source/WebCore/html/HTMLFrameOwnerElement.h
@@ -64,6 +64,7 @@ private:
     friend class Frame;
 
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isFrameOwnerElement() const OVERRIDE { return true; }
 
     Frame* m_contentFrame;
     SandboxFlags m_sandboxFlags;
diff --git a/Source/WebCore/html/HTMLFrameSetElement.cpp b/Source/WebCore/html/HTMLFrameSetElement.cpp
index 8b36dbf07..c51ecc310 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.cpp
+++ b/Source/WebCore/html/HTMLFrameSetElement.cpp
@@ -56,7 +56,7 @@ HTMLFrameSetElement::HTMLFrameSetElement(const QualifiedName& tagName, Document*
 {
     ASSERT(hasTagName(framesetTag));
     
-    setHasCustomWillOrDidRecalcStyle();
+    setHasCustomCallbacks();
 }
 
 PassRefPtr<HTMLFrameSetElement> HTMLFrameSetElement::create(const QualifiedName& tagName, Document* document)
@@ -71,30 +71,30 @@ bool HTMLFrameSetElement::isPresentationAttribute(const QualifiedName& name) con
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLFrameSetElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLFrameSetElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == bordercolorAttr)
-        addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+    if (attribute.name() == bordercolorAttr)
+        addHTMLColorToStyle(style, CSSPropertyBorderColor, attribute.value());
     else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLFrameSetElement::parseAttribute(Attribute* attr)
+void HTMLFrameSetElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == rowsAttr) {
-        if (!attr->isNull()) {
-            m_rowLengths = newLengthArray(attr->value().string(), m_totalRows);
+    if (attribute.name() == rowsAttr) {
+        if (!attribute.isNull()) {
+            m_rowLengths = newLengthArray(attribute.value().string(), m_totalRows);
             setNeedsStyleRecalc();
         }
-    } else if (attr->name() == colsAttr) {
-        if (!attr->isNull()) {
-            m_colLengths = newLengthArray(attr->value().string(), m_totalCols);
+    } else if (attribute.name() == colsAttr) {
+        if (!attribute.isNull()) {
+            m_colLengths = newLengthArray(attribute.value().string(), m_totalCols);
             setNeedsStyleRecalc();
         }
-    } else if (attr->name() == frameborderAttr) {
-        if (!attr->isNull()) {
+    } else if (attribute.name() == frameborderAttr) {
+        if (!attribute.isNull()) {
             // false or "no" or "0"..
-            if (attr->value().toInt() == 0) {
+            if (attribute.value().toInt() == 0) {
                 m_frameborder = false;
                 m_border = 0;
             }
@@ -103,52 +103,52 @@ void HTMLFrameSetElement::parseAttribute(Attribute* attr)
             m_frameborder = false;
             m_frameborderSet = false;
         }
-    } else if (attr->name() == noresizeAttr) {
+    } else if (attribute.name() == noresizeAttr) {
         m_noresize = true;
-    } else if (attr->name() == borderAttr) {
-        if (!attr->isNull()) {
-            m_border = attr->value().toInt();
+    } else if (attribute.name() == borderAttr) {
+        if (!attribute.isNull()) {
+            m_border = attribute.value().toInt();
             if (!m_border)
                 m_frameborder = false;
             m_borderSet = true;
         } else
             m_borderSet = false;
-    } else if (attr->name() == bordercolorAttr)
-        m_borderColorSet = !attr->isEmpty();
-    else if (attr->name() == onloadAttr)
-        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onbeforeunloadAttr)
-        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onunloadAttr)
-        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onblurAttr)
-        document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onfocusAttr)
-        document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onfocusinAttr)
-        document()->setWindowAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onfocusoutAttr)
-        document()->setWindowAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(document()->frame(), attr));
+    } else if (attribute.name() == bordercolorAttr)
+        m_borderColorSet = !attribute.isEmpty();
+    else if (attribute.name() == onloadAttr)
+        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onbeforeunloadAttr)
+        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onunloadAttr)
+        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onblurAttr)
+        document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onfocusAttr)
+        document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onfocusinAttr)
+        document()->setWindowAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onfocusoutAttr)
+        document()->setWindowAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(document()->frame(), attribute));
 #if ENABLE(ORIENTATION_EVENTS)
-    else if (attr->name() == onorientationchangeAttr)
-        document()->setWindowAttributeEventListener(eventNames().orientationchangeEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attribute.name() == onorientationchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().orientationchangeEvent, createAttributeEventListener(document()->frame(), attribute));
 #endif
-    else if (attr->name() == onhashchangeAttr)
-        document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onresizeAttr)
-        document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onscrollAttr)
-        document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onstorageAttr)
-        document()->setWindowAttributeEventListener(eventNames().storageEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == ononlineAttr)
-        document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onofflineAttr)
-        document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == onpopstateAttr)
-        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attribute.name() == onhashchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onresizeAttr)
+        document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onscrollAttr)
+        document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onstorageAttr)
+        document()->setWindowAttributeEventListener(eventNames().storageEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == ononlineAttr)
+        document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onofflineAttr)
+        document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == onpopstateAttr)
+        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attribute));
     else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 bool HTMLFrameSetElement::rendererIsNeeded(const NodeRenderingContext& context)
diff --git a/Source/WebCore/html/HTMLFrameSetElement.h b/Source/WebCore/html/HTMLFrameSetElement.h
index 2f1594993..2d3c9ade9 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.h
+++ b/Source/WebCore/html/HTMLFrameSetElement.h
@@ -67,9 +67,9 @@ public:
 private:
     HTMLFrameSetElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
diff --git a/Source/WebCore/html/HTMLHRElement.cpp b/Source/WebCore/html/HTMLHRElement.cpp
index d417f84a6..78c8c3662 100644
--- a/Source/WebCore/html/HTMLHRElement.cpp
+++ b/Source/WebCore/html/HTMLHRElement.cpp
@@ -56,45 +56,45 @@ bool HTMLHRElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLHRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLHRElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == alignAttr) {
-        if (equalIgnoringCase(attr->value(), "left")) {
+    if (attribute.name() == alignAttr) {
+        if (equalIgnoringCase(attribute.value(), "left")) {
             addPropertyToAttributeStyle(style, CSSPropertyMarginLeft, 0, CSSPrimitiveValue::CSS_PX);
             addPropertyToAttributeStyle(style, CSSPropertyMarginRight, CSSValueAuto);
-        } else if (equalIgnoringCase(attr->value(), "right")) {
+        } else if (equalIgnoringCase(attribute.value(), "right")) {
             addPropertyToAttributeStyle(style, CSSPropertyMarginLeft, CSSValueAuto);
             addPropertyToAttributeStyle(style, CSSPropertyMarginRight, 0, CSSPrimitiveValue::CSS_PX);
         } else {
             addPropertyToAttributeStyle(style, CSSPropertyMarginLeft, CSSValueAuto);
             addPropertyToAttributeStyle(style, CSSPropertyMarginRight, CSSValueAuto);
         }
-    } else if (attr->name() == widthAttr) {
+    } else if (attribute.name() == widthAttr) {
         bool ok;
-        int v = attr->value().toInt(&ok);
+        int v = attribute.value().toInt(&ok);
         if (ok && !v)
             addPropertyToAttributeStyle(style, CSSPropertyWidth, 1, CSSPrimitiveValue::CSS_PX);
         else
-            addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
-    } else if (attr->name() == colorAttr) {
+            addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
+    } else if (attribute.name() == colorAttr) {
         addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
-        addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
-        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
-    } else if (attr->name() == noshadeAttr) {
+        addHTMLColorToStyle(style, CSSPropertyBorderColor, attribute.value());
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attribute.value());
+    } else if (attribute.name() == noshadeAttr) {
         addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
 
         RefPtr<CSSPrimitiveValue> darkGrayValue = cssValuePool().createColorValue(Color::darkGray);
         style->setProperty(CSSPropertyBorderColor, darkGrayValue);
         style->setProperty(CSSPropertyBackgroundColor, darkGrayValue);
-    } else if (attr->name() == sizeAttr) {
-        StringImpl* si = attr->value().impl();
+    } else if (attribute.name() == sizeAttr) {
+        StringImpl* si = attribute.value().impl();
         int size = si->toInt();
         if (size <= 1)
             addPropertyToAttributeStyle(style, CSSPropertyBorderBottomWidth, 0, CSSPrimitiveValue::CSS_PX);
         else
             addPropertyToAttributeStyle(style, CSSPropertyHeight, size - 2, CSSPrimitiveValue::CSS_PX);
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLHRElement.h b/Source/WebCore/html/HTMLHRElement.h
index 89ae018bf..d9a211152 100644
--- a/Source/WebCore/html/HTMLHRElement.h
+++ b/Source/WebCore/html/HTMLHRElement.h
@@ -38,7 +38,7 @@ private:
     HTMLHRElement(const QualifiedName&, Document*);
 
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLIFrameElement.cpp b/Source/WebCore/html/HTMLIFrameElement.cpp
index c7e157e73..0be7053e4 100644
--- a/Source/WebCore/html/HTMLIFrameElement.cpp
+++ b/Source/WebCore/html/HTMLIFrameElement.cpp
@@ -41,7 +41,7 @@ inline HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Docume
     : HTMLFrameElementBase(tagName, document)
 {
     ASSERT(hasTagName(iframeTag));
-    setHasCustomWillOrDidRecalcStyle();
+    setHasCustomCallbacks();
 }
 
 PassRefPtr<HTMLIFrameElement> HTMLIFrameElement::create(const QualifiedName& tagName, Document* document)
@@ -51,44 +51,48 @@ PassRefPtr<HTMLIFrameElement> HTMLIFrameElement::create(const QualifiedName& tag
 
 bool HTMLIFrameElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (name == widthAttr || name == heightAttr || name == alignAttr || name == frameborderAttr)
+    if (name == widthAttr || name == heightAttr || name == alignAttr || name == frameborderAttr || name == seamlessAttr)
         return true;
     return HTMLFrameElementBase::isPresentationAttribute(name);
 }
 
-void HTMLIFrameElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLIFrameElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == widthAttr)
-        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
-    else if (attr->name() == heightAttr)
-        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
-    else if (attr->name() == alignAttr)
-        applyAlignmentAttributeToStyle(attr, style);
-    else if (attr->name() == frameborderAttr) {
+    if (attribute.name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
+    else if (attribute.name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attribute.value());
+    else if (attribute.name() == alignAttr)
+        applyAlignmentAttributeToStyle(attribute, style);
+    else if (attribute.name() == frameborderAttr) {
         // Frame border doesn't really match the HTML4 spec definition for iframes. It simply adds
         // a presentational hint that the border should be off if set to zero.
-        if (!attr->isNull() && !attr->value().toInt()) {
+        if (!attribute.isNull() && !attribute.value().toInt()) {
             // Add a rule that nulls out our border width.
             addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, 0, CSSPrimitiveValue::CSS_PX);
         }
     } else
-        HTMLFrameElementBase::collectStyleForAttribute(attr, style);
+        HTMLFrameElementBase::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLIFrameElement::parseAttribute(Attribute* attr)
+void HTMLIFrameElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == nameAttr) {
-        const AtomicString& newName = attr->value();
+    if (attribute.name() == nameAttr) {
+        const AtomicString& newName = attribute.value();
         if (inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
             document->removeExtraNamedItem(m_name);
             document->addExtraNamedItem(newName);
         }
         m_name = newName;
-    } else if (attr->name() == sandboxAttr)
-        setSandboxFlags(attr->isNull() ? SandboxNone : SecurityContext::parseSandboxPolicy(attr->value()));
-    else
-        HTMLFrameElementBase::parseAttribute(attr);
+    } else if (attribute.name() == sandboxAttr)
+        setSandboxFlags(attribute.isNull() ? SandboxNone : SecurityContext::parseSandboxPolicy(attribute.value()));
+    else if (attribute.name() == seamlessAttr) {
+        // If we're adding or removing the seamless attribute, we need to force the content document to recalculate its StyleResolver.
+        if (contentDocument())
+            contentDocument()->styleResolverChanged(DeferRecalcStyle);
+    } else
+        HTMLFrameElementBase::parseAttribute(attribute);
 }
 
 bool HTMLIFrameElement::rendererIsNeeded(const NodeRenderingContext& context)
diff --git a/Source/WebCore/html/HTMLIFrameElement.h b/Source/WebCore/html/HTMLIFrameElement.h
index ff889b060..67ed06c6b 100644
--- a/Source/WebCore/html/HTMLIFrameElement.h
+++ b/Source/WebCore/html/HTMLIFrameElement.h
@@ -37,9 +37,9 @@ public:
 private:
     HTMLIFrameElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void removedFrom(Node*) OVERRIDE;
diff --git a/Source/WebCore/html/HTMLImageElement.cpp b/Source/WebCore/html/HTMLImageElement.cpp
index 7bf618881..1510bb627 100644
--- a/Source/WebCore/html/HTMLImageElement.cpp
+++ b/Source/WebCore/html/HTMLImageElement.cpp
@@ -85,47 +85,46 @@ bool HTMLImageElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
-{
-    if (attr->name() == widthAttr)
-        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
-    else if (attr->name() == heightAttr)
-        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
-    else if (attr->name() == borderAttr)
-        applyBorderAttributeToStyle(attr, style);
-    else if (attr->name() == vspaceAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
-    } else if (attr->name() == hspaceAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
-    } else if (attr->name() == alignAttr)
-        applyAlignmentAttributeToStyle(attr, style);
-    else if (attr->name() == valignAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attr->value());
+void HTMLImageElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
+{
+    if (attribute.name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
+    else if (attribute.name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attribute.value());
+    else if (attribute.name() == borderAttr)
+        applyBorderAttributeToStyle(attribute, style);
+    else if (attribute.name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attribute.value());
+    } else if (attribute.name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attribute.value());
+    } else if (attribute.name() == alignAttr)
+        applyAlignmentAttributeToStyle(attribute, style);
+    else if (attribute.name() == valignAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attribute.value());
     else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLImageElement::parseAttribute(Attribute* attr)
+void HTMLImageElement::parseAttribute(const Attribute& attribute)
 {
-    const QualifiedName& attrName = attr->name();
-    if (attrName == altAttr) {
+    if (attribute.name() == altAttr) {
         if (renderer() && renderer()->isImage())
             toRenderImage(renderer())->updateAltText();
-    } else if (attrName == srcAttr)
+    } else if (attribute.name() == srcAttr)
         m_imageLoader.updateFromElementIgnoringPreviousError();
-    else if (attrName == usemapAttr)
-        setIsLink(!attr->isNull());
-    else if (attrName == onloadAttr)
-        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onbeforeloadAttr)
-        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
-    else if (attrName == compositeAttr) {
-        if (!parseCompositeOperator(attr->value(), m_compositeOperator))
+    else if (attribute.name() == usemapAttr)
+        setIsLink(!attribute.isNull());
+    else if (attribute.name() == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == compositeAttr) {
+        if (!parseCompositeOperator(attribute.value(), m_compositeOperator))
             m_compositeOperator = CompositeSourceOver;
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 String HTMLImageElement::altText() const
diff --git a/Source/WebCore/html/HTMLImageElement.h b/Source/WebCore/html/HTMLImageElement.h
index 62554f6f7..e3a9246ee 100644
--- a/Source/WebCore/html/HTMLImageElement.h
+++ b/Source/WebCore/html/HTMLImageElement.h
@@ -84,9 +84,9 @@ protected:
     virtual void didMoveToNewDocument(Document* oldDocument) OVERRIDE;
 
 private:
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 778ed257a..131e964b0 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -191,27 +191,32 @@ bool HTMLInputElement::isValidValue(const String& value) const
         return false;
     }
     return !m_inputType->typeMismatchFor(value)
-        && !stepMismatch(value)
-        && !rangeUnderflow(value)
-        && !rangeOverflow(value)
+        && !m_inputType->stepMismatch(value)
+        && !m_inputType->rangeUnderflow(value)
+        && !m_inputType->rangeOverflow(value)
         && !tooLong(value, IgnoreDirtyFlag)
-        && !patternMismatch(value)
-        && !valueMissing(value);
+        && !m_inputType->patternMismatch(value)
+        && !m_inputType->valueMissing(value);
+}
+
+bool HTMLInputElement::tooLong() const
+{
+    return willValidate() && tooLong(value(), CheckDirtyFlag);
 }
 
 bool HTMLInputElement::typeMismatch() const
 {
-    return m_inputType->typeMismatch();
+    return willValidate() && m_inputType->typeMismatch();
 }
 
-bool HTMLInputElement::valueMissing(const String& value) const
+bool HTMLInputElement::valueMissing() const
 {
-    return m_inputType->valueMissing(value);
+    return willValidate() && m_inputType->valueMissing(value());
 }
 
-bool HTMLInputElement::patternMismatch(const String& value) const
+bool HTMLInputElement::patternMismatch() const
 {
-    return m_inputType->patternMismatch(value);
+    return willValidate() && m_inputType->patternMismatch(value());
 }
 
 bool HTMLInputElement::tooLong(const String& value, NeedsToCheckDirtyFlag check) const
@@ -232,68 +237,40 @@ bool HTMLInputElement::tooLong(const String& value, NeedsToCheckDirtyFlag check)
     return numGraphemeClusters(value) > static_cast<unsigned>(max);
 }
 
-bool HTMLInputElement::rangeUnderflow(const String& value) const
-{
-    return m_inputType->rangeUnderflow(value);
-}
-
-bool HTMLInputElement::rangeOverflow(const String& value) const
-{
-    return m_inputType->rangeOverflow(value);
-}
-
-double HTMLInputElement::minimum() const
+bool HTMLInputElement::rangeUnderflow() const
 {
-    return m_inputType->minimum();
+    return willValidate() && m_inputType->rangeUnderflow(value());
 }
 
-double HTMLInputElement::maximum() const
+bool HTMLInputElement::rangeOverflow() const
 {
-    return m_inputType->maximum();
+    return willValidate() && m_inputType->rangeOverflow(value());
 }
 
-bool HTMLInputElement::stepMismatch(const String& value) const
+String HTMLInputElement::validationMessage() const
 {
-    double step;
-    if (!getAllowedValueStep(&step))
-        return false;
-    return m_inputType->stepMismatch(value, step);
-}
-
-String HTMLInputElement::minimumString() const
-{
-    return m_inputType->serialize(minimum());
-}
+    if (!willValidate())
+        return String();
 
-String HTMLInputElement::maximumString() const
-{
-    return m_inputType->serialize(maximum());
-}
+    if (customError())
+        return customValidationMessage();
 
-String HTMLInputElement::stepBaseString() const
-{
-    return m_inputType->serialize(m_inputType->stepBase());
+    return m_inputType->validationMessage();
 }
 
-String HTMLInputElement::stepString() const
+double HTMLInputElement::minimum() const
 {
-    double step;
-    if (!getAllowedValueStep(&step)) {
-        // stepString() should be called only if stepMismatch() can be true.
-        ASSERT_NOT_REACHED();
-        return String();
-    }
-    return serializeForNumberType(step / m_inputType->stepScaleFactor());
+    return m_inputType->minimum();
 }
 
-String HTMLInputElement::typeMismatchText() const
+double HTMLInputElement::maximum() const
 {
-    return m_inputType->typeMismatchText();
+    return m_inputType->maximum();
 }
 
-String HTMLInputElement::valueMissingText() const
+bool HTMLInputElement::stepMismatch() const
 {
-    return m_inputType->valueMissingText();
+    return willValidate() && m_inputType->stepMismatch(value());
 }
 
 bool HTMLInputElement::getAllowedValueStep(double* step) const
@@ -433,11 +410,11 @@ void HTMLInputElement::updateType()
     if (didRespectHeightAndWidth != m_inputType->shouldRespectHeightAndWidthAttributes()) {
         ASSERT(attributeData());
         if (Attribute* height = getAttributeItem(heightAttr))
-            attributeChanged(height);
+            attributeChanged(*height);
         if (Attribute* width = getAttributeItem(widthAttr))
-            attributeChanged(width);
+            attributeChanged(*width);
         if (Attribute* align = getAttributeItem(alignAttr))
-            attributeChanged(align);
+            attributeChanged(*align);
     }
 
     if (wasAttached) {
@@ -551,44 +528,44 @@ bool HTMLInputElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLTextFormControlElement::isPresentationAttribute(name);
 }
 
-void HTMLInputElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLInputElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == vspaceAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
-    } else if (attr->name() == hspaceAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
-    } else if (attr->name() == alignAttr) {
+    if (attribute.name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attribute.value());
+    } else if (attribute.name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attribute.value());
+    } else if (attribute.name() == alignAttr) {
         if (m_inputType->shouldRespectAlignAttribute())
-            applyAlignmentAttributeToStyle(attr, style);
-    } else if (attr->name() == widthAttr) {
+            applyAlignmentAttributeToStyle(attribute, style);
+    } else if (attribute.name() == widthAttr) {
         if (m_inputType->shouldRespectHeightAndWidthAttributes())
-            addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
-    } else if (attr->name() == heightAttr) {
+            addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
+    } else if (attribute.name() == heightAttr) {
         if (m_inputType->shouldRespectHeightAndWidthAttributes())
-            addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
-    } else if (attr->name() == borderAttr && isImageButton())
-        applyBorderAttributeToStyle(attr, style);
+            addHTMLLengthToStyle(style, CSSPropertyHeight, attribute.value());
+    } else if (attribute.name() == borderAttr && isImageButton())
+        applyBorderAttributeToStyle(attribute, style);
     else
-        return HTMLTextFormControlElement::collectStyleForAttribute(attr, style);
+        return HTMLTextFormControlElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLInputElement::parseAttribute(Attribute* attr)
+void HTMLInputElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == nameAttr) {
+    if (attribute.name() == nameAttr) {
         removeFromRadioButtonGroup();
-        m_name = attr->value();
+        m_name = attribute.value();
         addToRadioButtonGroup();
-        HTMLTextFormControlElement::parseAttribute(attr);
-    } else if (attr->name() == autocompleteAttr) {
-        if (equalIgnoringCase(attr->value(), "off")) {
+        HTMLTextFormControlElement::parseAttribute(attribute);
+    } else if (attribute.name() == autocompleteAttr) {
+        if (equalIgnoringCase(attribute.value(), "off")) {
             m_autocomplete = Off;
             registerForSuspensionCallbackIfNeeded();
         } else {
             bool needsToUnregister = m_autocomplete == Off;
 
-            if (attr->isEmpty())
+            if (attribute.isEmpty())
                 m_autocomplete = Uninitialized;
             else
                 m_autocomplete = On;
@@ -596,9 +573,9 @@ void HTMLInputElement::parseAttribute(Attribute* attr)
             if (needsToUnregister)
                 unregisterForSuspensionCallbackIfNeeded();
         }
-    } else if (attr->name() == typeAttr) {
+    } else if (attribute.name() == typeAttr) {
         updateType();
-    } else if (attr->name() == valueAttr) {
+    } else if (attribute.name() == valueAttr) {
         // We only need to setChanged if the form is looking at the default value right now.
         if (!hasDirtyValue()) {
             updatePlaceholderVisibility(false);
@@ -606,67 +583,67 @@ void HTMLInputElement::parseAttribute(Attribute* attr)
         }
         setFormControlValueMatchesRenderer(false);
         setNeedsValidityCheck();
-    } else if (attr->name() == checkedAttr) {
+    } else if (attribute.name() == checkedAttr) {
         // Another radio button in the same group might be checked by state
         // restore. We shouldn't call setChecked() even if this has the checked
         // attribute. So, delay the setChecked() call until
         // finishParsingChildren() is called if parsing is in progress.
         if (!m_parsingInProgress && m_reflectsCheckedAttribute) {
-            setChecked(!attr->isNull());
+            setChecked(!attribute.isNull());
             m_reflectsCheckedAttribute = true;
         }
-    } else if (attr->name() == maxlengthAttr)
-        parseMaxLengthAttribute(attr);
-    else if (attr->name() == sizeAttr) {
+    } else if (attribute.name() == maxlengthAttr)
+        parseMaxLengthAttribute(attribute);
+    else if (attribute.name() == sizeAttr) {
         int oldSize = m_size;
-        int value = attr->value().toInt();
+        int value = attribute.value().toInt();
         m_size = value > 0 ? value : defaultSize;
         if (m_size != oldSize && renderer())
             renderer()->setNeedsLayoutAndPrefWidthsRecalc();
-    } else if (attr->name() == altAttr)
+    } else if (attribute.name() == altAttr)
         m_inputType->altAttributeChanged();
-    else if (attr->name() == srcAttr)
+    else if (attribute.name() == srcAttr)
         m_inputType->srcAttributeChanged();
-    else if (attr->name() == usemapAttr || attr->name() == accesskeyAttr) {
+    else if (attribute.name() == usemapAttr || attribute.name() == accesskeyAttr) {
         // FIXME: ignore for the moment
-    } else if (attr->name() == onsearchAttr) {
+    } else if (attribute.name() == onsearchAttr) {
         // Search field and slider attributes all just cause updateFromElement to be called through style recalcing.
-        setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == resultsAttr) {
+        setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attribute));
+    } else if (attribute.name() == resultsAttr) {
         int oldResults = m_maxResults;
-        m_maxResults = !attr->isNull() ? std::min(attr->value().toInt(), maxSavedResults) : -1;
+        m_maxResults = !attribute.isNull() ? std::min(attribute.value().toInt(), maxSavedResults) : -1;
         // FIXME: Detaching just for maxResults change is not ideal.  We should figure out the right
         // time to relayout for this change.
         if (m_maxResults != oldResults && (m_maxResults <= 0 || oldResults <= 0))
             reattachIfAttached();
         setNeedsStyleRecalc();
-    } else if (attr->name() == autosaveAttr || attr->name() == incrementalAttr)
+    } else if (attribute.name() == autosaveAttr || attribute.name() == incrementalAttr)
         setNeedsStyleRecalc();
-    else if (attr->name() == minAttr || attr->name() == maxAttr) {
+    else if (attribute.name() == minAttr || attribute.name() == maxAttr) {
         m_inputType->minOrMaxAttributeChanged();
         setNeedsValidityCheck();
-    } else if (attr->name() == multipleAttr) {
+    } else if (attribute.name() == multipleAttr) {
         m_inputType->multipleAttributeChanged();
         setNeedsValidityCheck();
-    } else if (attr->name() == stepAttr) {
+    } else if (attribute.name() == stepAttr) {
         m_inputType->stepAttributeChanged();
         setNeedsValidityCheck();
-    } else if (attr->name() == patternAttr || attr->name() == precisionAttr)
+    } else if (attribute.name() == patternAttr || attribute.name() == precisionAttr)
         setNeedsValidityCheck();
-    else if (attr->name() == disabledAttr) {
-        HTMLTextFormControlElement::parseAttribute(attr);
+    else if (attribute.name() == disabledAttr) {
+        HTMLTextFormControlElement::parseAttribute(attribute);
         m_inputType->disabledAttributeChanged();
-    } else if (attr->name() == readonlyAttr) {
-        HTMLTextFormControlElement::parseAttribute(attr);
+    } else if (attribute.name() == readonlyAttr) {
+        HTMLTextFormControlElement::parseAttribute(attribute);
         m_inputType->readonlyAttributeChanged();
     }
 #if ENABLE(DATALIST)
-    else if (attr->name() == listAttr)
-        m_hasNonEmptyList = !attr->isEmpty();
+    else if (attribute.name() == listAttr)
+        m_hasNonEmptyList = !attribute.isEmpty();
         // FIXME: we need to tell this change to a renderer if the attribute affects the appearance.
 #endif
 #if ENABLE(INPUT_SPEECH)
-    else if (attr->name() == webkitspeechAttr) {
+    else if (attribute.name() == webkitspeechAttr) {
         if (renderer()) {
             // This renderer and its children have quite different layouts and styles depending on
             // whether the speech button is visible or not. So we reset the whole thing and recreate
@@ -681,11 +658,11 @@ void HTMLInputElement::parseAttribute(Attribute* attr)
         }
         setFormControlValueMatchesRenderer(false);
         setNeedsStyleRecalc();
-    } else if (attr->name() == onwebkitspeechchangeAttr)
-        setAttributeEventListener(eventNames().webkitspeechchangeEvent, createAttributeEventListener(this, attr));
+    } else if (attribute.name() == onwebkitspeechchangeAttr)
+        setAttributeEventListener(eventNames().webkitspeechchangeEvent, createAttributeEventListener(this, attribute));
 #endif
     else
-        HTMLTextFormControlElement::parseAttribute(attr);
+        HTMLTextFormControlElement::parseAttribute(attribute);
     updateInnerTextValue();
 }
 
@@ -848,17 +825,17 @@ bool HTMLInputElement::sizeShouldIncludeDecoration(int& preferredSize) const
     return m_inputType->sizeShouldIncludeDecoration(defaultSize, preferredSize);
 }
 
-void HTMLInputElement::copyNonAttributeProperties(const Element* source)
+void HTMLInputElement::copyNonAttributePropertiesFromElement(const Element& source)
 {
-    const HTMLInputElement* sourceElement = static_cast<const HTMLInputElement*>(source);
+    const HTMLInputElement& sourceElement = static_cast<const HTMLInputElement&>(source);
 
-    m_valueIfDirty = sourceElement->m_valueIfDirty;
+    m_valueIfDirty = sourceElement.m_valueIfDirty;
     m_wasModifiedByUser = false;
-    setChecked(sourceElement->m_isChecked);
-    m_reflectsCheckedAttribute = sourceElement->m_reflectsCheckedAttribute;
-    m_isIndeterminate = sourceElement->m_isIndeterminate;
+    setChecked(sourceElement.m_isChecked);
+    m_reflectsCheckedAttribute = sourceElement.m_reflectsCheckedAttribute;
+    m_isIndeterminate = sourceElement.m_isIndeterminate;
 
-    HTMLTextFormControlElement::copyNonAttributeProperties(source);
+    HTMLTextFormControlElement::copyNonAttributePropertiesFromElement(source);
 
     setFormControlValueMatchesRenderer(false);
     updateInnerTextValue();
@@ -912,6 +889,22 @@ void HTMLInputElement::setSuggestedValue(const String& value)
     updateInnerTextValue();
 }
 
+void HTMLInputElement::setEditingValue(const String& value)
+{
+    if (!renderer() || !isTextField())
+        return;
+    setInnerTextValue(value);
+    subtreeHasChanged();
+
+    unsigned max = value.length();
+    if (focused())
+        setSelectionRange(max, max);
+    else
+        cacheSelectionInResponseToSetValue(max);
+
+    dispatchInputEvent();
+}
+
 void HTMLInputElement::setValue(const String& value, TextFieldEventBehavior eventBehavior)
 {
     if (!m_inputType->canSetValue(value))
@@ -991,7 +984,7 @@ void HTMLInputElement::setValueFromRenderer(const String& value)
     // Workaround for bug where trailing \n is included in the result of textContent.
     // The assert macro above may also be simplified to: value == constrainValue(value)
     // http://bugs.webkit.org/show_bug.cgi?id=9661
-    m_valueIfDirty = value == "\n" ? String("") : value;
+    m_valueIfDirty = value == "\n" ? emptyString() : value;
 
     setFormControlValueMatchesRenderer(true);
     m_wasModifiedByUser = true;
@@ -1275,12 +1268,12 @@ bool HTMLInputElement::hasUnacceptableValue() const
 
 bool HTMLInputElement::isInRange() const
 {
-    return m_inputType->supportsRangeLimitation() && !rangeUnderflow(value()) && !rangeOverflow(value());
+    return m_inputType->supportsRangeLimitation() && !m_inputType->rangeUnderflow(value()) && !m_inputType->rangeOverflow(value());
 }
 
 bool HTMLInputElement::isOutOfRange() const
 {
-    return m_inputType->supportsRangeLimitation() && (rangeUnderflow(value()) || rangeOverflow(value()));
+    return m_inputType->supportsRangeLimitation() && (m_inputType->rangeUnderflow(value()) || m_inputType->rangeOverflow(value()));
 }
 
 bool HTMLInputElement::needsSuspensionCallback()
@@ -1584,10 +1577,10 @@ void HTMLInputElement::updatePlaceholderText()
     return m_inputType->updatePlaceholderText();
 }
 
-void HTMLInputElement::parseMaxLengthAttribute(Attribute* attribute)
+void HTMLInputElement::parseMaxLengthAttribute(const Attribute& attribute)
 {
     int maxLength;
-    if (!parseHTMLInteger(attribute->value(), maxLength))
+    if (!parseHTMLInteger(attribute.value(), maxLength))
         maxLength = maximumLength;
     if (maxLength < 0 || maxLength > maximumLength)
         maxLength = maximumLength;
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index e34a03e63..45dc5aafb 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -48,13 +48,15 @@ public:
     virtual bool shouldAutocomplete() const;
 
     // For ValidityState
-    bool typeMismatch() const;
-    // valueMissing() ignores the specified string value for CHECKBOX and RADIO.
-    bool valueMissing(const String&) const;
-    bool patternMismatch(const String&) const;
-    bool tooLong(const String&, NeedsToCheckDirtyFlag) const;
-    bool rangeUnderflow(const String&) const;
-    bool rangeOverflow(const String&) const;
+    virtual bool patternMismatch() const OVERRIDE;
+    virtual bool rangeUnderflow() const OVERRIDE;
+    virtual bool rangeOverflow() const;
+    virtual bool stepMismatch() const OVERRIDE;
+    virtual bool tooLong() const OVERRIDE;
+    virtual bool typeMismatch() const OVERRIDE;
+    virtual bool valueMissing() const OVERRIDE;
+    virtual String validationMessage() const OVERRIDE;
+
     // Returns the minimum value for type=date, number, or range.  Don't call this for other types.
     double minimum() const;
     // Returns the maximum value for type=date, number, or range.  Don't call this for other types.
@@ -64,15 +66,6 @@ public:
     // Returns false if there is no "allowed value step."
     bool getAllowedValueStep(double*) const;
 
-    // For ValidityState.
-    bool stepMismatch(const String&) const;
-    String minimumString() const;
-    String maximumString() const;
-    String stepBaseString() const;
-    String stepString() const;
-    String typeMismatchText() const;
-    String valueMissingText() const;
-
     // Implementations of HTMLInputElement::stepUp() and stepDown().
     void stepUp(int, ExceptionCode&);
     void stepDown(int, ExceptionCode&);
@@ -163,6 +156,8 @@ public:
     const String& suggestedValue() const;
     void setSuggestedValue(const String&);
 
+    void setEditingValue(const String&);
+
     double valueAsDate() const;
     void setValueAsDate(double, ExceptionCode&);
 
@@ -290,12 +285,12 @@ private:
 
     virtual void accessKeyAction(bool sendMouseEvents);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
     virtual void finishParsingChildren();
 
-    virtual void copyNonAttributeProperties(const Element* source);
+    virtual void copyNonAttributePropertiesFromElement(const Element&);
 
     virtual void attach();
 
@@ -325,6 +320,7 @@ private:
 
     bool supportsMaxLength() const { return isTextType(); }
     bool isTextType() const;
+    bool tooLong(const String&, NeedsToCheckDirtyFlag) const;
 
     virtual bool supportsPlaceholder() const;
     virtual bool isPlaceholderEmpty() const OVERRIDE;
@@ -347,7 +343,7 @@ private:
 #if ENABLE(DATALIST)
     HTMLDataListElement* dataList() const;
 #endif
-    void parseMaxLengthAttribute(Attribute*);
+    void parseMaxLengthAttribute(const Attribute&);
     void updateValueIfNeeded();
 
     // Returns null if this isn't associated with any radio button group.
diff --git a/Source/WebCore/html/HTMLKeygenElement.cpp b/Source/WebCore/html/HTMLKeygenElement.cpp
index db4d283fd..488eadb6e 100644
--- a/Source/WebCore/html/HTMLKeygenElement.cpp
+++ b/Source/WebCore/html/HTMLKeygenElement.cpp
@@ -96,13 +96,13 @@ PassRefPtr<HTMLKeygenElement> HTMLKeygenElement::create(const QualifiedName& tag
     return adoptRef(new HTMLKeygenElement(tagName, document, form));
 }
 
-void HTMLKeygenElement::parseAttribute(Attribute* attr)
+void HTMLKeygenElement::parseAttribute(const Attribute& attribute)
 {
     // Reflect disabled attribute on the shadow select element
-    if (attr->name() == disabledAttr)
-        shadowSelect()->setAttribute(attr->name(), attr->value());
+    if (attribute.name() == disabledAttr)
+        shadowSelect()->setAttribute(attribute.name(), attribute.value());
 
-    HTMLFormControlElement::parseAttribute(attr);
+    HTMLFormControlElement::parseAttribute(attribute);
 }
 
 bool HTMLKeygenElement::appendFormData(FormDataList& encoded_values, bool)
diff --git a/Source/WebCore/html/HTMLKeygenElement.h b/Source/WebCore/html/HTMLKeygenElement.h
index 45df10bac..a28d26993 100644
--- a/Source/WebCore/html/HTMLKeygenElement.h
+++ b/Source/WebCore/html/HTMLKeygenElement.h
@@ -41,7 +41,7 @@ private:
 
     virtual bool canStartSelection() const { return false; }
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual bool appendFormData(FormDataList&, bool);
     virtual const AtomicString& formControlType() const;
diff --git a/Source/WebCore/html/HTMLLIElement.cpp b/Source/WebCore/html/HTMLLIElement.cpp
index dd62dce9a..c3400a579 100644
--- a/Source/WebCore/html/HTMLLIElement.cpp
+++ b/Source/WebCore/html/HTMLLIElement.cpp
@@ -56,32 +56,32 @@ bool HTMLLIElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLLIElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLLIElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == typeAttr) {
-        if (attr->value() == "a")
+    if (attribute.name() == typeAttr) {
+        if (attribute.value() == "a")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerAlpha);
-        else if (attr->value() == "A")
+        else if (attribute.value() == "A")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperAlpha);
-        else if (attr->value() == "i")
+        else if (attribute.value() == "i")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerRoman);
-        else if (attr->value() == "I")
+        else if (attribute.value() == "I")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperRoman);
-        else if (attr->value() == "1")
+        else if (attribute.value() == "1")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueDecimal);
         else
-            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, attribute.value());
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLLIElement::parseAttribute(Attribute* attr)
+void HTMLLIElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == valueAttr) {
+    if (attribute.name() == valueAttr) {
         if (renderer() && renderer()->isListItem())
-            parseValue(attr->value());
+            parseValue(attribute.value());
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 void HTMLLIElement::attach()
diff --git a/Source/WebCore/html/HTMLLIElement.h b/Source/WebCore/html/HTMLLIElement.h
index 9f7685aa3..33cd47b86 100644
--- a/Source/WebCore/html/HTMLLIElement.h
+++ b/Source/WebCore/html/HTMLLIElement.h
@@ -35,9 +35,9 @@ public:
 private:
     HTMLLIElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
 
diff --git a/Source/WebCore/html/HTMLLinkElement.cpp b/Source/WebCore/html/HTMLLinkElement.cpp
index e17925fbe..927410b9a 100644
--- a/Source/WebCore/html/HTMLLinkElement.cpp
+++ b/Source/WebCore/html/HTMLLinkElement.cpp
@@ -127,36 +127,36 @@ void HTMLLinkElement::setDisabledState(bool disabled)
     }
 }
 
-void HTMLLinkElement::parseAttribute(Attribute* attr)
+void HTMLLinkElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == relAttr) {
-        m_relAttribute = LinkRelAttribute(attr->value());
+    if (attribute.name() == relAttr) {
+        m_relAttribute = LinkRelAttribute(attribute.value());
         process();
-    } else if (attr->name() == hrefAttr) {
-        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
+    } else if (attribute.name() == hrefAttr) {
+        String url = stripLeadingAndTrailingHTMLSpaces(attribute.value());
         m_url = url.isEmpty() ? KURL() : document()->completeURL(url);
         process();
-    } else if (attr->name() == typeAttr) {
-        m_type = attr->value();
+    } else if (attribute.name() == typeAttr) {
+        m_type = attribute.value();
         process();
-    } else if (attr->name() == sizesAttr) {
-        setSizes(attr->value());
+    } else if (attribute.name() == sizesAttr) {
+        setSizes(attribute.value());
         process();
-    } else if (attr->name() == mediaAttr) {
-        m_media = attr->value().string().lower();
+    } else if (attribute.name() == mediaAttr) {
+        m_media = attribute.value().string().lower();
         process();
-    } else if (attr->name() == disabledAttr)
-        setDisabledState(!attr->isNull());
-    else if (attr->name() == onbeforeloadAttr)
-        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onloadAttr)
-        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onerrorAttr)
-        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
+    } else if (attribute.name() == disabledAttr)
+        setDisabledState(!attribute.isNull());
+    else if (attribute.name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onerrorAttr)
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attribute));
     else {
-        if (attr->name() == titleAttr && m_sheet)
-            m_sheet->setTitle(attr->value());
-        HTMLElement::parseAttribute(attr);
+        if (attribute.name() == titleAttr && m_sheet)
+            m_sheet->setTitle(attribute.value());
+        HTMLElement::parseAttribute(attribute);
     }
 }
 
@@ -265,6 +265,8 @@ void HTMLLinkElement::removedFrom(Node* insertionPoint)
     if (!insertionPoint->inDocument())
         return;
 
+    m_linkLoader.released();
+
     if (m_isInShadowTree) {
         ASSERT(!m_sheet);
         return;
diff --git a/Source/WebCore/html/HTMLLinkElement.h b/Source/WebCore/html/HTMLLinkElement.h
index 82398505b..557421751 100644
--- a/Source/WebCore/html/HTMLLinkElement.h
+++ b/Source/WebCore/html/HTMLLinkElement.h
@@ -68,7 +68,7 @@ public:
     static void dispatchPendingLoadEvents();
 
 private:
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual bool shouldLoadLink();
     void process();
diff --git a/Source/WebCore/html/HTMLMapElement.cpp b/Source/WebCore/html/HTMLMapElement.cpp
index 5dc08366a..5073e89e1 100644
--- a/Source/WebCore/html/HTMLMapElement.cpp
+++ b/Source/WebCore/html/HTMLMapElement.cpp
@@ -98,14 +98,13 @@ HTMLImageElement* HTMLMapElement::imageElement()
     return 0;    
 }
 
-void HTMLMapElement::parseAttribute(Attribute* attribute)
+void HTMLMapElement::parseAttribute(const Attribute& attribute)
 {
     // FIXME: This logic seems wrong for XML documents.
     // Either the id or name will be used depending on the order the attributes are parsed.
 
-    const QualifiedName& attrName = attribute->name();
-    if (isIdAttributeName(attrName) || attrName == nameAttr) {
-        if (isIdAttributeName(attrName)) {
+    if (isIdAttributeName(attribute.name()) || attribute.name() == nameAttr) {
+        if (isIdAttributeName(attribute.name())) {
             // Call base class so that hasID bit gets set.
             HTMLElement::parseAttribute(attribute);
             if (document()->isHTMLDocument())
@@ -113,7 +112,7 @@ void HTMLMapElement::parseAttribute(Attribute* attribute)
         }
         if (inDocument())
             treeScope()->removeImageMap(this);
-        String mapName = attribute->value();
+        String mapName = attribute.value();
         if (mapName[0] == '#')
             mapName = mapName.substring(1);
         m_name = document()->isHTMLDocument() ? mapName.lower() : mapName;
diff --git a/Source/WebCore/html/HTMLMapElement.h b/Source/WebCore/html/HTMLMapElement.h
index a25baba60..038ae64bf 100644
--- a/Source/WebCore/html/HTMLMapElement.h
+++ b/Source/WebCore/html/HTMLMapElement.h
@@ -46,7 +46,7 @@ public:
 private:
     HTMLMapElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void removedFrom(Node*) OVERRIDE;
diff --git a/Source/WebCore/html/HTMLMarqueeElement.cpp b/Source/WebCore/html/HTMLMarqueeElement.cpp
index 4b0825d9d..bdafdad9a 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.cpp
+++ b/Source/WebCore/html/HTMLMarqueeElement.cpp
@@ -65,48 +65,48 @@ bool HTMLMarqueeElement::isPresentationAttribute(const QualifiedName& name) cons
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLMarqueeElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
-{
-    if (attr->name() == widthAttr) {
-        if (!attr->isEmpty())
-            addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
-    } else if (attr->name() == heightAttr) {
-        if (!attr->value().isEmpty())
-            addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
-    } else if (attr->name() == bgcolorAttr) {
-        if (!attr->value().isEmpty())
-            addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
-    } else if (attr->name() == vspaceAttr) {
-        if (!attr->value().isEmpty()) {
-            addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
-            addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+void HTMLMarqueeElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
+{
+    if (attribute.name() == widthAttr) {
+        if (!attribute.isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
+    } else if (attribute.name() == heightAttr) {
+        if (!attribute.isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyHeight, attribute.value());
+    } else if (attribute.name() == bgcolorAttr) {
+        if (!attribute.isEmpty())
+            addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attribute.value());
+    } else if (attribute.name() == vspaceAttr) {
+        if (!attribute.isEmpty()) {
+            addHTMLLengthToStyle(style, CSSPropertyMarginTop, attribute.value());
+            addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attribute.value());
         }
-    } else if (attr->name() == hspaceAttr) {
-        if (!attr->value().isEmpty()) {
-            addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
-            addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+    } else if (attribute.name() == hspaceAttr) {
+        if (!attribute.isEmpty()) {
+            addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attribute.value());
+            addHTMLLengthToStyle(style, CSSPropertyMarginRight, attribute.value());
         }
-    } else if (attr->name() == scrollamountAttr) {
-        if (!attr->value().isEmpty())
-            addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeIncrement, attr->value());
-    } else if (attr->name() == scrolldelayAttr) {
-        if (!attr->value().isEmpty())
-            addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeSpeed, attr->value());
-    } else if (attr->name() == loopAttr) {
-        if (!attr->value().isEmpty()) {
-            if (attr->value() == "-1" || equalIgnoringCase(attr->value(), "infinite"))
+    } else if (attribute.name() == scrollamountAttr) {
+        if (!attribute.isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeIncrement, attribute.value());
+    } else if (attribute.name() == scrolldelayAttr) {
+        if (!attribute.isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeSpeed, attribute.value());
+    } else if (attribute.name() == loopAttr) {
+        if (!attribute.isEmpty()) {
+            if (attribute.value() == "-1" || equalIgnoringCase(attribute.value(), "infinite"))
                 addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeRepetition, CSSValueInfinite);
             else
-                addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeRepetition, attr->value());
+                addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeRepetition, attribute.value());
         }
-    } else if (attr->name() == behaviorAttr) {
-        if (!attr->value().isEmpty())
-            addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeStyle, attr->value());
-    } else if (attr->name() == directionAttr) {
-        if (!attr->value().isEmpty())
-            addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeDirection, attr->value());
+    } else if (attribute.name() == behaviorAttr) {
+        if (!attribute.isEmpty())
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeStyle, attribute.value());
+    } else if (attribute.name() == directionAttr) {
+        if (!attribute.isEmpty())
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeDirection, attribute.value());
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 void HTMLMarqueeElement::start()
diff --git a/Source/WebCore/html/HTMLMarqueeElement.h b/Source/WebCore/html/HTMLMarqueeElement.h
index 6c453662b..8781a3985 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.h
+++ b/Source/WebCore/html/HTMLMarqueeElement.h
@@ -54,7 +54,7 @@ private:
     HTMLMarqueeElement(const QualifiedName&, Document*);
 
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     // ActiveDOMObject
     virtual bool canSuspend() const;
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index 049922628..33e1205ee 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -279,7 +279,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
     m_mediaSourceURL.setPath(createCanonicalUUIDString());
 #endif
 
-    setHasCustomWillOrDidRecalcStyle();
+    setHasCustomCallbacks();
     addElementToDocumentMap(this, document);
 }
 
@@ -345,26 +345,22 @@ bool HTMLMediaElement::isMouseFocusable() const
     return false;
 }
 
-void HTMLMediaElement::parseAttribute(Attribute* attr)
+void HTMLMediaElement::parseAttribute(const Attribute& attribute)
 {
-    const QualifiedName& attrName = attr->name();
-
-    if (attrName == srcAttr) {
+    if (attribute.name() == srcAttr) {
         // Trigger a reload, as long as the 'src' attribute is present.
         if (fastHasAttribute(srcAttr))
             scheduleLoad(MediaResource);
-    } else if (attrName == controlsAttr)
+    } else if (attribute.name() == controlsAttr)
         configureMediaControls();
 #if PLATFORM(MAC)
-    else if (attrName == loopAttr)
+    else if (attribute.name() == loopAttr)
         updateDisableSleep();
 #endif
-    else if (attrName == preloadAttr) {
-        String value = attr->value();
-
-        if (equalIgnoringCase(value, "none"))
+    else if (attribute.name() == preloadAttr) {
+        if (equalIgnoringCase(attribute.value(), "none"))
             m_preload = MediaPlayer::None;
-        else if (equalIgnoringCase(value, "metadata"))
+        else if (equalIgnoringCase(attribute.value(), "metadata"))
             m_preload = MediaPlayer::MetaData;
         else {
             // The spec does not define an "invalid value default" but "auto" is suggested as the
@@ -376,60 +372,60 @@ void HTMLMediaElement::parseAttribute(Attribute* attr)
         if (!autoplay() && m_player)
             m_player->setPreload(m_preload);
 
-    } else if (attrName == mediagroupAttr)
-        setMediaGroup(attr->value());
-    else if (attrName == onabortAttr)
-        setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onbeforeloadAttr)
-        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
-    else if (attrName == oncanplayAttr)
-        setAttributeEventListener(eventNames().canplayEvent, createAttributeEventListener(this, attr));
-    else if (attrName == oncanplaythroughAttr)
-        setAttributeEventListener(eventNames().canplaythroughEvent, createAttributeEventListener(this, attr));
-    else if (attrName == ondurationchangeAttr)
-        setAttributeEventListener(eventNames().durationchangeEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onemptiedAttr)
-        setAttributeEventListener(eventNames().emptiedEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onendedAttr)
-        setAttributeEventListener(eventNames().endedEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onerrorAttr)
-        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onloadeddataAttr)
-        setAttributeEventListener(eventNames().loadeddataEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onloadedmetadataAttr)
-        setAttributeEventListener(eventNames().loadedmetadataEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onloadstartAttr)
-        setAttributeEventListener(eventNames().loadstartEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onpauseAttr)
-        setAttributeEventListener(eventNames().pauseEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onplayAttr)
-        setAttributeEventListener(eventNames().playEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onplayingAttr)
-        setAttributeEventListener(eventNames().playingEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onprogressAttr)
-        setAttributeEventListener(eventNames().progressEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onratechangeAttr)
-        setAttributeEventListener(eventNames().ratechangeEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onseekedAttr)
-        setAttributeEventListener(eventNames().seekedEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onseekingAttr)
-        setAttributeEventListener(eventNames().seekingEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onstalledAttr)
-        setAttributeEventListener(eventNames().stalledEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onsuspendAttr)
-        setAttributeEventListener(eventNames().suspendEvent, createAttributeEventListener(this, attr));
-    else if (attrName == ontimeupdateAttr)
-        setAttributeEventListener(eventNames().timeupdateEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onvolumechangeAttr)
-        setAttributeEventListener(eventNames().volumechangeEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onwaitingAttr)
-        setAttributeEventListener(eventNames().waitingEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onwebkitbeginfullscreenAttr)
-        setAttributeEventListener(eventNames().webkitbeginfullscreenEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onwebkitendfullscreenAttr)
-        setAttributeEventListener(eventNames().webkitendfullscreenEvent, createAttributeEventListener(this, attr));
+    } else if (attribute.name() == mediagroupAttr)
+        setMediaGroup(attribute.value());
+    else if (attribute.name() == onabortAttr)
+        setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == oncanplayAttr)
+        setAttributeEventListener(eventNames().canplayEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == oncanplaythroughAttr)
+        setAttributeEventListener(eventNames().canplaythroughEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == ondurationchangeAttr)
+        setAttributeEventListener(eventNames().durationchangeEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onemptiedAttr)
+        setAttributeEventListener(eventNames().emptiedEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onendedAttr)
+        setAttributeEventListener(eventNames().endedEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onerrorAttr)
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onloadeddataAttr)
+        setAttributeEventListener(eventNames().loadeddataEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onloadedmetadataAttr)
+        setAttributeEventListener(eventNames().loadedmetadataEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onloadstartAttr)
+        setAttributeEventListener(eventNames().loadstartEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onpauseAttr)
+        setAttributeEventListener(eventNames().pauseEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onplayAttr)
+        setAttributeEventListener(eventNames().playEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onplayingAttr)
+        setAttributeEventListener(eventNames().playingEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onprogressAttr)
+        setAttributeEventListener(eventNames().progressEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onratechangeAttr)
+        setAttributeEventListener(eventNames().ratechangeEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onseekedAttr)
+        setAttributeEventListener(eventNames().seekedEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onseekingAttr)
+        setAttributeEventListener(eventNames().seekingEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onstalledAttr)
+        setAttributeEventListener(eventNames().stalledEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onsuspendAttr)
+        setAttributeEventListener(eventNames().suspendEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == ontimeupdateAttr)
+        setAttributeEventListener(eventNames().timeupdateEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onvolumechangeAttr)
+        setAttributeEventListener(eventNames().volumechangeEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onwaitingAttr)
+        setAttributeEventListener(eventNames().waitingEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onwebkitbeginfullscreenAttr)
+        setAttributeEventListener(eventNames().webkitbeginfullscreenEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onwebkitendfullscreenAttr)
+        setAttributeEventListener(eventNames().webkitendfullscreenEvent, createAttributeEventListener(this, attribute));
     else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 void HTMLMediaElement::finishParsingChildren()
@@ -617,7 +613,7 @@ HTMLMediaElement::NetworkState HTMLMediaElement::networkState() const
 
 String HTMLMediaElement::canPlayType(const String& mimeType, const String& keySystem) const
 {
-    MediaPlayer::SupportsType support = MediaPlayer::supportsType(ContentType(mimeType), keySystem);
+    MediaPlayer::SupportsType support = MediaPlayer::supportsType(ContentType(mimeType), keySystem, this);
     String canPlay;
 
     // 4.8.10.3
@@ -3097,7 +3093,7 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType* contentType, String* k
             if (shouldLog)
                 LOG(Media, "HTMLMediaElement::selectNextSourceChild - 'type' is '%s' - key system is '%s'", type.utf8().data(), system.utf8().data());
 #endif
-            if (!MediaPlayer::supportsType(ContentType(type), system))
+            if (!MediaPlayer::supportsType(ContentType(type), system, this))
                 goto check_again;
         }
 
@@ -4385,6 +4381,17 @@ String HTMLMediaElement::mediaPlayerUserAgent() const
 
 }
 
+bool HTMLMediaElement::mediaPlayerNeedsSiteSpecificHacks() const
+{
+    Settings* settings = document()->settings();
+    return settings && settings->needsSiteSpecificQuirks();
+}
+
+String HTMLMediaElement::mediaPlayerDocumentHost() const
+{
+    return document()->url().host();
+}
+
 void HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture()
 {
     m_restrictions = NoRestrictions;
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index ddb08c2c2..671b3642d 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -76,7 +76,7 @@ typedef Vector<CueIntervalTree::IntervalType> CueList;
 // But it can't be until the Chromium WebMediaPlayerClientImpl class is fixed so it
 // no longer depends on typecasting a MediaPlayerClient to an HTMLMediaElement.
 
-class HTMLMediaElement : public HTMLElement, public MediaPlayerClient, private MediaCanStartListener, public ActiveDOMObject, public MediaControllerInterface
+class HTMLMediaElement : public HTMLElement, public MediaPlayerClient, public MediaPlayerSupportsTypeClient, private MediaCanStartListener, public ActiveDOMObject, public MediaControllerInterface
 #if ENABLE(VIDEO_TRACK)
     , private TextTrackClient
 #endif
@@ -323,7 +323,7 @@ protected:
     HTMLMediaElement(const QualifiedName&, Document*, bool);
     virtual ~HTMLMediaElement();
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void finishParsingChildren();
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
     virtual void attach();
@@ -422,6 +422,9 @@ private:
     virtual String mediaPlayerReferrer() const OVERRIDE;
     virtual String mediaPlayerUserAgent() const OVERRIDE;
 
+    virtual bool mediaPlayerNeedsSiteSpecificHacks() const OVERRIDE;
+    virtual String mediaPlayerDocumentHost() const OVERRIDE;
+
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void progressEventTimerFired(Timer<HTMLMediaElement>*);
     void playbackProgressTimerFired(Timer<HTMLMediaElement>*);
diff --git a/Source/WebCore/html/HTMLMetaElement.cpp b/Source/WebCore/html/HTMLMetaElement.cpp
index 0aa665102..b1f35019e 100644
--- a/Source/WebCore/html/HTMLMetaElement.cpp
+++ b/Source/WebCore/html/HTMLMetaElement.cpp
@@ -42,16 +42,16 @@ PassRefPtr<HTMLMetaElement> HTMLMetaElement::create(const QualifiedName& tagName
     return adoptRef(new HTMLMetaElement(tagName, document));
 }
 
-void HTMLMetaElement::parseAttribute(Attribute* attr)
+void HTMLMetaElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == http_equivAttr)
+    if (attribute.name() == http_equivAttr)
         process();
-    else if (attr->name() == contentAttr)
+    else if (attribute.name() == contentAttr)
         process();
-    else if (attr->name() == nameAttr) {
+    else if (attribute.name() == nameAttr) {
         // Do nothing
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 Node::InsertionNotificationRequest HTMLMetaElement::insertedInto(Node* insertionPoint)
diff --git a/Source/WebCore/html/HTMLMetaElement.h b/Source/WebCore/html/HTMLMetaElement.h
index 9956f55c1..7e0762a26 100644
--- a/Source/WebCore/html/HTMLMetaElement.h
+++ b/Source/WebCore/html/HTMLMetaElement.h
@@ -38,7 +38,7 @@ public:
 private:
     HTMLMetaElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
 
     void process();
diff --git a/Source/WebCore/html/HTMLMeterElement.cpp b/Source/WebCore/html/HTMLMeterElement.cpp
index 684eb5ba3..4f48229af 100644
--- a/Source/WebCore/html/HTMLMeterElement.cpp
+++ b/Source/WebCore/html/HTMLMeterElement.cpp
@@ -71,9 +71,9 @@ bool HTMLMeterElement::supportsFocus() const
     return Node::supportsFocus() && !disabled();
 }
 
-void HTMLMeterElement::parseAttribute(Attribute* attribute)
+void HTMLMeterElement::parseAttribute(const Attribute& attribute)
 {
-    if (attribute->name() == valueAttr || attribute->name() == minAttr || attribute->name() == maxAttr || attribute->name() == lowAttr || attribute->name() == highAttr || attribute->name() == optimumAttr)
+    if (attribute.name() == valueAttr || attribute.name() == minAttr || attribute.name() == maxAttr || attribute.name() == lowAttr || attribute.name() == highAttr || attribute.name() == optimumAttr)
         didElementStateChange();
     else
         LabelableElement::parseAttribute(attribute);
diff --git a/Source/WebCore/html/HTMLMeterElement.h b/Source/WebCore/html/HTMLMeterElement.h
index 3f59b0b7c..bca0be6e6 100644
--- a/Source/WebCore/html/HTMLMeterElement.h
+++ b/Source/WebCore/html/HTMLMeterElement.h
@@ -72,7 +72,7 @@ private:
     virtual bool recalcWillValidate() const { return false; }
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     void didElementStateChange();
     void createShadowSubtree();
diff --git a/Source/WebCore/html/HTMLOListElement.cpp b/Source/WebCore/html/HTMLOListElement.cpp
index 816d6a8e5..90f905e18 100644
--- a/Source/WebCore/html/HTMLOListElement.cpp
+++ b/Source/WebCore/html/HTMLOListElement.cpp
@@ -61,42 +61,42 @@ bool HTMLOListElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLOListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLOListElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == typeAttr) {
-        if (attr->value() == "a")
+    if (attribute.name() == typeAttr) {
+        if (attribute.value() == "a")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerAlpha);
-        else if (attr->value() == "A")
+        else if (attribute.value() == "A")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperAlpha);
-        else if (attr->value() == "i")
+        else if (attribute.value() == "i")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerRoman);
-        else if (attr->value() == "I")
+        else if (attribute.value() == "I")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperRoman);
-        else if (attr->value() == "1")
+        else if (attribute.value() == "1")
             addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueDecimal);
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLOListElement::parseAttribute(Attribute* attr)
+void HTMLOListElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == startAttr) {
+    if (attribute.name() == startAttr) {
         int oldStart = start();
         bool canParse;
-        int parsedStart = attr->value().toInt(&canParse);
+        int parsedStart = attribute.value().toInt(&canParse);
         m_hasExplicitStart = canParse;
         m_start = canParse ? parsedStart : 0xBADBEEF;
         if (oldStart == start())
             return;
         updateItemValues();
-    } else if (attr->name() == reversedAttr) {
-        bool reversed = !attr->isNull();
+    } else if (attribute.name() == reversedAttr) {
+        bool reversed = !attribute.isNull();
         if (reversed == m_isReversed)
             return;
         m_isReversed = reversed;
         updateItemValues();
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 void HTMLOListElement::setStart(int start)
diff --git a/Source/WebCore/html/HTMLOListElement.h b/Source/WebCore/html/HTMLOListElement.h
index d78207d33..764465e60 100644
--- a/Source/WebCore/html/HTMLOListElement.h
+++ b/Source/WebCore/html/HTMLOListElement.h
@@ -53,9 +53,9 @@ private:
 
     void recalculateItemCount();
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     int m_start;
     unsigned m_itemCount;
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index b9e9447c9..e3be066a4 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -84,20 +84,20 @@ bool HTMLObjectElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLPlugInImageElement::isPresentationAttribute(name);
 }
 
-void HTMLObjectElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLObjectElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == borderAttr)
-        applyBorderAttributeToStyle(attr, style);
+    if (attribute.name() == borderAttr)
+        applyBorderAttributeToStyle(attribute, style);
     else
-        HTMLPlugInImageElement::collectStyleForAttribute(attr, style);
+        HTMLPlugInImageElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLObjectElement::parseAttribute(Attribute* attr)
+void HTMLObjectElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == formAttr)
+    if (attribute.name() == formAttr)
         formAttributeChanged();
-    else if (attr->name() == typeAttr) {
-        m_serviceType = attr->value().lower();
+    else if (attribute.name() == typeAttr) {
+        m_serviceType = attribute.value().lower();
         size_t pos = m_serviceType.find(";");
         if (pos != notFound)
             m_serviceType = m_serviceType.left(pos);
@@ -105,8 +105,8 @@ void HTMLObjectElement::parseAttribute(Attribute* attr)
             setNeedsWidgetUpdate(true);
         if (!isImageType() && m_imageLoader)
             m_imageLoader.clear();
-    } else if (attr->name() == dataAttr) {
-        m_url = stripLeadingAndTrailingHTMLSpaces(attr->value());
+    } else if (attribute.name() == dataAttr) {
+        m_url = stripLeadingAndTrailingHTMLSpaces(attribute.value());
         if (renderer()) {
             setNeedsWidgetUpdate(true);
             if (isImageType()) {
@@ -115,16 +115,16 @@ void HTMLObjectElement::parseAttribute(Attribute* attr)
                 m_imageLoader->updateFromElementIgnoringPreviousError();
             }
         }
-    } else if (attr->name() == classidAttr) {
-        m_classId = attr->value();
+    } else if (attribute.name() == classidAttr) {
+        m_classId = attribute.value();
         if (renderer())
             setNeedsWidgetUpdate(true);
-    } else if (attr->name() == onloadAttr)
-        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onbeforeloadAttr)
-        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    } else if (attribute.name() == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attribute));
     else
-        HTMLPlugInImageElement::parseAttribute(attr);
+        HTMLPlugInImageElement::parseAttribute(attribute);
 }
 
 static void mapDataParamToSrc(Vector<String>* paramNames, Vector<String>* paramValues)
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index a0e66377a..36a41607b 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -54,9 +54,9 @@ public:
 
     // Implementations of constraint validation API.
     // Note that the object elements are always barred from constraint validation.
-    String validationMessage() { return String(); }
+    virtual String validationMessage() const OVERRIDE { return String(); }
     bool checkValidity() { return true; }
-    void setCustomValidity(const String&) { }
+    virtual void setCustomValidity(const String&) OVERRIDE { }
 
     using TreeShared<ContainerNode>::ref;
     using TreeShared<ContainerNode>::deref;
@@ -66,9 +66,9 @@ public:
 private:
     HTMLObjectElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void removedFrom(Node*) OVERRIDE;
diff --git a/Source/WebCore/html/HTMLOptGroupElement.cpp b/Source/WebCore/html/HTMLOptGroupElement.cpp
index 86950640b..6daa35df3 100644
--- a/Source/WebCore/html/HTMLOptGroupElement.cpp
+++ b/Source/WebCore/html/HTMLOptGroupElement.cpp
@@ -72,9 +72,9 @@ void HTMLOptGroupElement::childrenChanged(bool changedByParser, Node* beforeChan
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
-void HTMLOptGroupElement::parseAttribute(Attribute* attr)
+void HTMLOptGroupElement::parseAttribute(const Attribute& attribute)
 {
-    HTMLElement::parseAttribute(attr);
+    HTMLElement::parseAttribute(attribute);
     recalcSelectOptions();
 }
 
diff --git a/Source/WebCore/html/HTMLOptGroupElement.h b/Source/WebCore/html/HTMLOptGroupElement.h
index bfd6fe4dc..81a244e7d 100644
--- a/Source/WebCore/html/HTMLOptGroupElement.h
+++ b/Source/WebCore/html/HTMLOptGroupElement.h
@@ -44,7 +44,7 @@ private:
     virtual const AtomicString& formControlType() const;
     virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool rendererIsNeeded(const NodeRenderingContext&) { return false; }
     virtual void attach();
     virtual void detach();
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index baf6ca98e..7bce8e614 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -185,26 +185,26 @@ int HTMLOptionElement::index() const
     return 0;
 }
 
-void HTMLOptionElement::parseAttribute(Attribute* attr)
+void HTMLOptionElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == disabledAttr) {
+    if (attribute.name() == disabledAttr) {
         bool oldDisabled = m_disabled;
-        m_disabled = !attr->isNull();
+        m_disabled = !attribute.isNull();
         if (oldDisabled != m_disabled) {
             setNeedsStyleRecalc();
             if (renderer() && renderer()->style()->hasAppearance())
                 renderer()->theme()->stateChanged(renderer(), EnabledState);
         }
-    } else if (attr->name() == selectedAttr) {
+    } else if (attribute.name() == selectedAttr) {
         // FIXME: This doesn't match what the HTML specification says.
         // The specification implies that removing the selected attribute or
         // changing the value of a selected attribute that is already present
         // has no effect on whether the element is selected. Further, it seems
         // that we need to do more than just set m_isSelected to select in that
         // case; we'd need to do the other work from the setSelected function.
-        m_isSelected = !attr->isNull();
+        m_isSelected = !attribute.isNull();
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 String HTMLOptionElement::value() const
diff --git a/Source/WebCore/html/HTMLOptionElement.h b/Source/WebCore/html/HTMLOptionElement.h
index 064845a9c..f9c50aac6 100644
--- a/Source/WebCore/html/HTMLOptionElement.h
+++ b/Source/WebCore/html/HTMLOptionElement.h
@@ -73,7 +73,7 @@ private:
     virtual void detach();
     virtual void setRenderStyle(PassRefPtr<RenderStyle>);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void accessKeyAction(bool);
diff --git a/Source/WebCore/html/HTMLOutputElement.cpp b/Source/WebCore/html/HTMLOutputElement.cpp
index 0e1155fd4..5432c92f1 100644
--- a/Source/WebCore/html/HTMLOutputElement.cpp
+++ b/Source/WebCore/html/HTMLOutputElement.cpp
@@ -61,12 +61,12 @@ bool HTMLOutputElement::supportsFocus() const
     return Node::supportsFocus() && !disabled();
 }
 
-void HTMLOutputElement::parseAttribute(Attribute* attr)
+void HTMLOutputElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == HTMLNames::forAttr)
-        setFor(attr->value());
+    if (attribute.name() == HTMLNames::forAttr)
+        setFor(attribute.value());
     else
-        HTMLFormControlElement::parseAttribute(attr);
+        HTMLFormControlElement::parseAttribute(attribute);
 }
 
 DOMSettableTokenList* HTMLOutputElement::htmlFor() const
diff --git a/Source/WebCore/html/HTMLOutputElement.h b/Source/WebCore/html/HTMLOutputElement.h
index 16af96776..da2c8d897 100644
--- a/Source/WebCore/html/HTMLOutputElement.h
+++ b/Source/WebCore/html/HTMLOutputElement.h
@@ -55,7 +55,7 @@ public:
 private:
     HTMLOutputElement(const QualifiedName&, Document*, HTMLFormElement*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual const AtomicString& formControlType() const;
     virtual bool isEnumeratable() const { return true; }
     virtual bool supportLabels() const OVERRIDE { return true; }
diff --git a/Source/WebCore/html/HTMLParagraphElement.cpp b/Source/WebCore/html/HTMLParagraphElement.cpp
index bc98710a1..2141b280a 100644
--- a/Source/WebCore/html/HTMLParagraphElement.cpp
+++ b/Source/WebCore/html/HTMLParagraphElement.cpp
@@ -56,19 +56,19 @@ bool HTMLParagraphElement::isPresentationAttribute(const QualifiedName& name) co
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLParagraphElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLParagraphElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == alignAttr) {
-        if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
+    if (attribute.name() == alignAttr) {
+        if (equalIgnoringCase(attribute.value(), "middle") || equalIgnoringCase(attribute.value(), "center"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitCenter);
-        else if (equalIgnoringCase(attr->value(), "left"))
+        else if (equalIgnoringCase(attribute.value(), "left"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitLeft);
-        else if (equalIgnoringCase(attr->value(), "right"))
+        else if (equalIgnoringCase(attribute.value(), "right"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitRight);
         else
-            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attribute.value());
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLParagraphElement.h b/Source/WebCore/html/HTMLParagraphElement.h
index 736567949..db1a11348 100644
--- a/Source/WebCore/html/HTMLParagraphElement.h
+++ b/Source/WebCore/html/HTMLParagraphElement.h
@@ -36,7 +36,7 @@ private:
     HTMLParagraphElement(const QualifiedName&, Document*);
 
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLPlugInElement.cpp b/Source/WebCore/html/HTMLPlugInElement.cpp
index a6c24522c..5bdf60d44 100644
--- a/Source/WebCore/html/HTMLPlugInElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInElement.cpp
@@ -88,6 +88,11 @@ void HTMLPlugInElement::detach()
     HTMLFrameOwnerElement::detach();
 }
 
+void HTMLPlugInElement::resetInstance()
+{
+    m_instance.clear();
+}
+
 PassScriptInstance HTMLPlugInElement::getInstance()
 {
     Frame* frame = document()->frame();
@@ -142,22 +147,22 @@ bool HTMLPlugInElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLFrameOwnerElement::isPresentationAttribute(name);
 }
 
-void HTMLPlugInElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLPlugInElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == widthAttr)
-        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
-    else if (attr->name() == heightAttr)
-        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
-    else if (attr->name() == vspaceAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
-    } else if (attr->name() == hspaceAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
-    } else if (attr->name() == alignAttr)
-        applyAlignmentAttributeToStyle(attr, style);
+    if (attribute.name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
+    else if (attribute.name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attribute.value());
+    else if (attribute.name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attribute.value());
+    } else if (attribute.name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attribute.value());
+    } else if (attribute.name() == alignAttr)
+        applyAlignmentAttributeToStyle(attribute, style);
     else
-        HTMLFrameOwnerElement::collectStyleForAttribute(attr, style);
+        HTMLFrameOwnerElement::collectStyleForAttribute(attribute, style);
 }
 
 void HTMLPlugInElement::defaultEventHandler(Event* event)
diff --git a/Source/WebCore/html/HTMLPlugInElement.h b/Source/WebCore/html/HTMLPlugInElement.h
index 65f869bdb..813f8063d 100644
--- a/Source/WebCore/html/HTMLPlugInElement.h
+++ b/Source/WebCore/html/HTMLPlugInElement.h
@@ -40,6 +40,8 @@ class HTMLPlugInElement : public HTMLFrameOwnerElement {
 public:
     virtual ~HTMLPlugInElement();
 
+    void resetInstance();
+
     PassScriptInstance getInstance();
 
     Widget* pluginWidget();
@@ -58,7 +60,7 @@ protected:
 
     virtual void detach();
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     bool m_inBeforeLoadEventHandler;
     // Subclasses should use guardedDispatchBeforeLoadEvent instead of calling dispatchBeforeLoadEvent directly.
diff --git a/Source/WebCore/html/HTMLPlugInImageElement.cpp b/Source/WebCore/html/HTMLPlugInImageElement.cpp
index 4471c63d5..4954e36d5 100644
--- a/Source/WebCore/html/HTMLPlugInImageElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInImageElement.cpp
@@ -32,6 +32,7 @@
 #include "RenderEmbeddedObject.h"
 #include "RenderImage.h"
 #include "SecurityOrigin.h"
+#include "StyleResolver.h"
 
 namespace WebCore {
 
@@ -45,7 +46,7 @@ HTMLPlugInImageElement::HTMLPlugInImageElement(const QualifiedName& tagName, Doc
     , m_shouldPreferPlugInsForImages(preferPlugInsForImagesOption == ShouldPreferPlugInsForImages)
     , m_needsDocumentActivationCallbacks(false)
 {
-    setHasCustomWillOrDidRecalcStyle();
+    setHasCustomCallbacks();
 }
 
 HTMLPlugInImageElement::~HTMLPlugInImageElement()
@@ -224,8 +225,6 @@ void HTMLPlugInImageElement::documentWillSuspendForPageCache()
     if (RenderStyle* renderStyle = this->renderStyle()) {
         m_customStyleForPageCache = RenderStyle::clone(renderStyle);
         m_customStyleForPageCache->setDisplay(NONE);
-        setHasCustomStyleForRenderer();
-
         recalcStyle(Force);
     }
 
@@ -236,8 +235,6 @@ void HTMLPlugInImageElement::documentDidResumeFromPageCache()
 {
     if (m_customStyleForPageCache) {
         m_customStyleForPageCache = 0;
-        clearHasCustomStyleForRenderer();
-
         recalcStyle(Force);
     }
     
@@ -246,7 +243,8 @@ void HTMLPlugInImageElement::documentDidResumeFromPageCache()
 
 PassRefPtr<RenderStyle> HTMLPlugInImageElement::customStyleForRenderer()
 {
-    ASSERT(m_customStyleForPageCache);
+    if (!m_customStyleForPageCache)
+        return document()->styleResolver()->styleForElement(this);
     return m_customStyleForPageCache;
 }
 
diff --git a/Source/WebCore/html/HTMLPreElement.cpp b/Source/WebCore/html/HTMLPreElement.cpp
index 839c52a3d..932af12f9 100644
--- a/Source/WebCore/html/HTMLPreElement.cpp
+++ b/Source/WebCore/html/HTMLPreElement.cpp
@@ -49,12 +49,12 @@ bool HTMLPreElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLPreElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLPreElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == wrapAttr)
+    if (attribute.name() == wrapAttr)
         style->setProperty(CSSPropertyWhiteSpace, CSSValuePreWrap);
     else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLPreElement.h b/Source/WebCore/html/HTMLPreElement.h
index 6c21afd59..8657325f2 100644
--- a/Source/WebCore/html/HTMLPreElement.h
+++ b/Source/WebCore/html/HTMLPreElement.h
@@ -35,7 +35,7 @@ private:
     HTMLPreElement(const QualifiedName&, Document*);
 
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLProgressElement.cpp b/Source/WebCore/html/HTMLProgressElement.cpp
index af8191f3e..2d47d820e 100644
--- a/Source/WebCore/html/HTMLProgressElement.cpp
+++ b/Source/WebCore/html/HTMLProgressElement.cpp
@@ -73,11 +73,11 @@ bool HTMLProgressElement::supportsFocus() const
     return Node::supportsFocus() && !disabled();
 }
 
-void HTMLProgressElement::parseAttribute(Attribute* attribute)
+void HTMLProgressElement::parseAttribute(const Attribute& attribute)
 {
-    if (attribute->name() == valueAttr)
+    if (attribute.name() == valueAttr)
         didElementStateChange();
-    else if (attribute->name() == maxAttr)
+    else if (attribute.name() == maxAttr)
         didElementStateChange();
     else
         LabelableElement::parseAttribute(attribute);
diff --git a/Source/WebCore/html/HTMLProgressElement.h b/Source/WebCore/html/HTMLProgressElement.h
index 35fff15e6..e2e8a270d 100644
--- a/Source/WebCore/html/HTMLProgressElement.h
+++ b/Source/WebCore/html/HTMLProgressElement.h
@@ -58,7 +58,7 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual void attach();
 
diff --git a/Source/WebCore/html/HTMLScriptElement.cpp b/Source/WebCore/html/HTMLScriptElement.cpp
index 0e37be8d7..fba8b8bcf 100644
--- a/Source/WebCore/html/HTMLScriptElement.cpp
+++ b/Source/WebCore/html/HTMLScriptElement.cpp
@@ -58,20 +58,18 @@ void HTMLScriptElement::childrenChanged(bool changedByParser, Node* beforeChange
     ScriptElement::childrenChanged();
 }
 
-void HTMLScriptElement::parseAttribute(Attribute* attr)
+void HTMLScriptElement::parseAttribute(const Attribute& attribute)
 {
-    const QualifiedName& attrName = attr->name();
-
-    if (attrName == srcAttr)
-        handleSourceAttribute(attr->value());
-    else if (attr->name() == asyncAttr)
+    if (attribute.name() == srcAttr)
+        handleSourceAttribute(attribute.value());
+    else if (attribute.name() == asyncAttr)
         handleAsyncAttribute();
-    else if (attrName == onloadAttr)
-        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onbeforeloadAttr)
-        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else if (attribute.name() == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attribute));
     else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 Node::InsertionNotificationRequest HTMLScriptElement::insertedInto(Node* insertionPoint)
diff --git a/Source/WebCore/html/HTMLScriptElement.h b/Source/WebCore/html/HTMLScriptElement.h
index 038cbe191..06fcff0c8 100644
--- a/Source/WebCore/html/HTMLScriptElement.h
+++ b/Source/WebCore/html/HTMLScriptElement.h
@@ -44,7 +44,7 @@ public:
 private:
     HTMLScriptElement(const QualifiedName&, Document*, bool wasInsertedByParser, bool alreadyStarted);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index 58a9a739c..b4efee12f 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -41,6 +41,7 @@
 #include "HTMLOptionElement.h"
 #include "HTMLOptionsCollection.h"
 #include "KeyboardEvent.h"
+#include "LocalizedStrings.h"
 #include "MouseEvent.h"
 #include "NodeRenderingContext.h"
 #include "Page.h"
@@ -145,8 +146,22 @@ bool HTMLSelectElement::hasPlaceholderLabelOption() const
     return !listIndex && option->value().isEmpty();
 }
 
+String HTMLSelectElement::validationMessage() const
+{
+    if (!willValidate())
+        return String();
+
+    if (customError())
+        return customValidationMessage();
+
+    return valueMissing() ? validationMessageValueMissingForSelectText() : String();
+}
+
 bool HTMLSelectElement::valueMissing() const
 {
+    if (!willValidate())
+        return false;
+
     if (!isRequiredFormControl())
         return false;
 
@@ -268,15 +283,15 @@ bool HTMLSelectElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLFormControlElementWithState::isPresentationAttribute(name);
 }
 
-void HTMLSelectElement::parseAttribute(Attribute* attr)
+void HTMLSelectElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == sizeAttr) {
+    if (attribute.name() == sizeAttr) {
         int oldSize = m_size;
         // Set the attribute value to a number.
         // This is important since the style rules for this attribute can determine the appearance property.
-        int size = attr->value().toInt();
+        int size = attribute.value().toInt();
         String attrSize = String::number(size);
-        if (attrSize != attr->value()) {
+        if (attrSize != attribute.value()) {
             // FIXME: This is horribly factored.
             if (Attribute* sizeAttribute = getAttributeItem(sizeAttr))
                 sizeAttribute->setValue(attrSize);
@@ -293,14 +308,14 @@ void HTMLSelectElement::parseAttribute(Attribute* attr)
             reattach();
             setRecalcListItems();
         }
-    } else if (attr->name() == multipleAttr)
-        parseMultipleAttribute(attr);
-    else if (attr->name() == accesskeyAttr) {
+    } else if (attribute.name() == multipleAttr)
+        parseMultipleAttribute(attribute);
+    else if (attribute.name() == accesskeyAttr) {
         // FIXME: ignore for the moment.
-    } else if (attr->name() == onchangeAttr)
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
+    } else if (attribute.name() == onchangeAttr)
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attribute));
     else
-        HTMLFormControlElementWithState::parseAttribute(attr);
+        HTMLFormControlElementWithState::parseAttribute(attribute);
 }
 
 bool HTMLSelectElement::isKeyboardFocusable(KeyboardEvent* event) const
@@ -413,7 +428,7 @@ void HTMLSelectElement::setOption(unsigned index, HTMLOptionElement* option, Exc
     if (index > maxSelectItems - 1)
         index = maxSelectItems - 1;
     int diff = index - length();
-    HTMLElement* before = 0;
+    RefPtr<HTMLElement> before = 0;
     // Out of array bounds? First insert empty dummies.
     if (diff > 0) {
         setLength(index, ec);
@@ -424,7 +439,7 @@ void HTMLSelectElement::setOption(unsigned index, HTMLOptionElement* option, Exc
     }
     // Finally add the new element.
     if (!ec) {
-        add(option, before, ec);
+        add(option, before.get(), ec);
         if (diff >= 0 && option->selected())
             optionSelectionStateChanged(option, true);
     }
@@ -938,10 +953,10 @@ void HTMLSelectElement::restoreFormControlState(const String& state)
     setNeedsValidityCheck();
 }
 
-void HTMLSelectElement::parseMultipleAttribute(const Attribute* attribute)
+void HTMLSelectElement::parseMultipleAttribute(const Attribute& attribute)
 {
     bool oldUsesMenuList = usesMenuList();
-    m_multiple = !attribute->isNull();
+    m_multiple = !attribute.isNull();
     setNeedsValidityCheck();
     if (oldUsesMenuList != usesMenuList())
         reattachIfAttached();
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index 52665e195..dc8954f97 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -46,7 +46,8 @@ public:
     void optionSelectedByUser(int index, bool dispatchChangeEvent, bool allowMultipleSelection = false);
 
     // For ValidityState
-    bool valueMissing() const;
+    virtual String validationMessage() const OVERRIDE;
+    virtual bool valueMissing() const OVERRIDE;
 
     unsigned length() const;
 
@@ -123,7 +124,7 @@ private:
     virtual bool saveFormControlState(String& value) const;
     virtual void restoreFormControlState(const String&);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
 
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
@@ -157,7 +158,7 @@ private:
     typedef unsigned SelectOptionFlags;
     void selectOption(int optionIndex, SelectOptionFlags = 0);
     void deselectItemsWithoutValidation(HTMLElement* elementToExclude = 0);
-    void parseMultipleAttribute(const Attribute*);
+    void parseMultipleAttribute(const Attribute&);
     int lastSelectedListIndex() const;
     void updateSelectedState(int listIndex, bool multi, bool shift);
     void menuListDefaultEventHandler(Event*);
diff --git a/Source/WebCore/html/HTMLStyleElement.cpp b/Source/WebCore/html/HTMLStyleElement.cpp
index d1afa1b90..195fd50c4 100644
--- a/Source/WebCore/html/HTMLStyleElement.cpp
+++ b/Source/WebCore/html/HTMLStyleElement.cpp
@@ -70,24 +70,24 @@ PassRefPtr<HTMLStyleElement> HTMLStyleElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLStyleElement(tagName, document, createdByParser));
 }
 
-void HTMLStyleElement::parseAttribute(Attribute* attr)
+void HTMLStyleElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == titleAttr && m_sheet)
-        m_sheet->setTitle(attr->value());
-    else if (attr->name() == onloadAttr)
-        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onerrorAttr)
-        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
+    if (attribute.name() == titleAttr && m_sheet)
+        m_sheet->setTitle(attribute.value());
+    else if (attribute.name() == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onerrorAttr)
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attribute));
 #if ENABLE(STYLE_SCOPED)
-    else if (attr->name() == scopedAttr) {
-        if (!attr->isNull() && !m_isRegisteredWithScopingNode && inDocument())
+    else if (attribute.name() == scopedAttr) {
+        if (!attribute.isNull() && !m_isRegisteredWithScopingNode && inDocument())
             registerWithScopingNode();
-        else if (attr->isNull() && m_isRegisteredWithScopingNode)
+        else if (attribute.isNull() && m_isRegisteredWithScopingNode)
             unregisterWithScopingNode();
     }
 #endif
     else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 }
 
 void HTMLStyleElement::finishParsingChildren()
diff --git a/Source/WebCore/html/HTMLStyleElement.h b/Source/WebCore/html/HTMLStyleElement.h
index 1ff57c82d..e8b78a64f 100644
--- a/Source/WebCore/html/HTMLStyleElement.h
+++ b/Source/WebCore/html/HTMLStyleElement.h
@@ -59,7 +59,7 @@ private:
     HTMLStyleElement(const QualifiedName&, Document*, bool createdByParser);
 
     // overload from HTMLElement
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void removedFrom(Node*) OVERRIDE;
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.cpp b/Source/WebCore/html/HTMLTableCaptionElement.cpp
index 4e6445bb3..051d8219c 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.cpp
+++ b/Source/WebCore/html/HTMLTableCaptionElement.cpp
@@ -51,13 +51,13 @@ bool HTMLTableCaptionElement::isPresentationAttribute(const QualifiedName& name)
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLTableCaptionElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLTableCaptionElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == alignAttr) {
-        if (!attr->isEmpty())
-            addPropertyToAttributeStyle(style, CSSPropertyCaptionSide, attr->value());
+    if (attribute.name() == alignAttr) {
+        if (!attribute.isEmpty())
+            addPropertyToAttributeStyle(style, CSSPropertyCaptionSide, attribute.value());
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.h b/Source/WebCore/html/HTMLTableCaptionElement.h
index 4d3c1d8c0..2346ba33f 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.h
+++ b/Source/WebCore/html/HTMLTableCaptionElement.h
@@ -38,7 +38,7 @@ private:
     HTMLTableCaptionElement(const QualifiedName&, Document*);
 
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLTableCellElement.cpp b/Source/WebCore/html/HTMLTableCellElement.cpp
index ff0b3c8ed..c75ecc8a1 100644
--- a/Source/WebCore/html/HTMLTableCellElement.cpp
+++ b/Source/WebCore/html/HTMLTableCellElement.cpp
@@ -82,36 +82,36 @@ bool HTMLTableCellElement::isPresentationAttribute(const QualifiedName& name) co
     return HTMLTablePartElement::isPresentationAttribute(name);
 }
 
-void HTMLTableCellElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLTableCellElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == nowrapAttr) {
+    if (attribute.name() == nowrapAttr) {
         addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValueWebkitNowrap);
-    } else if (attr->name() == widthAttr) {
-        if (!attr->value().isEmpty()) {
-            int widthInt = attr->value().toInt();
+    } else if (attribute.name() == widthAttr) {
+        if (!attribute.value().isEmpty()) {
+            int widthInt = attribute.value().toInt();
             if (widthInt > 0) // width="0" is ignored for compatibility with WinIE.
-                addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+                addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
         }
-    } else if (attr->name() == heightAttr) {
-        if (!attr->value().isEmpty()) {
-            int heightInt = attr->value().toInt();
+    } else if (attribute.name() == heightAttr) {
+        if (!attribute.value().isEmpty()) {
+            int heightInt = attribute.value().toInt();
             if (heightInt > 0) // height="0" is ignored for compatibility with WinIE.
-                addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+                addHTMLLengthToStyle(style, CSSPropertyHeight, attribute.value());
         }
     } else
-        HTMLTablePartElement::collectStyleForAttribute(attr, style);
+        HTMLTablePartElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLTableCellElement::parseAttribute(Attribute* attr)
+void HTMLTableCellElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == rowspanAttr) {
+    if (attribute.name() == rowspanAttr) {
         if (renderer() && renderer()->isTableCell())
             toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
-    } else if (attr->name() == colspanAttr) {
+    } else if (attribute.name() == colspanAttr) {
         if (renderer() && renderer()->isTableCell())
             toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
     } else
-        HTMLTablePartElement::parseAttribute(attr);
+        HTMLTablePartElement::parseAttribute(attribute);
 }
 
 StylePropertySet* HTMLTableCellElement::additionalAttributeStyle()
diff --git a/Source/WebCore/html/HTMLTableCellElement.h b/Source/WebCore/html/HTMLTableCellElement.h
index 2f41d604e..5213e1c16 100644
--- a/Source/WebCore/html/HTMLTableCellElement.h
+++ b/Source/WebCore/html/HTMLTableCellElement.h
@@ -53,9 +53,9 @@ public:
 private:
     HTMLTableCellElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
diff --git a/Source/WebCore/html/HTMLTableColElement.cpp b/Source/WebCore/html/HTMLTableColElement.cpp
index 1f4a2ff6e..d769b0424 100644
--- a/Source/WebCore/html/HTMLTableColElement.cpp
+++ b/Source/WebCore/html/HTMLTableColElement.cpp
@@ -54,22 +54,22 @@ bool HTMLTableColElement::isPresentationAttribute(const QualifiedName& name) con
     return HTMLTablePartElement::isPresentationAttribute(name);
 }
 
-void HTMLTableColElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLTableColElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == widthAttr)
-        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    if (attribute.name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
     else
-        HTMLTablePartElement::collectStyleForAttribute(attr, style);
+        HTMLTablePartElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLTableColElement::parseAttribute(Attribute* attr)
+void HTMLTableColElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == spanAttr) {
-        m_span = !attr->isNull() ? attr->value().toInt() : 1;
+    if (attribute.name() == spanAttr) {
+        m_span = !attribute.isNull() ? attribute.value().toInt() : 1;
         if (renderer() && renderer()->isTableCol())
             renderer()->updateFromElement();
-    } else if (attr->name() == widthAttr) {
-        if (!attr->value().isEmpty()) {
+    } else if (attribute.name() == widthAttr) {
+        if (!attribute.isEmpty()) {
             if (renderer() && renderer()->isTableCol()) {
                 RenderTableCol* col = toRenderTableCol(renderer());
                 int newWidth = width().toInt();
@@ -78,7 +78,7 @@ void HTMLTableColElement::parseAttribute(Attribute* attr)
             }
         }
     } else
-        HTMLTablePartElement::parseAttribute(attr);
+        HTMLTablePartElement::parseAttribute(attribute);
 }
 
 StylePropertySet* HTMLTableColElement::additionalAttributeStyle()
diff --git a/Source/WebCore/html/HTMLTableColElement.h b/Source/WebCore/html/HTMLTableColElement.h
index 6cff11624..1916d250a 100644
--- a/Source/WebCore/html/HTMLTableColElement.h
+++ b/Source/WebCore/html/HTMLTableColElement.h
@@ -42,9 +42,9 @@ public:
 private:
     HTMLTableColElement(const QualifiedName& tagName, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
     int m_span;
diff --git a/Source/WebCore/html/HTMLTableElement.cpp b/Source/WebCore/html/HTMLTableElement.cpp
index 98f76bd99..a6fa17d7b 100644
--- a/Source/WebCore/html/HTMLTableElement.cpp
+++ b/Source/WebCore/html/HTMLTableElement.cpp
@@ -304,54 +304,54 @@ static bool getBordersFromFrameAttributeValue(const AtomicString& value, bool& b
     return true;
 }
 
-void HTMLTableElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
-{
-    if (attr->name() == widthAttr)
-        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
-    else if (attr->name() == heightAttr)
-        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
-    else if (attr->name() == borderAttr) {
-        int borderWidth = attr->isEmpty() ? 1 : attr->value().toInt();
+void HTMLTableElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
+{
+    if (attribute.name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
+    else if (attribute.name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attribute.value());
+    else if (attribute.name() == borderAttr) {
+        int borderWidth = attribute.isEmpty() ? 1 : attribute.value().toInt();
         addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, borderWidth, CSSPrimitiveValue::CSS_PX);
-    } else if (attr->name() == bordercolorAttr) {
-        if (!attr->isEmpty())
-            addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
-    } else if (attr->name() == bgcolorAttr)
-        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
-    else if (attr->name() == backgroundAttr) {
-        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
+    } else if (attribute.name() == bordercolorAttr) {
+        if (!attribute.isEmpty())
+            addHTMLColorToStyle(style, CSSPropertyBorderColor, attribute.value());
+    } else if (attribute.name() == bgcolorAttr)
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attribute.value());
+    else if (attribute.name() == backgroundAttr) {
+        String url = stripLeadingAndTrailingHTMLSpaces(attribute.value());
         if (!url.isEmpty())
             style->setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document()->completeURL(url).string())));
-    } else if (attr->name() == valignAttr) {
-        if (!attr->isEmpty())
-            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attr->value());
-    } else if (attr->name() == cellspacingAttr) {
-        if (!attr->isEmpty())
-            addHTMLLengthToStyle(style, CSSPropertyBorderSpacing, attr->value());
-    } else if (attr->name() == vspaceAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
-    } else if (attr->name() == hspaceAttr) {
-        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
-        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
-    } else if (attr->name() == alignAttr) {
-        if (!attr->value().isEmpty()) {
-            if (equalIgnoringCase(attr->value(), "center")) {
+    } else if (attribute.name() == valignAttr) {
+        if (!attribute.isEmpty())
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attribute.value());
+    } else if (attribute.name() == cellspacingAttr) {
+        if (!attribute.isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyBorderSpacing, attribute.value());
+    } else if (attribute.name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attribute.value());
+    } else if (attribute.name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attribute.value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attribute.value());
+    } else if (attribute.name() == alignAttr) {
+        if (!attribute.value().isEmpty()) {
+            if (equalIgnoringCase(attribute.value(), "center")) {
                 addPropertyToAttributeStyle(style, CSSPropertyWebkitMarginStart, CSSValueAuto);
                 addPropertyToAttributeStyle(style, CSSPropertyWebkitMarginEnd, CSSValueAuto);
             } else
-                addPropertyToAttributeStyle(style, CSSPropertyFloat, attr->value());
+                addPropertyToAttributeStyle(style, CSSPropertyFloat, attribute.value());
         }
-    } else if (attr->name() == rulesAttr) {
+    } else if (attribute.name() == rulesAttr) {
         // The presence of a valid rules attribute causes border collapsing to be enabled.
         if (m_rulesAttr != UnsetRules)
             addPropertyToAttributeStyle(style, CSSPropertyBorderCollapse, CSSValueCollapse);
-    } else if (attr->name() == frameAttr) {
+    } else if (attribute.name() == frameAttr) {
         bool borderTop;
         bool borderRight;
         bool borderBottom;
         bool borderLeft;
-        if (getBordersFromFrameAttributeValue(attr->value(), borderTop, borderRight, borderBottom, borderLeft)) {
+        if (getBordersFromFrameAttributeValue(attribute.value(), borderTop, borderRight, borderBottom, borderLeft)) {
             addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, CSSValueThin);
             addPropertyToAttributeStyle(style, CSSPropertyBorderTopStyle, borderTop ? CSSValueSolid : CSSValueHidden);
             addPropertyToAttributeStyle(style, CSSPropertyBorderBottomStyle, borderBottom ? CSSValueSolid : CSSValueHidden);
@@ -359,7 +359,7 @@ void HTMLTableElement::collectStyleForAttribute(Attribute* attr, StylePropertySe
             addPropertyToAttributeStyle(style, CSSPropertyBorderRightStyle, borderRight ? CSSValueSolid : CSSValueHidden);
         }
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 bool HTMLTableElement::isPresentationAttribute(const QualifiedName& name) const
@@ -369,48 +369,48 @@ bool HTMLTableElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLTableElement::parseAttribute(Attribute* attr)
+void HTMLTableElement::parseAttribute(const Attribute& attribute)
 {
     CellBorders bordersBefore = cellBorders();
     unsigned short oldPadding = m_padding;
 
-    if (attr->name() == borderAttr)  {
+    if (attribute.name() == borderAttr)  {
         // FIXME: This attribute is a mess.
         m_borderAttr = true;
-        if (!attr->isNull()) {
-            int border = attr->isEmpty() ? 1 : attr->value().toInt();
+        if (!attribute.isNull()) {
+            int border = attribute.isEmpty() ? 1 : attribute.value().toInt();
             m_borderAttr = border;
         }
-    } else if (attr->name() == bordercolorAttr) {
-        m_borderColorAttr = !attr->isEmpty();
-    } else if (attr->name() == frameAttr) {
+    } else if (attribute.name() == bordercolorAttr) {
+        m_borderColorAttr = !attribute.isEmpty();
+    } else if (attribute.name() == frameAttr) {
         // FIXME: This attribute is a mess.
         bool borderTop;
         bool borderRight;
         bool borderBottom;
         bool borderLeft;
-        m_frameAttr = getBordersFromFrameAttributeValue(attr->value(), borderTop, borderRight, borderBottom, borderLeft);
-    } else if (attr->name() == rulesAttr) {
+        m_frameAttr = getBordersFromFrameAttributeValue(attribute.value(), borderTop, borderRight, borderBottom, borderLeft);
+    } else if (attribute.name() == rulesAttr) {
         m_rulesAttr = UnsetRules;
-        if (equalIgnoringCase(attr->value(), "none"))
+        if (equalIgnoringCase(attribute.value(), "none"))
             m_rulesAttr = NoneRules;
-        else if (equalIgnoringCase(attr->value(), "groups"))
+        else if (equalIgnoringCase(attribute.value(), "groups"))
             m_rulesAttr = GroupsRules;
-        else if (equalIgnoringCase(attr->value(), "rows"))
+        else if (equalIgnoringCase(attribute.value(), "rows"))
             m_rulesAttr = RowsRules;
-        if (equalIgnoringCase(attr->value(), "cols"))
+        if (equalIgnoringCase(attribute.value(), "cols"))
             m_rulesAttr = ColsRules;
-        if (equalIgnoringCase(attr->value(), "all"))
+        if (equalIgnoringCase(attribute.value(), "all"))
             m_rulesAttr = AllRules;
-    } else if (attr->name() == cellpaddingAttr) {
-        if (!attr->value().isEmpty())
-            m_padding = max(0, attr->value().toInt());
+    } else if (attribute.name() == cellpaddingAttr) {
+        if (!attribute.value().isEmpty())
+            m_padding = max(0, attribute.value().toInt());
         else
             m_padding = 1;
-    } else if (attr->name() == colsAttr) {
+    } else if (attribute.name() == colsAttr) {
         // ###
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::parseAttribute(attribute);
 
     if (bordersBefore != cellBorders() || oldPadding != m_padding) {
         m_sharedCellStyle = 0;
diff --git a/Source/WebCore/html/HTMLTableElement.h b/Source/WebCore/html/HTMLTableElement.h
index 463e8a4f8..d492b5453 100644
--- a/Source/WebCore/html/HTMLTableElement.h
+++ b/Source/WebCore/html/HTMLTableElement.h
@@ -71,9 +71,9 @@ public:
 private:
     HTMLTableElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
 
     // Used to obtain either a solid or outset border decl and to deal with the frame and rules attributes.
diff --git a/Source/WebCore/html/HTMLTablePartElement.cpp b/Source/WebCore/html/HTMLTablePartElement.cpp
index c6fb149f5..d0aa0cae5 100644
--- a/Source/WebCore/html/HTMLTablePartElement.cpp
+++ b/Source/WebCore/html/HTMLTablePartElement.cpp
@@ -45,46 +45,46 @@ bool HTMLTablePartElement::isPresentationAttribute(const QualifiedName& name) co
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLTablePartElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLTablePartElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == bgcolorAttr)
-        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
-    else if (attr->name() == backgroundAttr) {
-        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
+    if (attribute.name() == bgcolorAttr)
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attribute.value());
+    else if (attribute.name() == backgroundAttr) {
+        String url = stripLeadingAndTrailingHTMLSpaces(attribute.value());
         if (!url.isEmpty())
             style->setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document()->completeURL(url).string())));
-    } else if (attr->name() == bordercolorAttr) {
-        if (!attr->value().isEmpty()) {
-            addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+    } else if (attribute.name() == bordercolorAttr) {
+        if (!attribute.value().isEmpty()) {
+            addHTMLColorToStyle(style, CSSPropertyBorderColor, attribute.value());
             addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
         }
-    } else if (attr->name() == valignAttr) {
-        if (equalIgnoringCase(attr->value(), "top"))
+    } else if (attribute.name() == valignAttr) {
+        if (equalIgnoringCase(attribute.value(), "top"))
             addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueTop);
-        else if (equalIgnoringCase(attr->value(), "middle"))
+        else if (equalIgnoringCase(attribute.value(), "middle"))
             addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueMiddle);
-        else if (equalIgnoringCase(attr->value(), "bottom"))
+        else if (equalIgnoringCase(attribute.value(), "bottom"))
             addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueBottom);
-        else if (equalIgnoringCase(attr->value(), "baseline"))
+        else if (equalIgnoringCase(attribute.value(), "baseline"))
             addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueBaseline);
         else
-            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attr->value());
-    } else if (attr->name() == alignAttr) {
-        if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attribute.value());
+    } else if (attribute.name() == alignAttr) {
+        if (equalIgnoringCase(attribute.value(), "middle") || equalIgnoringCase(attribute.value(), "center"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitCenter);
-        else if (equalIgnoringCase(attr->value(), "absmiddle"))
+        else if (equalIgnoringCase(attribute.value(), "absmiddle"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueCenter);
-        else if (equalIgnoringCase(attr->value(), "left"))
+        else if (equalIgnoringCase(attribute.value(), "left"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitLeft);
-        else if (equalIgnoringCase(attr->value(), "right"))
+        else if (equalIgnoringCase(attribute.value(), "right"))
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitRight);
         else
-            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
-    } else if (attr->name() == heightAttr) {
-        if (!attr->value().isEmpty())
-            addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attribute.value());
+    } else if (attribute.name() == heightAttr) {
+        if (!attribute.value().isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyHeight, attribute.value());
     } else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 HTMLTableElement* HTMLTablePartElement::findParentTable() const
diff --git a/Source/WebCore/html/HTMLTablePartElement.h b/Source/WebCore/html/HTMLTablePartElement.h
index d07068379..202b74158 100644
--- a/Source/WebCore/html/HTMLTablePartElement.h
+++ b/Source/WebCore/html/HTMLTablePartElement.h
@@ -40,7 +40,7 @@ protected:
     }
 
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 
     HTMLTableElement* findParentTable() const;
 };
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index 8257d0f93..1652c8911 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -37,6 +37,7 @@
 #include "FormDataList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "LocalizedStrings.h"
 #include "RenderTextControlMultiLine.h"
 #include "ShadowRoot.h"
 #include "Text.h"
@@ -132,9 +133,9 @@ bool HTMLTextAreaElement::isPresentationAttribute(const QualifiedName& name) con
     return HTMLTextFormControlElement::isPresentationAttribute(name);
 }
 
-void HTMLTextAreaElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLTextAreaElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == wrapAttr) {
+    if (attribute.name() == wrapAttr) {
         if (shouldWrapText()) {
             addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValuePreWrap);
             addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueBreakWord);
@@ -143,13 +144,13 @@ void HTMLTextAreaElement::collectStyleForAttribute(Attribute* attr, StylePropert
             addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueNormal);
         }
     } else
-        HTMLTextFormControlElement::collectStyleForAttribute(attr, style);
+        HTMLTextFormControlElement::collectStyleForAttribute(attribute, style);
 }
 
-void HTMLTextAreaElement::parseAttribute(Attribute* attr)
+void HTMLTextAreaElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == rowsAttr) {
-        int rows = attr->value().toInt();
+    if (attribute.name() == rowsAttr) {
+        int rows = attribute.value().toInt();
         if (rows <= 0)
             rows = defaultRows;
         if (m_rows != rows) {
@@ -157,8 +158,8 @@ void HTMLTextAreaElement::parseAttribute(Attribute* attr)
             if (renderer())
                 renderer()->setNeedsLayoutAndPrefWidthsRecalc();
         }
-    } else if (attr->name() == colsAttr) {
-        int cols = attr->value().toInt();
+    } else if (attribute.name() == colsAttr) {
+        int cols = attribute.value().toInt();
         if (cols <= 0)
             cols = defaultCols;
         if (m_cols != cols) {
@@ -166,13 +167,13 @@ void HTMLTextAreaElement::parseAttribute(Attribute* attr)
             if (renderer())
                 renderer()->setNeedsLayoutAndPrefWidthsRecalc();
         }
-    } else if (attr->name() == wrapAttr) {
+    } else if (attribute.name() == wrapAttr) {
         // The virtual/physical values were a Netscape extension of HTML 3.0, now deprecated.
         // The soft/hard /off values are a recommendation for HTML 4 extension by IE and NS 4.
         WrapMethod wrap;
-        if (equalIgnoringCase(attr->value(), "physical") || equalIgnoringCase(attr->value(), "hard") || equalIgnoringCase(attr->value(), "on"))
+        if (equalIgnoringCase(attribute.value(), "physical") || equalIgnoringCase(attribute.value(), "hard") || equalIgnoringCase(attribute.value(), "on"))
             wrap = HardWrap;
-        else if (equalIgnoringCase(attr->value(), "off"))
+        else if (equalIgnoringCase(attribute.value(), "off"))
             wrap = NoWrap;
         else
             wrap = SoftWrap;
@@ -181,12 +182,12 @@ void HTMLTextAreaElement::parseAttribute(Attribute* attr)
             if (renderer())
                 renderer()->setNeedsLayoutAndPrefWidthsRecalc();
         }
-    } else if (attr->name() == accesskeyAttr) {
+    } else if (attribute.name() == accesskeyAttr) {
         // ignore for the moment
-    } else if (attr->name() == maxlengthAttr)
+    } else if (attribute.name() == maxlengthAttr)
         setNeedsValidityCheck();
     else
-        HTMLTextFormControlElement::parseAttribute(attr);
+        HTMLTextFormControlElement::parseAttribute(attribute);
 }
 
 RenderObject* HTMLTextAreaElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -423,6 +424,33 @@ void HTMLTextAreaElement::setMaxLength(int newValue, ExceptionCode& ec)
         setAttribute(maxlengthAttr, String::number(newValue));
 }
 
+String HTMLTextAreaElement::validationMessage() const
+{
+    if (!willValidate())
+        return String();
+
+    if (customError())
+        return customValidationMessage();
+
+    if (valueMissing())
+        return validationMessageValueMissingText();
+
+    if (tooLong())
+        return validationMessageTooLongText(numGraphemeClusters(value()), maxLength());
+
+    return String();
+}
+
+bool HTMLTextAreaElement::valueMissing() const
+{
+    return willValidate() && valueMissing(value());
+}
+
+bool HTMLTextAreaElement::tooLong() const
+{
+    return willValidate() && tooLong(value(), CheckDirtyFlag);
+}
+
 bool HTMLTextAreaElement::tooLong(const String& value, NeedsToCheckDirtyFlag check) const
 {
     // Return false for the default value or value set by script even if it is
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index a19a471a9..c475c717e 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -47,8 +47,10 @@ public:
     int textLength() const { return value().length(); }
     virtual int maxLength() const;
     void setMaxLength(int, ExceptionCode&);
-    bool valueMissing(const String& value) const { return isRequiredFormControl() && !disabled() && !readOnly() && value.isEmpty(); }
-    bool tooLong(const String&, NeedsToCheckDirtyFlag) const;
+    // For ValidityState
+    virtual String validationMessage() const OVERRIDE;
+    virtual bool valueMissing() const OVERRIDE;
+    virtual bool tooLong() const OVERRIDE;
     bool isValidValue(const String&) const;
     
     virtual HTMLElement* innerTextElement() const;
@@ -94,9 +96,9 @@ private:
     virtual bool isTextFormControl() const { return true; }
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool appendFormData(FormDataList&, bool);
     virtual void reset();
@@ -108,6 +110,9 @@ private:
 
     virtual bool shouldUseInputMethod();
 
+    bool valueMissing(const String& value) const { return isRequiredFormControl() && !disabled() && !readOnly() && value.isEmpty(); }
+    bool tooLong(const String&, NeedsToCheckDirtyFlag) const;
+
     int m_rows;
     int m_cols;
     WrapMethod m_wrap;
diff --git a/Source/WebCore/html/HTMLTextFormControlElement.cpp b/Source/WebCore/html/HTMLTextFormControlElement.cpp
index 6a6248ce3..64109717c 100644
--- a/Source/WebCore/html/HTMLTextFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLTextFormControlElement.cpp
@@ -430,16 +430,16 @@ void HTMLTextFormControlElement::selectionChanged(bool userTriggered)
     }
 }
 
-void HTMLTextFormControlElement::parseAttribute(Attribute* attr)
+void HTMLTextFormControlElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == placeholderAttr)
+    if (attribute.name() == placeholderAttr)
         updatePlaceholderVisibility(true);
-    else if (attr->name() == onselectAttr)
-        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onchangeAttr)
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
+    else if (attribute.name() == onselectAttr)
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onchangeAttr)
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attribute));
     else
-        HTMLFormControlElementWithState::parseAttribute(attr);
+        HTMLFormControlElementWithState::parseAttribute(attribute);
 }
 
 void HTMLTextFormControlElement::notifyFormStateChanged()
diff --git a/Source/WebCore/html/HTMLTextFormControlElement.h b/Source/WebCore/html/HTMLTextFormControlElement.h
index bad807fd6..ba5f9bde3 100644
--- a/Source/WebCore/html/HTMLTextFormControlElement.h
+++ b/Source/WebCore/html/HTMLTextFormControlElement.h
@@ -90,7 +90,7 @@ protected:
     virtual bool isPlaceholderEmpty() const;
     virtual void updatePlaceholderText() = 0;
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     void cacheSelection(int start, int end, TextFieldSelectionDirection direction)
     {
diff --git a/Source/WebCore/html/HTMLTrackElement.cpp b/Source/WebCore/html/HTMLTrackElement.cpp
index 767320a97..64b19a88b 100644
--- a/Source/WebCore/html/HTMLTrackElement.cpp
+++ b/Source/WebCore/html/HTMLTrackElement.cpp
@@ -94,27 +94,25 @@ void HTMLTrackElement::removedFrom(Node* insertionPoint)
     HTMLElement::removedFrom(insertionPoint);
 }
 
-void HTMLTrackElement::parseAttribute(Attribute* attribute)
+void HTMLTrackElement::parseAttribute(const Attribute& attribute)
 {
-    const QualifiedName& attrName = attribute->name();
-
     if (RuntimeEnabledFeatures::webkitVideoTrackEnabled()) {
-        if (attrName == srcAttr) {
-            if (!attribute->isEmpty() && mediaElement())
+        if (attribute.name() == srcAttr) {
+            if (!attribute.isEmpty() && mediaElement())
                 scheduleLoad();
             // 4.8.10.12.3 Sourcing out-of-band text tracks
             // As the kind, label, and srclang attributes are set, changed, or removed, the text track must update accordingly...
-        } else if (attrName == kindAttr)
-            track()->setKind(attribute->value());
-        else if (attrName == labelAttr)
-            track()->setLabel(attribute->value());
-        else if (attrName == srclangAttr)
-            track()->setLanguage(attribute->value());
+        } else if (attribute.name() == kindAttr)
+            track()->setKind(attribute.value());
+        else if (attribute.name() == labelAttr)
+            track()->setLabel(attribute.value());
+        else if (attribute.name() == srclangAttr)
+            track()->setLanguage(attribute.value());
     }
 
-    if (attrName == onloadAttr)
+    if (attribute.name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
-    else if (attrName == onerrorAttr)
+    else if (attribute.name() == onerrorAttr)
         setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attribute));
     else
         HTMLElement::parseAttribute(attribute);
diff --git a/Source/WebCore/html/HTMLTrackElement.h b/Source/WebCore/html/HTMLTrackElement.h
index f78dae596..a05666d07 100644
--- a/Source/WebCore/html/HTMLTrackElement.h
+++ b/Source/WebCore/html/HTMLTrackElement.h
@@ -75,7 +75,7 @@ private:
     HTMLTrackElement(const QualifiedName&, Document*);
     virtual ~HTMLTrackElement();
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
 
diff --git a/Source/WebCore/html/HTMLUListElement.cpp b/Source/WebCore/html/HTMLUListElement.cpp
index 6e9a405ef..a94accdcd 100644
--- a/Source/WebCore/html/HTMLUListElement.cpp
+++ b/Source/WebCore/html/HTMLUListElement.cpp
@@ -54,12 +54,12 @@ bool HTMLUListElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLElement::isPresentationAttribute(name);
 }
 
-void HTMLUListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLUListElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == typeAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyListStyleType, attr->value());
+    if (attribute.name() == typeAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyListStyleType, attribute.value());
     else
-        HTMLElement::collectStyleForAttribute(attr, style);
+        HTMLElement::collectStyleForAttribute(attribute, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLUListElement.h b/Source/WebCore/html/HTMLUListElement.h
index 0f27514c6..2d7c5e750 100644
--- a/Source/WebCore/html/HTMLUListElement.h
+++ b/Source/WebCore/html/HTMLUListElement.h
@@ -36,7 +36,7 @@ private:
     HTMLUListElement(const QualifiedName&, Document*);
 
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLVideoElement.cpp b/Source/WebCore/html/HTMLVideoElement.cpp
index 86fe85ef0..eebe53367 100644
--- a/Source/WebCore/html/HTMLVideoElement.cpp
+++ b/Source/WebCore/html/HTMLVideoElement.cpp
@@ -95,14 +95,14 @@ void HTMLVideoElement::detach()
         m_imageLoader.clear();
 }
 
-void HTMLVideoElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void HTMLVideoElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == widthAttr)
-        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
-    else if (attr->name() == heightAttr)
-        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+    if (attribute.name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attribute.value());
+    else if (attribute.name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attribute.value());
     else
-        HTMLMediaElement::collectStyleForAttribute(attr, style);
+        HTMLMediaElement::collectStyleForAttribute(attribute, style);
 }
 
 bool HTMLVideoElement::isPresentationAttribute(const QualifiedName& name) const
@@ -112,11 +112,9 @@ bool HTMLVideoElement::isPresentationAttribute(const QualifiedName& name) const
     return HTMLMediaElement::isPresentationAttribute(name);
 }
 
-void HTMLVideoElement::parseAttribute(Attribute* attr)
+void HTMLVideoElement::parseAttribute(const Attribute& attribute)
 {
-    const QualifiedName& attrName = attr->name();
-
-    if (attrName == posterAttr) {
+    if (attribute.name() == posterAttr) {
         // Force a poster recalc by setting m_displayMode to Unknown directly before calling updateDisplayState.
         HTMLMediaElement::setDisplayMode(Unknown);
         updateDisplayState();
@@ -133,7 +131,7 @@ void HTMLVideoElement::parseAttribute(Attribute* attr)
         }
 #endif
     } else
-        HTMLMediaElement::parseAttribute(attr);
+        HTMLMediaElement::parseAttribute(attribute);
 }
 
 bool HTMLVideoElement::supportsFullscreen() const
@@ -142,15 +140,19 @@ bool HTMLVideoElement::supportsFullscreen() const
     if (!page) 
         return false;
 
-    if (!player() || !player()->supportsFullscreen() || !player()->hasVideo())
+    if (!player() || !player()->supportsFullscreen())
         return false;
 
-    // Check with the platform client.
 #if ENABLE(FULLSCREEN_API)
+    // If the full screen API is enabled and is supported for the current element
+    // do not require that the player has a video track to enter full screen.
     if (page->chrome()->client()->supportsFullScreenForElement(this, false))
         return true;
 #endif
 
+    if (!player()->hasVideo())
+        return false;
+
     return page->chrome()->client()->supportsFullscreenForNode(this);
 }
 
diff --git a/Source/WebCore/html/HTMLVideoElement.h b/Source/WebCore/html/HTMLVideoElement.h
index 67bbe352d..f14670527 100644
--- a/Source/WebCore/html/HTMLVideoElement.h
+++ b/Source/WebCore/html/HTMLVideoElement.h
@@ -75,9 +75,9 @@ private:
 #endif
     virtual void attach();
     virtual void detach();
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
     virtual bool supportsFullscreen() const;
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index cf125c9e0..146d9189c 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -283,6 +283,14 @@ bool InputType::sizeShouldIncludeDecoration(int, int& preferredSize) const
     return false;
 }
 
+bool InputType::stepMismatch(const String& value) const
+{
+    double step;
+    if (!getAllowedValueStep(&step))
+        return false;
+    return stepMismatch(value, step);
+}
+
 bool InputType::stepMismatch(const String&, double) const
 {
     // Non-supported types should be rejected by HTMLInputElement::getAllowedValueStep().
@@ -338,6 +346,41 @@ String InputType::valueMissingText() const
     return validationMessageValueMissingText();
 }
 
+String InputType::validationMessage() const
+{
+    const String value = element()->value();
+
+    // The order of the following checks is meaningful. e.g. We'd like to show the
+    // valueMissing message even if the control has other validation errors.
+    if (valueMissing(value))
+        return valueMissingText();
+
+    if (typeMismatch())
+        return typeMismatchText();
+
+    if (patternMismatch(value))
+        return validationMessagePatternMismatchText();
+
+    if (element()->tooLong())
+        return validationMessageTooLongText(numGraphemeClusters(value), element()->maxLength());
+
+    if (rangeUnderflow(value))
+        return validationMessageRangeUnderflowText(serialize(minimum()));
+
+    if (rangeOverflow(value))
+        return validationMessageRangeOverflowText(serialize(maximum()));
+
+    if (stepMismatch(value)) {
+        String stepString;
+        double step;
+        if (getAllowedValueStep(&step))
+            stepString = serializeForNumberType(step / stepScaleFactor());
+        return validationMessageStepMismatchText(serialize(stepBase()), stepString);
+    }
+
+    return String();
+}
+
 void InputType::handleClickEvent(MouseEvent*)
 {
 }
@@ -870,7 +913,7 @@ double InputType::alignValueForStep(double newValue, double step, unsigned curre
     unsigned baseDecimalPlaces;
     double base = stepBaseWithDecimalPlaces(&baseDecimalPlaces);
     baseDecimalPlaces = min(baseDecimalPlaces, 16u);
-    if (element()->stepMismatch(element()->value())) {
+    if (stepMismatch(element()->value())) {
         double scale = pow(10.0, static_cast<double>(max(stepDecimalPlaces, currentDecimalPlaces)));
         newValue = round(newValue * scale) / scale;
     } else {
@@ -1023,7 +1066,7 @@ void InputType::stepUpFromRenderer(int n)
         element()->setValue(serialize(sign > 0 ? minimum() : maximum()), DispatchInputAndChangeEvent);
     else {
         ExceptionCode ec;
-        if (element()->stepMismatch(element()->value())) {
+        if (stepMismatch(element()->value())) {
             ASSERT(step);
             double newValue;
             double scale = pow(10.0, static_cast<double>(max(stepDecimalPlaces, baseDecimalPlaces)));
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index 1c86cb0fc..b00826b08 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -140,7 +140,7 @@ public:
     virtual void setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode&) const;
 
     // Validation functions
-
+    virtual String validationMessage() const;
     virtual bool supportsValidation() const;
     virtual bool typeMismatchFor(const String&) const;
     // Type check for the current input value. We do nothing for some types
@@ -157,6 +157,7 @@ public:
     virtual double minimum() const;
     virtual double maximum() const;
     virtual bool sizeShouldIncludeDecoration(int defaultSize, int& preferredSize) const;
+    bool stepMismatch(const String&) const;
     virtual bool stepMismatch(const String&, double step) const;
     virtual double stepBase() const;
     virtual double stepBaseWithDecimalPlaces(unsigned*) const;
diff --git a/Source/WebCore/html/LinkRelAttribute.cpp b/Source/WebCore/html/LinkRelAttribute.cpp
index 5261df2d0..87071b99b 100644
--- a/Source/WebCore/html/LinkRelAttribute.cpp
+++ b/Source/WebCore/html/LinkRelAttribute.cpp
@@ -41,9 +41,11 @@ LinkRelAttribute::LinkRelAttribute()
     , m_isDNSPrefetch(false)
 #if ENABLE(LINK_PREFETCH)
     , m_isLinkPrefetch(false)
-    , m_isLinkPrerender(false)
     , m_isLinkSubresource(false)
 #endif
+#if ENABLE(LINK_PRERENDER)
+    , m_isLinkPrerender(false)
+#endif
 {
 }
 
@@ -54,9 +56,11 @@ LinkRelAttribute::LinkRelAttribute(const String& rel)
     , m_isDNSPrefetch(false)
 #if ENABLE(LINK_PREFETCH)
     , m_isLinkPrefetch(false)
-    , m_isLinkPrerender(false)
     , m_isLinkSubresource(false)
 #endif
+#if ENABLE(LINK_PRERENDER)
+    , m_isLinkPrerender(false)
+#endif
 {
     if (equalIgnoringCase(rel, "stylesheet"))
         m_isStyleSheet = true;
@@ -96,11 +100,13 @@ LinkRelAttribute::LinkRelAttribute(const String& rel)
 #if ENABLE(LINK_PREFETCH)
             else if (equalIgnoringCase(*it, "prefetch"))
               m_isLinkPrefetch = true;
-            else if (equalIgnoringCase(*it, "prerender"))
-              m_isLinkPrerender = true;
             else if (equalIgnoringCase(*it, "subresource"))
               m_isLinkSubresource = true;
 #endif
+#if ENABLE(LINK_PRERENDER)
+            else if (equalIgnoringCase(*it, "prerender"))
+              m_isLinkPrerender = true;
+#endif
         }
     }
 }
diff --git a/Source/WebCore/html/LinkRelAttribute.h b/Source/WebCore/html/LinkRelAttribute.h
index 3178194b4..98dd48191 100644
--- a/Source/WebCore/html/LinkRelAttribute.h
+++ b/Source/WebCore/html/LinkRelAttribute.h
@@ -44,9 +44,11 @@ public:
     bool m_isDNSPrefetch;
 #if ENABLE(LINK_PREFETCH)
     bool m_isLinkPrefetch;
-    bool m_isLinkPrerender;
     bool m_isLinkSubresource;
 #endif
+#if ENABLE(LINK_PRERENDER)
+    bool m_isLinkPrerender;
+#endif
 
     LinkRelAttribute();
     explicit LinkRelAttribute(const String&);
diff --git a/Source/WebCore/html/ValidityState.cpp b/Source/WebCore/html/ValidityState.cpp
index fe7312c2a..649765df9 100644
--- a/Source/WebCore/html/ValidityState.cpp
+++ b/Source/WebCore/html/ValidityState.cpp
@@ -38,177 +38,52 @@ using namespace HTMLNames;
 
 String ValidityState::validationMessage() const
 {
-    if (!toHTMLElement(m_control)->willValidate())
-        return String();
-
-    if (customError())
-        return m_customErrorMessage;
-    HTMLElement* element = toHTMLElement(m_control);
-    bool isInputElement = element->isFormControlElement() && element->hasTagName(inputTag);
-    bool isTextAreaElement = element->isFormControlElement() && element->hasTagName(textareaTag);
-    // The order of the following checks is meaningful. e.g. We'd like to show the
-    // valueMissing message even if the control has other validation errors.
-    if (valueMissing()) {
-        if (element->hasTagName(selectTag))
-            return validationMessageValueMissingForSelectText();
-        if (isInputElement)
-            return static_cast<HTMLInputElement*>(element)->valueMissingText();
-        return validationMessageValueMissingText();
-    }
-    if (typeMismatch()) {
-        if (isInputElement)
-            return static_cast<HTMLInputElement*>(element)->typeMismatchText();
-        return validationMessageTypeMismatchText();
-    }
-    if (patternMismatch())
-        return validationMessagePatternMismatchText();
-    if (tooLong()) {
-        if (!isInputElement && !isTextAreaElement) {
-            ASSERT_NOT_REACHED();
-            return String();
-        }
-        HTMLTextFormControlElement* text = static_cast<HTMLTextFormControlElement*>(element);
-        return validationMessageTooLongText(numGraphemeClusters(text->value()), text->maxLength());
-    }
-    if (rangeUnderflow()) {
-        if (!isInputElement) {
-            ASSERT_NOT_REACHED();
-            return String();
-        }
-        return validationMessageRangeUnderflowText(static_cast<HTMLInputElement*>(element)->minimumString());
-    }
-    if (rangeOverflow()) {
-        if (!isInputElement) {
-            ASSERT_NOT_REACHED();
-            return String();
-        }
-        return validationMessageRangeOverflowText(static_cast<HTMLInputElement*>(element)->maximumString());
-    }
-    if (stepMismatch()) {
-        if (!isInputElement) {
-            ASSERT_NOT_REACHED();
-            return String();
-        }
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(element);
-        return validationMessageStepMismatchText(input->stepBaseString(), input->stepString());
-    }
-
-    return String();
-}
-
-void ValidityState::setCustomErrorMessage(const String& message)
-{
-    m_customErrorMessage = message;
-    if (m_control->isFormControlElement())
-        static_cast<HTMLFormControlElement*>(m_control)->setNeedsValidityCheck();
+    return m_control->validationMessage();
 }
 
 bool ValidityState::valueMissing() const
 {
-    HTMLElement* element = toHTMLElement(m_control);
-    if (!element->willValidate())
-        return false;
-
-    if (element->hasTagName(inputTag)) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(element);
-        return input->valueMissing(input->value());
-    }
-    if (element->hasTagName(textareaTag)) {
-        HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(element);
-        return textArea->valueMissing(textArea->value());
-    }
-    if (element->hasTagName(selectTag))
-        return toHTMLSelectElement(element)->valueMissing();
-    return false;
+    return m_control->valueMissing();
 }
 
 bool ValidityState::typeMismatch() const
 {
-    HTMLElement* element = toHTMLElement(m_control);
-    if (!element->willValidate())
-        return false;
-
-    if (!element->hasTagName(inputTag))
-        return false;
-    return static_cast<HTMLInputElement*>(element)->typeMismatch();
+    return m_control->typeMismatch();
 }
 
 bool ValidityState::patternMismatch() const
 {
-    HTMLElement* element = toHTMLElement(m_control);
-    if (!element->willValidate())
-        return false;
-
-    if (!element->hasTagName(inputTag))
-        return false;
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(element);
-    return input->patternMismatch(input->value());
+    return m_control->patternMismatch();
 }
 
 bool ValidityState::tooLong() const
 {
-    HTMLElement* element = toHTMLElement(m_control);
-    if (!element->willValidate())
-        return false;
-
-    if (element->hasTagName(inputTag)) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(element);
-        return input->tooLong(input->value(), HTMLTextFormControlElement::CheckDirtyFlag);
-    }
-    if (element->hasTagName(textareaTag)) {
-        HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(element);
-        return textArea->tooLong(textArea->value(), HTMLTextFormControlElement::CheckDirtyFlag);
-    }
-    return false;
+    return m_control->tooLong();
 }
 
 bool ValidityState::rangeUnderflow() const
 {
-    HTMLElement* element = toHTMLElement(m_control);
-    if (!element->willValidate())
-        return false;
-
-    if (!element->hasTagName(inputTag))
-        return false;
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(element);
-    return input->rangeUnderflow(input->value());
+    return m_control->rangeUnderflow();
 }
 
 bool ValidityState::rangeOverflow() const
 {
-    HTMLElement* element = toHTMLElement(m_control);
-    if (!element->willValidate())
-        return false;
-
-    if (!element->hasTagName(inputTag))
-        return false;
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(element);
-    return input->rangeOverflow(input->value());
+    return m_control->rangeOverflow();
 }
 
 bool ValidityState::stepMismatch() const
 {
-    HTMLElement* element = toHTMLElement(m_control);
-    if (!element->willValidate())
-        return false;
-
-    if (!element->hasTagName(inputTag))
-        return false;
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(element);
-    return input->stepMismatch(input->value());
+    return m_control->stepMismatch();
 }
 
 bool ValidityState::customError() const
 {
-    HTMLElement* element = toHTMLElement(m_control);
-    return element->willValidate() && !m_customErrorMessage.isEmpty();
+    return m_control->customError();
 }
 
 bool ValidityState::valid() const
 {
-    bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow()
-        || tooLong() || patternMismatch() || valueMissing() || customError();
-    return !someError;
+    return m_control->valid();
 }
 
 } // namespace
diff --git a/Source/WebCore/html/ValidityState.h b/Source/WebCore/html/ValidityState.h
index 4a96488bd..17e94c978 100644
--- a/Source/WebCore/html/ValidityState.h
+++ b/Source/WebCore/html/ValidityState.h
@@ -57,11 +57,7 @@ public:
 private:
     ValidityState(FormAssociatedElement* control) : m_control(control) { }
 
-    static bool isValidColorString(const String&);
-    static bool isValidEmailAddress(const String&);
-
     FormAssociatedElement* m_control;
-    String m_customErrorMessage;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index efd0d727b..fbdd17c32 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
@@ -115,6 +115,7 @@ private:
 CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas, bool usesCSSCompatibilityParseMode, bool usesDashboardCompatibilityMode)
     : CanvasRenderingContext(canvas)
     , m_stateStack(1)
+    , m_unrealizedSaveCount(0)
     , m_usesCSSCompatibilityParseMode(usesCSSCompatibilityParseMode)
 #if ENABLE(DASHBOARD_SUPPORT)
     , m_usesDashboardCompatibilityMode(usesDashboardCompatibilityMode)
@@ -148,7 +149,10 @@ CanvasRenderingContext2D::~CanvasRenderingContext2D()
 bool CanvasRenderingContext2D::isAccelerated() const
 {
 #if USE(IOSURFACE_CANVAS_BACKING_STORE) || ENABLE(ACCELERATED_2D_CANVAS)
-    return canvas()->hasCreatedImageBuffer() && drawingContext() && drawingContext()->isAcceleratedContext();
+    if (!canvas()->hasCreatedImageBuffer())
+        return false;
+    GraphicsContext* context = drawingContext();
+    return context && context->isAcceleratedContext();
 #else
     return false;
 #endif
@@ -160,6 +164,7 @@ void CanvasRenderingContext2D::reset()
     m_stateStack.resize(1);
     m_stateStack.first() = State();
     m_path.clear();
+    m_unrealizedSaveCount = 0;
 }
 
 CanvasRenderingContext2D::State::State()
@@ -259,18 +264,24 @@ void CanvasRenderingContext2D::State::fontsNeedUpdate(FontSelector* fontSelector
     m_font.update(fontSelector);
 }
 
-void CanvasRenderingContext2D::save()
+void CanvasRenderingContext2D::realizeSavesLoop()
 {
+    ASSERT(m_unrealizedSaveCount);
     ASSERT(m_stateStack.size() >= 1);
-    m_stateStack.append(state());
-    GraphicsContext* c = drawingContext();
-    if (!c)
-        return;
-    c->save();
+    GraphicsContext* context = drawingContext();
+    do {
+        m_stateStack.append(state());
+        if (context)
+            context->save();
+    } while (--m_unrealizedSaveCount);
 }
 
 void CanvasRenderingContext2D::restore()
 {
+    if (m_unrealizedSaveCount) {
+        --m_unrealizedSaveCount;
+        return;
+    }
     ASSERT(m_stateStack.size() >= 1);
     if (m_stateStack.size() <= 1)
         return;
@@ -283,23 +294,6 @@ void CanvasRenderingContext2D::restore()
     c->restore();
 }
 
-void CanvasRenderingContext2D::setAllAttributesToDefault()
-{
-    state().m_globalAlpha = 1;
-    state().m_shadowOffset = FloatSize();
-    state().m_shadowBlur = 0;
-    state().m_shadowColor = Color::transparent;
-    state().m_globalComposite = CompositeSourceOver;
-
-    GraphicsContext* context = drawingContext();
-    if (!context)
-        return;
-
-    applyShadow();
-    context->setAlpha(1);
-    context->setCompositeOperation(CompositeSourceOver);
-}
-
 CanvasStyle* CanvasRenderingContext2D::strokeStyle() const
 {
     return state().m_strokeStyle.get();
@@ -323,12 +317,13 @@ void CanvasRenderingContext2D::setStrokeStyle(PassRefPtr<CanvasStyle> prpStyle)
     } else
         checkOrigin(style->canvasPattern());
 
-    state().m_strokeStyle = style.release();
+    realizeSaves();
+    modifiableState().m_strokeStyle = style.release();
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
     state().m_strokeStyle->applyStrokeColor(c);
-    state().m_unparsedStrokeColor = String();
+    modifiableState().m_unparsedStrokeColor = String();
 }
 
 CanvasStyle* CanvasRenderingContext2D::fillStyle() const
@@ -354,12 +349,13 @@ void CanvasRenderingContext2D::setFillStyle(PassRefPtr<CanvasStyle> prpStyle)
     } else
         checkOrigin(style->canvasPattern());
 
-    state().m_fillStyle = style.release();
+    realizeSaves();
+    modifiableState().m_fillStyle = style.release();
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
     state().m_fillStyle->applyFillColor(c);
-    state().m_unparsedFillColor = String();
+    modifiableState().m_unparsedFillColor = String();
 }
 
 float CanvasRenderingContext2D::lineWidth() const
@@ -371,7 +367,10 @@ void CanvasRenderingContext2D::setLineWidth(float width)
 {
     if (!(isfinite(width) && width > 0))
         return;
-    state().m_lineWidth = width;
+    if (state().m_lineWidth == width)
+        return;
+    realizeSaves();
+    modifiableState().m_lineWidth = width;
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -388,7 +387,10 @@ void CanvasRenderingContext2D::setLineCap(const String& s)
     LineCap cap;
     if (!parseLineCap(s, cap))
         return;
-    state().m_lineCap = cap;
+    if (state().m_lineCap == cap)
+        return;
+    realizeSaves();
+    modifiableState().m_lineCap = cap;
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -405,7 +407,10 @@ void CanvasRenderingContext2D::setLineJoin(const String& s)
     LineJoin join;
     if (!parseLineJoin(s, join))
         return;
-    state().m_lineJoin = join;
+    if (state().m_lineJoin == join)
+        return;
+    realizeSaves();
+    modifiableState().m_lineJoin = join;
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -421,7 +426,10 @@ void CanvasRenderingContext2D::setMiterLimit(float limit)
 {
     if (!(isfinite(limit) && limit > 0))
         return;
-    state().m_miterLimit = limit;
+    if (state().m_miterLimit == limit)
+        return;
+    realizeSaves();
+    modifiableState().m_miterLimit = limit;
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -437,7 +445,10 @@ void CanvasRenderingContext2D::setShadowOffsetX(float x)
 {
     if (!isfinite(x))
         return;
-    state().m_shadowOffset.setWidth(x);
+    if (state().m_shadowOffset.width() == x)
+        return;
+    realizeSaves();
+    modifiableState().m_shadowOffset.setWidth(x);
     applyShadow();
 }
 
@@ -450,7 +461,10 @@ void CanvasRenderingContext2D::setShadowOffsetY(float y)
 {
     if (!isfinite(y))
         return;
-    state().m_shadowOffset.setHeight(y);
+    if (state().m_shadowOffset.height() == y)
+        return;
+    realizeSaves();
+    modifiableState().m_shadowOffset.setHeight(y);
     applyShadow();
 }
 
@@ -463,7 +477,10 @@ void CanvasRenderingContext2D::setShadowBlur(float blur)
 {
     if (!(isfinite(blur) && blur >= 0))
         return;
-    state().m_shadowBlur = blur;
+    if (state().m_shadowBlur == blur)
+        return;
+    realizeSaves();
+    modifiableState().m_shadowBlur = blur;
     applyShadow();
 }
 
@@ -474,8 +491,13 @@ String CanvasRenderingContext2D::shadowColor() const
 
 void CanvasRenderingContext2D::setShadowColor(const String& color)
 {
-    if (!parseColorOrCurrentColor(state().m_shadowColor, color, canvas()))
+    RGBA32 rgba;
+    if (!parseColorOrCurrentColor(rgba, color, canvas()))
+        return;
+    if (state().m_shadowColor == rgba)
         return;
+    realizeSaves();
+    modifiableState().m_shadowColor = rgba;
     applyShadow();
 }
 
@@ -486,8 +508,10 @@ const DashArray* CanvasRenderingContext2D::webkitLineDash() const
 
 void CanvasRenderingContext2D::setWebkitLineDash(const DashArray& dash)
 {
-    state().m_lineDash = dash;
-
+    if (state().m_lineDash == dash)
+        return;
+    realizeSaves();
+    modifiableState().m_lineDash = dash;
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -503,9 +527,10 @@ void CanvasRenderingContext2D::setWebkitLineDashOffset(float offset)
 {
     if (!isfinite(offset))
         return;
-
-    state().m_lineDashOffset = offset;
-
+    if (state().m_lineDashOffset == offset)
+        return;
+    realizeSaves();
+    modifiableState().m_lineDashOffset = offset;
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -521,7 +546,10 @@ void CanvasRenderingContext2D::setGlobalAlpha(float alpha)
 {
     if (!(alpha >= 0 && alpha <= 1))
         return;
-    state().m_globalAlpha = alpha;
+    if (state().m_globalAlpha == alpha)
+        return;
+    realizeSaves();
+    modifiableState().m_globalAlpha = alpha;
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -538,7 +566,10 @@ void CanvasRenderingContext2D::setGlobalCompositeOperation(const String& operati
     CompositeOperator op;
     if (!parseCompositeOperator(operation, op))
         return;
-    state().m_globalComposite = op;
+    if (state().m_globalComposite == op)
+        return;
+    realizeSaves();
+    modifiableState().m_globalComposite = op;
     GraphicsContext* c = drawingContext();
     if (!c)
         return;
@@ -558,12 +589,17 @@ void CanvasRenderingContext2D::scale(float sx, float sy)
 
     AffineTransform newTransform = state().m_transform;
     newTransform.scaleNonUniform(sx, sy);
+    if (state().m_transform == newTransform)
+        return;
+
+    realizeSaves();
+
     if (!newTransform.isInvertible()) {
-        state().m_invertibleCTM = false;
+        modifiableState().m_invertibleCTM = false;
         return;
     }
 
-    state().m_transform = newTransform;
+    modifiableState().m_transform = newTransform;
     c->scale(FloatSize(sx, sy));
     m_path.transform(AffineTransform().scaleNonUniform(1.0 / sx, 1.0 / sy));
 }
@@ -581,12 +617,17 @@ void CanvasRenderingContext2D::rotate(float angleInRadians)
 
     AffineTransform newTransform = state().m_transform;
     newTransform.rotate(angleInRadians / piDouble * 180.0);
+    if (state().m_transform == newTransform)
+        return;
+
+    realizeSaves();
+
     if (!newTransform.isInvertible()) {
-        state().m_invertibleCTM = false;
+        modifiableState().m_invertibleCTM = false;
         return;
     }
 
-    state().m_transform = newTransform;
+    modifiableState().m_transform = newTransform;
     c->rotate(angleInRadians);
     m_path.transform(AffineTransform().rotate(-angleInRadians / piDouble * 180.0));
 }
@@ -604,12 +645,17 @@ void CanvasRenderingContext2D::translate(float tx, float ty)
 
     AffineTransform newTransform = state().m_transform;
     newTransform.translate(tx, ty);
+    if (state().m_transform == newTransform)
+        return;
+
+    realizeSaves();
+
     if (!newTransform.isInvertible()) {
-        state().m_invertibleCTM = false;
+        modifiableState().m_invertibleCTM = false;
         return;
     }
 
-    state().m_transform = newTransform;
+    modifiableState().m_transform = newTransform;
     c->translate(tx, ty);
     m_path.transform(AffineTransform().translate(-tx, -ty));
 }
@@ -627,12 +673,17 @@ void CanvasRenderingContext2D::transform(float m11, float m12, float m21, float
 
     AffineTransform transform(m11, m12, m21, m22, dx, dy);
     AffineTransform newTransform = state().m_transform * transform;
+    if (state().m_transform == newTransform)
+        return;
+
+    realizeSaves();
+
     if (!newTransform.isInvertible()) {
-        state().m_invertibleCTM = false;
+        modifiableState().m_invertibleCTM = false;
         return;
     }
 
-    state().m_transform = newTransform;
+    modifiableState().m_transform = newTransform;
     c->concatCTM(transform);
     m_path.transform(transform.inverse());
 }
@@ -649,11 +700,14 @@ void CanvasRenderingContext2D::setTransform(float m11, float m12, float m21, flo
     AffineTransform ctm = state().m_transform;
     if (!ctm.isInvertible())
         return;
+
+    realizeSaves();
+    
     c->setCTM(canvas()->baseTransform());
-    state().m_transform = AffineTransform();
+    modifiableState().m_transform = AffineTransform();
     m_path.transform(ctm);
 
-    state().m_invertibleCTM = true;
+    modifiableState().m_invertibleCTM = true;
     transform(m11, m12, m21, m22, dx, dy);
 }
 
@@ -661,8 +715,9 @@ void CanvasRenderingContext2D::setStrokeColor(const String& color)
 {
     if (color == state().m_unparsedStrokeColor)
         return;
+    realizeSaves();
     setStrokeStyle(CanvasStyle::createFromString(color, canvas()->document()));
-    state().m_unparsedStrokeColor = color;
+    modifiableState().m_unparsedStrokeColor = color;
 }
 
 void CanvasRenderingContext2D::setStrokeColor(float grayLevel)
@@ -702,8 +757,9 @@ void CanvasRenderingContext2D::setFillColor(const String& color)
 {
     if (color == state().m_unparsedFillColor)
         return;
+    realizeSaves();
     setFillStyle(CanvasStyle::createFromString(color, canvas()->document()));
-    state().m_unparsedFillColor = color;
+    modifiableState().m_unparsedFillColor = color;
 }
 
 void CanvasRenderingContext2D::setFillColor(float grayLevel)
@@ -971,6 +1027,7 @@ void CanvasRenderingContext2D::clip()
         return;
     if (!state().m_invertibleCTM)
         return;
+    realizeSaves();
     c->canvasClip(m_path);
 #if ENABLE(DASHBOARD_SUPPORT)
     clearPathForDashboardBackwardCompatibilityMode();
@@ -1004,11 +1061,30 @@ void CanvasRenderingContext2D::clearRect(float x, float y, float width, float he
         return;
     FloatRect rect(x, y, width, height);
 
-    save();
-    setAllAttributesToDefault();
+    bool saved = false;
+    if (shouldDrawShadows()) {
+        context->save();
+        saved = true;
+        context->setLegacyShadow(FloatSize(), 0, Color::transparent, ColorSpaceDeviceRGB);
+    }
+    if (state().m_globalAlpha != 1) {
+        if (!saved) {
+            context->save();
+            saved = true;
+        }
+        context->setAlpha(1);
+    }
+    if (state().m_globalComposite != CompositeSourceOver) {
+        if (!saved) {
+            context->save();
+            saved = true;
+        }
+        context->setCompositeOperation(CompositeSourceOver);
+    }
     context->clearRect(rect);
+    if (saved)
+        context->restore();
     didDraw(rect);
-    restore();
 }
 
 void CanvasRenderingContext2D::fillRect(float x, float y, float width, float height)
@@ -1079,72 +1155,61 @@ void CanvasRenderingContext2D::strokeRect(float x, float y, float width, float h
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur)
 {
-    state().m_shadowOffset = FloatSize(width, height);
-    state().m_shadowBlur = blur;
-    state().m_shadowColor = Color::transparent;
-    applyShadow();
+    setShadow(FloatSize(width, height), blur, Color::transparent);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, const String& color)
 {
-    if (!parseColorOrCurrentColor(state().m_shadowColor, color, canvas()))
+    RGBA32 rgba;
+    if (!parseColorOrCurrentColor(rgba, color, canvas()))
         return;
-
-    state().m_shadowOffset = FloatSize(width, height);
-    state().m_shadowBlur = blur;
-    applyShadow();
+    setShadow(FloatSize(width, height), blur, rgba);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float grayLevel)
 {
-    state().m_shadowOffset = FloatSize(width, height);
-    state().m_shadowBlur = blur;
-    state().m_shadowColor = makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, 1.0f);
-    applyShadow();
+    setShadow(FloatSize(width, height), blur, makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, 1));
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, const String& color, float alpha)
 {
     RGBA32 rgba;
-
     if (!parseColorOrCurrentColor(rgba, color, canvas()))
         return;
-
-    state().m_shadowColor = colorWithOverrideAlpha(rgba, alpha);
-    state().m_shadowOffset = FloatSize(width, height);
-    state().m_shadowBlur = blur;
-    applyShadow();
+    setShadow(FloatSize(width, height), blur, colorWithOverrideAlpha(rgba, alpha));
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float grayLevel, float alpha)
 {
-    state().m_shadowOffset = FloatSize(width, height);
-    state().m_shadowBlur = blur;
-    state().m_shadowColor = makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, alpha);
-    applyShadow();
+    setShadow(FloatSize(width, height), blur, makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, alpha));
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float r, float g, float b, float a)
 {
-    state().m_shadowOffset = FloatSize(width, height);
-    state().m_shadowBlur = blur;
-    state().m_shadowColor = makeRGBA32FromFloats(r, g, b, a);
-    applyShadow();
+    setShadow(FloatSize(width, height), blur, makeRGBA32FromFloats(r, g, b, a));
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float c, float m, float y, float k, float a)
 {
-    state().m_shadowOffset = FloatSize(width, height);
-    state().m_shadowBlur = blur;
-    state().m_shadowColor = makeRGBAFromCMYKA(c, m, y, k, a);
-    applyShadow();
+    setShadow(FloatSize(width, height), blur, makeRGBAFromCMYKA(c, m, y, k, a));
 }
 
 void CanvasRenderingContext2D::clearShadow()
 {
-    state().m_shadowOffset = FloatSize();
-    state().m_shadowBlur = 0;
-    state().m_shadowColor = Color::transparent;
+    setShadow(FloatSize(), 0, Color::transparent);
+}
+
+void CanvasRenderingContext2D::setShadow(const FloatSize& offset, float blur, RGBA32 color)
+{
+    if (state().m_shadowOffset == offset && state().m_shadowBlur == blur && state().m_shadowColor == color)
+        return;
+    bool wasDrawingShadows = shouldDrawShadows();
+    realizeSaves();
+    modifiableState().m_shadowOffset = offset;
+    modifiableState().m_shadowBlur = blur;
+    modifiableState().m_shadowColor = color;
+    if (!wasDrawingShadows && !shouldDrawShadows())
+        return;
     applyShadow();
 }
 
@@ -1923,17 +1988,14 @@ String CanvasRenderingContext2D::font() const
 
 void CanvasRenderingContext2D::setFont(const String& newFont)
 {
-    RefPtr<StylePropertySet> tempDecl = StylePropertySet::create();
-    CSSParser parser(strictToCSSParserMode(!m_usesCSSCompatibilityParseMode));
-
-    String declarationText("font: ");
-    declarationText += newFont;
-    parser.parseDeclaration(tempDecl.get(), declarationText, 0, 0);
-    if (tempDecl->isEmpty())
+    RefPtr<StylePropertySet> parsedStyle = StylePropertySet::create();
+    CSSParser(strictToCSSParserMode(!m_usesCSSCompatibilityParseMode)).parseDeclaration(parsedStyle.get(), "font:" + newFont, 0, 0);
+    if (parsedStyle->isEmpty())
         return;
 
     // The parse succeeded.
-    state().m_unparsedFont = newFont;
+    realizeSaves();
+    modifiableState().m_unparsedFont = newFont;
 
     // Map the <canvas> font into the text style. If the font uses keywords like larger/smaller, these will work
     // relative to the canvas.
@@ -1944,22 +2006,22 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
 
     // Now map the font property longhands into the style.
     StyleResolver* styleResolver = canvas()->styleResolver();
-    styleResolver->applyPropertyToStyle(CSSPropertyFontFamily, tempDecl->getPropertyCSSValue(CSSPropertyFontFamily).get(), newStyle.get());
-    styleResolver->applyPropertyToCurrentStyle(CSSPropertyFontStyle, tempDecl->getPropertyCSSValue(CSSPropertyFontStyle).get());
-    styleResolver->applyPropertyToCurrentStyle(CSSPropertyFontVariant, tempDecl->getPropertyCSSValue(CSSPropertyFontVariant).get());
-    styleResolver->applyPropertyToCurrentStyle(CSSPropertyFontWeight, tempDecl->getPropertyCSSValue(CSSPropertyFontWeight).get());
+    styleResolver->applyPropertyToStyle(CSSPropertyFontFamily, parsedStyle->getPropertyCSSValue(CSSPropertyFontFamily).get(), newStyle.get());
+    styleResolver->applyPropertyToCurrentStyle(CSSPropertyFontStyle, parsedStyle->getPropertyCSSValue(CSSPropertyFontStyle).get());
+    styleResolver->applyPropertyToCurrentStyle(CSSPropertyFontVariant, parsedStyle->getPropertyCSSValue(CSSPropertyFontVariant).get());
+    styleResolver->applyPropertyToCurrentStyle(CSSPropertyFontWeight, parsedStyle->getPropertyCSSValue(CSSPropertyFontWeight).get());
 
     // As described in BUG66291, setting font-size on a font may entail a CSSPrimitiveValue::computeLengthDouble call,
     // which assumes the fontMetrics are available for the affected font, otherwise a crash occurs (see http://trac.webkit.org/changeset/96122).
     // The updateFont() call below updates the fontMetrics and ensures the proper setting of font-size.
     styleResolver->updateFont();
-    styleResolver->applyPropertyToCurrentStyle(CSSPropertyFontSize, tempDecl->getPropertyCSSValue(CSSPropertyFontSize).get());
-    styleResolver->applyPropertyToCurrentStyle(CSSPropertyLineHeight, tempDecl->getPropertyCSSValue(CSSPropertyLineHeight).get());
+    styleResolver->applyPropertyToCurrentStyle(CSSPropertyFontSize, parsedStyle->getPropertyCSSValue(CSSPropertyFontSize).get());
+    styleResolver->applyPropertyToCurrentStyle(CSSPropertyLineHeight, parsedStyle->getPropertyCSSValue(CSSPropertyLineHeight).get());
 
-    state().m_font = newStyle->font();
-    state().m_font.update(styleResolver->fontSelector());
-    state().m_realizedFont = true;
-    styleResolver->fontSelector()->registerForInvalidationCallbacks(&state());
+    modifiableState().m_font = newStyle->font();
+    modifiableState().m_font.update(styleResolver->fontSelector());
+    modifiableState().m_realizedFont = true;
+    styleResolver->fontSelector()->registerForInvalidationCallbacks(&modifiableState());
 }
 
 String CanvasRenderingContext2D::textAlign() const
@@ -1972,7 +2034,10 @@ void CanvasRenderingContext2D::setTextAlign(const String& s)
     TextAlign align;
     if (!parseTextAlign(s, align))
         return;
-    state().m_textAlign = align;
+    if (state().m_textAlign == align)
+        return;
+    realizeSaves();
+    modifiableState().m_textAlign = align;
 }
 
 String CanvasRenderingContext2D::textBaseline() const
@@ -1985,7 +2050,10 @@ void CanvasRenderingContext2D::setTextBaseline(const String& s)
     TextBaseline baseline;
     if (!parseTextBaseline(s, baseline))
         return;
-    state().m_textBaseline = baseline;
+    if (state().m_textBaseline == baseline)
+        return;
+    realizeSaves();
+    modifiableState().m_textBaseline = baseline;
 }
 
 void CanvasRenderingContext2D::fillText(const String& text, float x, float y)
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.h b/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
index 9c406ca65..7ef19032f 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -66,9 +66,6 @@ public:
     }
     virtual ~CanvasRenderingContext2D();
 
-    virtual bool is2d() const { return true; }
-    virtual bool isAccelerated() const;
-
     CanvasStyle* strokeStyle() const;
     void setStrokeStyle(PassRefPtr<CanvasStyle>);
 
@@ -111,9 +108,8 @@ public:
     String globalCompositeOperation() const;
     void setGlobalCompositeOperation(const String&);
 
-    void save();
+    void save() { ++m_unrealizedSaveCount; }
     void restore();
-    void setAllAttributesToDefault();
 
     void scale(float sx, float sy);
     void rotate(float angleInRadians);
@@ -226,10 +222,6 @@ public:
     LineCap getLineCap() const { return state().m_lineCap; }
     LineJoin getLineJoin() const { return state().m_lineJoin; }
 
-#if ENABLE(ACCELERATED_2D_CANVAS) && USE(ACCELERATED_COMPOSITING)
-    virtual PlatformLayer* platformLayer() const;
-#endif
-
 private:
     struct State : FontSelectorClient {
         State();
@@ -238,7 +230,7 @@ private:
         State(const State&);
         State& operator=(const State&);
 
-        virtual void fontsNeedUpdate(FontSelector*);
+        virtual void fontsNeedUpdate(FontSelector*) OVERRIDE;
 
         String m_unparsedStrokeColor;
         String m_unparsedFillColor;
@@ -277,11 +269,10 @@ private:
 
     CanvasRenderingContext2D(HTMLCanvasElement*, bool usesCSSCompatibilityParseMode, bool usesDashboardCompatibilityMode);
 
-    Path m_path;
-
-    State& state() { return m_stateStack.last(); }
+    State& modifiableState() { ASSERT(!m_unrealizedSaveCount); return m_stateStack.last(); }
     const State& state() const { return m_stateStack.last(); }
 
+    void setShadow(const FloatSize& offset, float blur, RGBA32 color);
     void applyShadow();
     bool shouldDrawShadows() const;
 
@@ -291,6 +282,12 @@ private:
     GraphicsContext* drawingContext() const;
 
     void unwindStateStack();
+    void realizeSaves()
+    {
+        if (m_unrealizedSaveCount)
+            realizeSavesLoop();
+    }
+    void realizeSavesLoop();
 
     void applyStrokePattern();
     void applyFillPattern();
@@ -322,7 +319,16 @@ private:
     PassRefPtr<ImageData> getImageData(ImageBuffer::CoordinateSystem, float sx, float sy, float sw, float sh, ExceptionCode&) const;
     void putImageData(ImageData*, ImageBuffer::CoordinateSystem, float dx, float dy, float dirtyX, float dirtyY, float dirtyWidth, float dirtyHeight, ExceptionCode&);
 
+    virtual bool is2d() const OVERRIDE { return true; }
+    virtual bool isAccelerated() const OVERRIDE;
+
+#if ENABLE(ACCELERATED_2D_CANVAS) && USE(ACCELERATED_COMPOSITING)
+    virtual PlatformLayer* platformLayer() const OVERRIDE;
+#endif
+
+    Path m_path;    
     Vector<State, 1> m_stateStack;
+    unsigned m_unrealizedSaveCount;
     bool m_usesCSSCompatibilityParseMode;
 #if ENABLE(DASHBOARD_SUPPORT)
     bool m_usesDashboardCompatibilityMode;
diff --git a/Source/WebCore/html/canvas/WebGLFramebuffer.cpp b/Source/WebCore/html/canvas/WebGLFramebuffer.cpp
index dd4d0dbf2..eb07cf06a 100644
--- a/Source/WebCore/html/canvas/WebGLFramebuffer.cpp
+++ b/Source/WebCore/html/canvas/WebGLFramebuffer.cpp
@@ -36,30 +36,39 @@ namespace WebCore {
 
 namespace {
 
-    bool isAttachmentComplete(WebGLSharedObject* attachedObject, GC3Denum attachment)
+    bool isAttachmentComplete(WebGLSharedObject* attachedObject, GC3Denum attachment, const char** reason)
     {
         ASSERT(attachedObject && attachedObject->object());
         ASSERT(attachedObject->isRenderbuffer());
+        ASSERT(reason);
         WebGLRenderbuffer* buffer = reinterpret_cast<WebGLRenderbuffer*>(attachedObject);
         switch (attachment) {
         case GraphicsContext3D::DEPTH_ATTACHMENT:
-            if (buffer->getInternalFormat() != GraphicsContext3D::DEPTH_COMPONENT16)
+            if (buffer->getInternalFormat() != GraphicsContext3D::DEPTH_COMPONENT16) {
+                *reason = "DEPTH_ATTACHMENT is not a depth format";
                 return false;
+            }
             break;
         case GraphicsContext3D::STENCIL_ATTACHMENT:
-            if (buffer->getInternalFormat() != GraphicsContext3D::STENCIL_INDEX8)
+            if (buffer->getInternalFormat() != GraphicsContext3D::STENCIL_INDEX8) {
+                *reason = "STENCIL_ATTACHMENT is not a stencil format";
                 return false;
+            }
             break;
         case GraphicsContext3D::DEPTH_STENCIL_ATTACHMENT:
-            if (buffer->getInternalFormat() != GraphicsContext3D::DEPTH_STENCIL)
+            if (buffer->getInternalFormat() != GraphicsContext3D::DEPTH_STENCIL) {
+                *reason = "DEPTH_STENCIL_ATTACHMENT is not a depth-stencil format";
                 return false;
+            }
             break;
         default:
             ASSERT_NOT_REACHED();
             return false;
         }
-        if (!buffer->getWidth() || !buffer->getHeight())
+        if (!buffer->getWidth() || !buffer->getHeight()) {
+            *reason = "attachment has a 0 dimension";
             return false;
+        }
         return true;
     }
 
@@ -319,70 +328,87 @@ GC3Denum WebGLFramebuffer::getColorBufferFormat() const
     return 0;
 }
 
-GC3Denum WebGLFramebuffer::checkStatus() const
+GC3Denum WebGLFramebuffer::checkStatus(const char** reason) const
 {
     unsigned int count = 0;
     GC3Dsizei width = 0, height = 0;
     if (isDepthAttached()) {
-        if (!isAttachmentComplete(m_depthAttachment.get(), GraphicsContext3D::DEPTH_ATTACHMENT))
+        if (!isAttachmentComplete(m_depthAttachment.get(), GraphicsContext3D::DEPTH_ATTACHMENT, reason))
             return GraphicsContext3D::FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
         width = getImageWidth(m_depthAttachment.get());
         height = getImageHeight(m_depthAttachment.get());
         count++;
     }
     if (isStencilAttached()) {
-        if (!isAttachmentComplete(m_stencilAttachment.get(), GraphicsContext3D::STENCIL_ATTACHMENT))
+        if (!isAttachmentComplete(m_stencilAttachment.get(), GraphicsContext3D::STENCIL_ATTACHMENT, reason))
             return GraphicsContext3D::FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
         if (!count) {
             width = getImageWidth(m_stencilAttachment.get());
             height = getImageHeight(m_stencilAttachment.get());
         } else {
-            if (width != getImageWidth(m_stencilAttachment.get()) || height != getImageHeight(m_stencilAttachment.get()))
+            if (width != getImageWidth(m_stencilAttachment.get()) || height != getImageHeight(m_stencilAttachment.get())) {
+                *reason = "STENCIL_ATTACHMENT has different dimensions than DEPTH_ATTACHMENT";
                 return GraphicsContext3D::FRAMEBUFFER_INCOMPLETE_DIMENSIONS;
+            }
         }
         count++;
     }
     if (isDepthStencilAttached()) {
-        if (!isAttachmentComplete(m_depthStencilAttachment.get(), GraphicsContext3D::DEPTH_STENCIL_ATTACHMENT))
+        if (!isAttachmentComplete(m_depthStencilAttachment.get(), GraphicsContext3D::DEPTH_STENCIL_ATTACHMENT, reason))
             return GraphicsContext3D::FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
-        if (!isValidRenderbuffer(m_depthStencilAttachment.get()))
+        if (!isValidRenderbuffer(m_depthStencilAttachment.get())) {
+            *reason = "DEPTH_STENCIL_ATTACHMENT is not valid";
             return GraphicsContext3D::FRAMEBUFFER_UNSUPPORTED;
+        }
         if (!count) {
             width = getImageWidth(m_depthStencilAttachment.get());
             height = getImageHeight(m_depthStencilAttachment.get());
         } else {
-            if (width != getImageWidth(m_depthStencilAttachment.get()) || height != getImageHeight(m_depthStencilAttachment.get()))
+            if (width != getImageWidth(m_depthStencilAttachment.get()) || height != getImageHeight(m_depthStencilAttachment.get())) {
+                *reason = "DEPTH_STENCIL_ATTACHMENT has different dimensions than other attachments";
                 return GraphicsContext3D::FRAMEBUFFER_INCOMPLETE_DIMENSIONS;
+            }
         }
         count++;
     }
     // WebGL specific: no conflicting DEPTH/STENCIL/DEPTH_STENCIL attachments.
-    if (count > 1)
+    if (count > 1) {
+        *reason = "conflicting DEPTH/STENCIL/DEPTH_STENCIL attachments";
         return GraphicsContext3D::FRAMEBUFFER_UNSUPPORTED;
+    }
     if (isColorAttached()) {
         // FIXME: if color buffer is texture, is ALPHA, LUMINANCE or LUMINANCE_ALPHA valid?
-        if (!getColorBufferFormat())
+        if (!getColorBufferFormat()) {
+            *reason = "COLOR_ATTACHMENT0 is an unsupported format";
             return GraphicsContext3D::FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
+        }
         if (!count) {
-            if (!getColorBufferWidth() || !getColorBufferHeight())
+            if (!getColorBufferWidth() || !getColorBufferHeight())  {
+                *reason = "COLOR_ATTACHMENT0 has a 0 dimension";
                 return GraphicsContext3D::FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
+            }
         } else {
-            if (width != getColorBufferWidth() || height != getColorBufferHeight())
+            if (width != getColorBufferWidth() || height != getColorBufferHeight())  {
+                *reason = "COLOR_ATTACHMENT0 has different dimensions than other attachments";
                 return GraphicsContext3D::FRAMEBUFFER_INCOMPLETE_DIMENSIONS;
+            }
         }
+
     } else {
-        if (!count)
+        if (!count) {
+            *reason = "no attachments";
             return GraphicsContext3D::FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT;
+        }
     }
     return GraphicsContext3D::FRAMEBUFFER_COMPLETE;
 }
 
-bool WebGLFramebuffer::onAccess(GraphicsContext3D* context3d, bool needToInitializeRenderbuffers)
+bool WebGLFramebuffer::onAccess(GraphicsContext3D* context3d, bool needToInitializeRenderbuffers, const char** reason)
 {
-    if (checkStatus() != GraphicsContext3D::FRAMEBUFFER_COMPLETE)
+    if (checkStatus(reason) != GraphicsContext3D::FRAMEBUFFER_COMPLETE)
         return false;
     if (needToInitializeRenderbuffers)
-        return initializeRenderbuffers(context3d);
+        return initializeRenderbuffers(context3d, reason);
     return true;
 }
 
@@ -404,7 +430,7 @@ void WebGLFramebuffer::deleteObjectImpl(GraphicsContext3D* context3d, Platform3D
     context3d->deleteFramebuffer(object);
 }
 
-bool WebGLFramebuffer::initializeRenderbuffers(GraphicsContext3D* g3d)
+bool WebGLFramebuffer::initializeRenderbuffers(GraphicsContext3D* g3d, const char** reason)
 {
     ASSERT(object());
     bool initColor = false, initDepth = false, initStencil = false;
@@ -431,8 +457,10 @@ bool WebGLFramebuffer::initializeRenderbuffers(GraphicsContext3D* g3d)
 
     // We only clear un-initialized renderbuffers when they are ready to be
     // read, i.e., when the framebuffer is complete.
-    if (g3d->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE)
+    if (g3d->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
+        *reason = "framebuffer not complete";
         return false;
+    }
 
     GC3Dfloat colorClearValue[] = {0, 0, 0, 0}, depthClearValue = 0;
     GC3Dint stencilClearValue = 0;
diff --git a/Source/WebCore/html/canvas/WebGLFramebuffer.h b/Source/WebCore/html/canvas/WebGLFramebuffer.h
index 676a0a893..c69b0cc6a 100644
--- a/Source/WebCore/html/canvas/WebGLFramebuffer.h
+++ b/Source/WebCore/html/canvas/WebGLFramebuffer.h
@@ -61,13 +61,13 @@ public:
     // Return false if the framebuffer is incomplete; otherwise initialize
     // the buffers if they haven't been initialized and
     // needToInitializeRenderbuffers is true.
-    bool onAccess(GraphicsContext3D*, bool needToInitializeRenderbuffers);
+    bool onAccess(GraphicsContext3D*, bool needToInitializeRenderbuffers, const char** reason);
 
     // Software version of glCheckFramebufferStatus(), except that when
     // FRAMEBUFFER_COMPLETE is returned, it is still possible for
     // glCheckFramebufferStatus() to return FRAMEBUFFER_UNSUPPORTED,
     // depending on hardware implementation.
-    GC3Denum checkStatus() const;
+    GC3Denum checkStatus(const char** reason) const;
 
     bool hasEverBeenBound() const { return object() && m_hasEverBeenBound; }
 
@@ -84,7 +84,7 @@ private:
     virtual bool isFramebuffer() const { return true; }
 
     // Return false if framebuffer is incomplete.
-    bool initializeRenderbuffers(GraphicsContext3D*);
+    bool initializeRenderbuffers(GraphicsContext3D*, const char** reason);
 
     // Check if the framebuffer is currently bound.
     bool isBound() const;
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index 46ed8b756..901246d2e 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -690,11 +690,11 @@ void WebGLRenderingContext::paintRenderingResultsToCanvas()
     // Until the canvas is written to by the application, the clear that
     // happened after it was composited should be ignored by the compositor.
     if (m_context->layerComposited() && !m_attributes.preserveDrawingBuffer) {
-        m_context->paintCompositedResultsToCanvas(this);
+        m_context->paintCompositedResultsToCanvas(canvas()->buffer());
 
 #if USE(ACCELERATED_COMPOSITING) && PLATFORM(CHROMIUM)
         if (m_drawingBuffer)
-            m_drawingBuffer->paintCompositedResultsToCanvas(this);
+            m_drawingBuffer->paintCompositedResultsToCanvas(canvas()->buffer());
 #endif
 
         canvas()->makePresentationCopy();
@@ -710,7 +710,7 @@ void WebGLRenderingContext::paintRenderingResultsToCanvas()
 
     if (m_drawingBuffer)
         m_drawingBuffer->commit();
-    m_context->paintRenderingResultsToCanvas(this, m_drawingBuffer.get());
+    m_context->paintRenderingResultsToCanvas(canvas()->buffer(), m_drawingBuffer.get());
 
     if (m_drawingBuffer) {
         if (m_framebufferBinding)
@@ -1165,9 +1165,12 @@ GC3Denum WebGLRenderingContext::checkFramebufferStatus(GC3Denum target)
     }
     if (!m_framebufferBinding || !m_framebufferBinding->object())
         return GraphicsContext3D::FRAMEBUFFER_COMPLETE;
-    GC3Denum result = m_framebufferBinding->checkStatus();
-    if (result != GraphicsContext3D::FRAMEBUFFER_COMPLETE)
+    const char* reason = "framebuffer incomplete";
+    GC3Denum result = m_framebufferBinding->checkStatus(&reason);
+    if (result != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
+        printGLWarningToConsole("checkFramebufferStatus", reason);
         return result;
+    }
     result = m_context->checkFramebufferStatus(target);
     cleanupAfterGraphicsCall(false);
     return result;
@@ -1181,8 +1184,9 @@ void WebGLRenderingContext::clear(GC3Dbitfield mask)
         synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "clear", "invalid mask");
         return;
     }
-    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe())) {
-        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "clear", "can not render to framebuffer");
+    const char* reason = "framebuffer incomplete";
+    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe(), &reason)) {
+        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "clear", reason);
         return;
     }
     if (!clearIfComposited(mask))
@@ -1333,8 +1337,9 @@ void WebGLRenderingContext::copyTexImage2D(GC3Denum target, GC3Dint level, GC3De
         synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "copyTexImage2D", "level > 0 not power of 2");
         return;
     }
-    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe())) {
-        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "copyTexImage2D", "framebuffer not readable");
+    const char* reason = "framebuffer incomplete";
+    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe(), &reason)) {
+        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "copyTexImage2D", reason);
         return;
     }
     clearIfComposited();
@@ -1379,8 +1384,9 @@ void WebGLRenderingContext::copyTexSubImage2D(GC3Denum target, GC3Dint level, GC
         synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "copyTexSubImage2D", "framebuffer is incompatible format");
         return;
     }
-    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe())) {
-        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "copyTexSubImage2D", "framebuffer not readable");
+    const char* reason = "framebuffer incomplete";
+    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe(), &reason)) {
+        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "copyTexSubImage2D", reason);
         return;
     }
     clearIfComposited();
@@ -1878,8 +1884,9 @@ void WebGLRenderingContext::drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei c
         }
     }
 
-    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe())) {
-        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "drawArrays", "framebuffer can not be rendered to");
+    const char* reason = "framebuffer incomplete";
+    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe(), &reason)) {
+        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "drawArrays", reason);
         return;
     }
 
@@ -1952,8 +1959,9 @@ void WebGLRenderingContext::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denu
         }
     }
 
-    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe())) {
-        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "drawElements", "framebuffer can not be rendered to");
+    const char* reason = "framebuffer incomplete";
+    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe(), &reason)) {
+        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "drawElements", reason);
         return;
     }
     clearIfComposited();
@@ -3255,8 +3263,9 @@ void WebGLRenderingContext::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC
         synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "readPixels", "ArrayBufferView not Uint8Array");
         return;
     }
-    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe())) {
-        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "readPixels", "framebuffer not readable");
+    const char* reason = "framebuffer incomplete";
+    if (m_framebufferBinding && !m_framebufferBinding->onAccess(graphicsContext3D(), !isResourceSafe(), &reason)) {
+        synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION, "readPixels", reason);
         return;
     }
     // Calculate array size, taking into consideration of PACK_ALIGNMENT.
@@ -5532,6 +5541,14 @@ void WebGLRenderingContext::synthesizeGLError(GC3Denum error, const char* functi
 }
 
 
+void WebGLRenderingContext::printGLWarningToConsole(const char* functionName, const char* description)
+{
+    if (m_synthesizedErrorsToConsole) {
+        String str = String("WebGL: ") + String(functionName) + ": " + String(description);
+        printGLErrorToConsole(str);
+    }
+}
+
 void WebGLRenderingContext::applyStencilTest()
 {
     bool haveStencilBuffer = false;
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index f18cb1753..548a999b1 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -634,6 +634,7 @@ public:
 
     // Helper function to print GL errors to console.
     void printGLErrorToConsole(const String&);
+    void printGLWarningToConsole(const char* function, const char* reason);
 
     // Helper function to print warnings to console. Currently
     // used only to warn about use of obsolete functions.
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index 4acfec9f8..3a87e224d 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -86,7 +86,7 @@ class AtomicHTMLToken : public AtomicMarkupTokenBase<HTMLToken> {
 public:
     AtomicHTMLToken(HTMLToken& token) : AtomicMarkupTokenBase<HTMLToken>(&token) { }
 
-    AtomicHTMLToken(HTMLTokenTypes::Type type, AtomicString name, const Vector<Attribute>& attributes = Vector<Attribute>())
+    AtomicHTMLToken(HTMLTokenTypes::Type type, const AtomicString& name, const Vector<Attribute>& attributes = Vector<Attribute>())
         : AtomicMarkupTokenBase<HTMLToken>(type, name, attributes)
     {
     }
diff --git a/Source/WebCore/html/shadow/ContentDistributor.cpp b/Source/WebCore/html/shadow/ContentDistributor.cpp
new file mode 100644
index 000000000..ac5dbf68d
--- /dev/null
+++ b/Source/WebCore/html/shadow/ContentDistributor.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ContentDistributor.h"
+
+#include "ContentSelectorQuery.h"
+#include "HTMLContentElement.h"
+#include "ShadowRoot.h"
+
+
+namespace WebCore {
+
+ContentDistributor::ContentDistributor()
+    : m_phase(Prevented)
+{
+}
+
+ContentDistributor::~ContentDistributor()
+{
+    ASSERT(m_pool.isEmpty());
+}
+
+void ContentDistributor::distribute(InsertionPoint* insertionPoint, ContentDistribution* distribution)
+{
+    ASSERT(m_phase == Prepared);
+    ASSERT(distribution->isEmpty());
+
+    ContentSelectorQuery query(insertionPoint);
+
+    for (size_t i = 0; i < m_pool.size(); ++i) {
+        Node* child = m_pool[i].get();
+        if (!child)
+            continue;
+        if (!query.matches(child))
+            continue;
+
+        distribution->append(child);
+        m_nodeToInsertionPoint.add(child, insertionPoint);
+        m_pool[i] = 0;
+    }
+}
+
+void ContentDistributor::clearDistribution(ContentDistribution* list)
+{
+    for (size_t i = 0; i < list->size(); ++i)
+        m_nodeToInsertionPoint.remove(list->at(i).get());
+    list->clear();
+}
+
+InsertionPoint* ContentDistributor::findInsertionPointFor(const Node* key) const
+{
+    return m_nodeToInsertionPoint.get(key);
+}
+
+void ContentDistributor::willDistribute()
+{
+    m_phase = Started;
+}
+
+void ContentDistributor::didDistribute()
+{
+    ASSERT(m_phase != Prevented);
+    m_phase = Prevented;
+    m_pool.clear();
+}
+
+void ContentDistributor::preparePoolFor(Element* shadowHost)
+{
+    if (poolIsReady())
+        return;
+
+    ASSERT(m_pool.isEmpty());
+    ASSERT(shadowHost);
+    ASSERT(m_phase == Started);
+
+    m_phase = Prepared;
+    for (Node* node = shadowHost->firstChild(); node; node = node->nextSibling())
+        m_pool.append(node);
+}
+
+}
diff --git a/Source/WebCore/html/shadow/ContentDistributor.h b/Source/WebCore/html/shadow/ContentDistributor.h
new file mode 100644
index 000000000..d443772a7
--- /dev/null
+++ b/Source/WebCore/html/shadow/ContentDistributor.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ContentDistributor_h
+#define ContentDistributor_h
+
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Element;
+class InsertionPoint;
+class Node;
+class ShadowRoot;
+
+typedef Vector<RefPtr<Node> > ContentDistribution;
+
+class ContentDistributor {
+    WTF_MAKE_NONCOPYABLE(ContentDistributor);
+public:
+    ContentDistributor();
+    ~ContentDistributor();
+
+    void distribute(InsertionPoint*, ContentDistribution*);
+    void clearDistribution(ContentDistribution*);
+    InsertionPoint* findInsertionPointFor(const Node* key) const;
+
+    void willDistribute();
+    bool inDistribution() const;
+    void didDistribute();
+
+    void preparePoolFor(Element* shadowHost);
+    bool poolIsReady() const;
+
+private:
+    enum DistributionPhase {
+        Prevented,
+        Started,
+        Prepared,
+    };
+
+    Vector<RefPtr<Node> > m_pool;
+    DistributionPhase m_phase;
+    HashMap<const Node*, InsertionPoint*> m_nodeToInsertionPoint;
+};
+
+inline bool ContentDistributor::inDistribution() const
+{
+    return m_phase != Prevented;
+}
+
+inline bool ContentDistributor::poolIsReady() const
+{
+    return m_phase == Prepared;
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/html/shadow/ContentSelectorQuery.cpp b/Source/WebCore/html/shadow/ContentSelectorQuery.cpp
index c3aa620a4..38d449c7b 100644
--- a/Source/WebCore/html/shadow/ContentSelectorQuery.cpp
+++ b/Source/WebCore/html/shadow/ContentSelectorQuery.cpp
@@ -30,6 +30,7 @@
 #include "CSSParser.h"
 #include "CSSSelectorList.h"
 #include "InsertionPoint.h"
+#include "ShadowRoot.h"
 
 namespace WebCore {
 
@@ -63,7 +64,7 @@ bool ContentSelectorQuery::matches(Node* node) const
     if (!node)
         return false;
 
-    ASSERT(node->parentNode() == m_insertionPoint->shadowTreeRootNode()->shadowHost());
+    ASSERT(node->parentNode() == m_insertionPoint->shadowRoot()->shadowHost());
 
     if (m_insertionPoint->select().isNull() || m_insertionPoint->select().isEmpty())
         return true;
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.cpp b/Source/WebCore/html/shadow/HTMLContentElement.cpp
index 543679506..a4dceeed0 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentElement.cpp
@@ -27,9 +27,9 @@
 #include "config.h"
 #include "HTMLContentElement.h"
 
+#include "ContentDistributor.h"
 #include "ContentSelectorQuery.h"
 #include "ElementShadow.h"
-#include "HTMLContentSelector.h"
 #include "HTMLNames.h"
 #include "QualifiedName.h"
 #include "RuntimeEnabledFeatures.h"
@@ -86,13 +86,13 @@ void HTMLContentElement::setSelect(const AtomicString& selectValue)
     setAttribute(selectAttr, selectValue);
 }
 
-void HTMLContentElement::parseAttribute(Attribute* attr)
+void HTMLContentElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == selectAttr) {
-        if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode()))
-            root->owner()->setNeedsReattachHostChildrenAndShadow();
+    if (attribute.name() == selectAttr) {
+        if (ShadowRoot* root = shadowRoot())
+            root->owner()->setNeedsRedistributing();
     } else
-        InsertionPoint::parseAttribute(attr);
+        InsertionPoint::parseAttribute(attribute);
 }
 
 }
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.h b/Source/WebCore/html/shadow/HTMLContentElement.h
index bf143528b..c0452a006 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.h
+++ b/Source/WebCore/html/shadow/HTMLContentElement.h
@@ -53,7 +53,7 @@ protected:
     HTMLContentElement(const QualifiedName&, Document*);
 
 private:
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 };
 
 }
diff --git a/Source/WebCore/html/shadow/HTMLContentSelector.cpp b/Source/WebCore/html/shadow/HTMLContentSelector.cpp
deleted file mode 100644
index 31e4194ec..000000000
--- a/Source/WebCore/html/shadow/HTMLContentSelector.cpp
+++ /dev/null
@@ -1,172 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "HTMLContentSelector.h"
-
-#include "ContentSelectorQuery.h"
-#include "HTMLContentElement.h"
-#include "ShadowRoot.h"
-
-
-namespace WebCore {
-
-void HTMLContentSelection::append(PassRefPtr<HTMLContentSelection> next)
-{
-    ASSERT(!m_next);
-    ASSERT(!next->previous());
-    m_next = next;
-    m_next->m_previous = this;
-}
-
-void HTMLContentSelection::unlink()
-{
-    ASSERT(!m_previous); // Can be called only for a head.
-    RefPtr<HTMLContentSelection> item = this;
-    while (item) {
-        ASSERT(!item->previous());
-        RefPtr<HTMLContentSelection> nextItem = item->m_next;
-        item->m_next.clear();
-        if (nextItem)
-            nextItem->m_previous.clear();
-        item = nextItem;
-    }
-}
-
-HTMLContentSelectionList::HTMLContentSelectionList()
-{
-}
-
-HTMLContentSelectionList::~HTMLContentSelectionList()
-{
-    ASSERT(isEmpty());
-}
-
-HTMLContentSelection* HTMLContentSelectionList::find(Node* node) const
-{
-    for (HTMLContentSelection* item = first(); item; item = item->next()) {
-        if (node == item->node())
-            return item;
-    }
-    
-    return 0;
-}
-
-void HTMLContentSelectionList::clear()
-{
-    if (isEmpty()) {
-        ASSERT(!m_last);
-        return;
-    }
-
-    m_first->unlink();
-    m_first.clear();
-    m_last.clear();
-}
-
-void HTMLContentSelectionList::append(PassRefPtr<HTMLContentSelection> child)
-{
-    if (isEmpty()) {
-        ASSERT(!m_last);
-        m_first = m_last = child;
-        return;
-    }
-
-    m_last->append(child);
-    m_last = m_last->next();
-}
-
-HTMLContentSelector::HTMLContentSelector()
-    : m_phase(SelectionPrevented)
-{
-}
-
-HTMLContentSelector::~HTMLContentSelector()
-{
-    ASSERT(m_candidates.isEmpty());
-}
-
-void HTMLContentSelector::select(InsertionPoint* insertionPoint, HTMLContentSelectionList* selections)
-{
-    ASSERT(m_phase == HostChildrenPopulated);
-    ASSERT(selections->isEmpty());
-
-    ContentSelectorQuery query(insertionPoint);
-
-    for (size_t i = 0; i < m_candidates.size(); ++i) {
-        Node* child = m_candidates[i].get();
-        if (!child)
-            continue;
-        if (!query.matches(child))
-            continue;
-
-        RefPtr<HTMLContentSelection> selection = HTMLContentSelection::create(insertionPoint, child);
-
-        selections->append(selection);
-        m_selectionSet.add(selection.get());
-        m_candidates[i] = 0;
-    }
-}
-
-void HTMLContentSelector::unselect(HTMLContentSelectionList* list)
-{
-    for (HTMLContentSelection* selection = list->first(); selection; selection = selection->next())
-        m_selectionSet.remove(selection);
-    list->clear();
-}
-
-HTMLContentSelection* HTMLContentSelector::findFor(const Node* key) const
-{
-    return m_selectionSet.find(key);
-}
-
-void HTMLContentSelector::willSelect()
-{
-    m_phase = SelectionStarted;
-}
-
-void HTMLContentSelector::didSelect()
-{
-    ASSERT(m_phase != SelectionPrevented);
-    m_phase = SelectionPrevented;
-    m_candidates.clear();
-}
-
-void HTMLContentSelector::populateIfNecessary(Element* shadowHost)
-{
-    if (hasPopulated())
-        return;
-
-    ASSERT(m_candidates.isEmpty());
-    ASSERT(shadowHost);
-    ASSERT(m_phase == SelectionStarted);
-
-    m_phase = HostChildrenPopulated;
-    for (Node* node = shadowHost->firstChild(); node; node = node->nextSibling())
-        m_candidates.append(node);
-}
-
-}
diff --git a/Source/WebCore/html/shadow/HTMLContentSelector.h b/Source/WebCore/html/shadow/HTMLContentSelector.h
deleted file mode 100644
index bcfbddbbd..000000000
--- a/Source/WebCore/html/shadow/HTMLContentSelector.h
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef HTMLContentSelector_h
-#define HTMLContentSelector_h
-
-#include <wtf/Forward.h>
-#include <wtf/HashSet.h>
-#include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-class Element;
-class HTMLContentElement;
-class InsertionPoint;
-class Node;
-class ShadowRoot;
-
-class HTMLContentSelection : public RefCounted<HTMLContentSelection> {
-public:
-    static PassRefPtr<HTMLContentSelection> create(InsertionPoint*, Node*);
-
-    InsertionPoint* insertionPoint() const { return m_insertionPoint; }
-    Node* node() const { return m_node.get(); }
-    HTMLContentSelection* next() const { return m_next.get(); }
-    HTMLContentSelection* previous() const { return m_previous.get(); }
-
-    void append(PassRefPtr<HTMLContentSelection>);
-    void unlink();
-
-private:
-    HTMLContentSelection(InsertionPoint*, Node*);
-
-    InsertionPoint* m_insertionPoint;
-    RefPtr<Node> m_node;
-    RefPtr<HTMLContentSelection> m_next;
-    RefPtr<HTMLContentSelection> m_previous;
-};
-
-inline HTMLContentSelection::HTMLContentSelection(InsertionPoint* insertionPoint, Node* node)
-    : m_insertionPoint(insertionPoint), m_node(node)
-{ }
-
-inline PassRefPtr<HTMLContentSelection> HTMLContentSelection::create(InsertionPoint* insertionPoint, Node* node)
-{
-    return adoptRef(new HTMLContentSelection(insertionPoint, node));
-}
-
-class HTMLContentSelectionList {
-public:
-    HTMLContentSelectionList();
-    ~HTMLContentSelectionList();
-
-    HTMLContentSelection* first() const { return m_first.get(); }
-    HTMLContentSelection* last() const { return m_last.get(); }
-    HTMLContentSelection* find(Node*) const;
-    bool isEmpty() const { return !m_first; }
-
-    void clear();
-    void append(PassRefPtr<HTMLContentSelection>);
-
-private:
-    RefPtr<HTMLContentSelection> m_first;
-    RefPtr<HTMLContentSelection> m_last;
-};
-
-
-class HTMLContentSelectionSet {
-public:
-    void add(HTMLContentSelection* value) { m_set.add(value); }
-    void remove(HTMLContentSelection* value) { m_set.remove(value); }
-    bool isEmpty() const { return m_set.isEmpty(); }
-    HTMLContentSelection* find(const Node* key) const;
-
-private:
-    struct Translator {
-    public:
-        static unsigned hash(const Node* key) { return PtrHash<const Node*>::hash(key); }
-        static bool equal(const HTMLContentSelection* selection, const Node* node) { return selection->node() == node; }
-    };
-
-    struct Hash {
-        static unsigned hash(HTMLContentSelection* key) { return PtrHash<const Node*>::hash(key->node()); }
-        static bool equal(HTMLContentSelection* a, HTMLContentSelection* b) { return a->node() == b->node(); }
-        static const bool safeToCompareToEmptyOrDeleted = false;
-    };
-
-    typedef HashSet<HTMLContentSelection*, Hash> PointerSet;
-
-    PointerSet m_set;
-};
-
-inline HTMLContentSelection* HTMLContentSelectionSet::find(const Node* key) const
-{
-    PointerSet::iterator found = m_set.find<const Node*, HTMLContentSelectionSet::Translator>(key);
-    return found != m_set.end() ? *found : 0;
-}
-
-class HTMLContentSelector {
-    WTF_MAKE_NONCOPYABLE(HTMLContentSelector);
-public:
-    HTMLContentSelector();
-    ~HTMLContentSelector();
-
-    void select(InsertionPoint*, HTMLContentSelectionList*);
-    void unselect(HTMLContentSelectionList*);
-    HTMLContentSelection* findFor(const Node* key) const;
-
-    void willSelect();
-    bool isSelecting() const;
-    void didSelect();
-
-    void populateIfNecessary(Element* shadowHost);
-    bool hasPopulated() const;
-
-private:
-    enum SelectingPhase {
-        SelectionPrevented,
-        SelectionStarted,
-        HostChildrenPopulated,
-    };
-
-    void removeFromSet(HTMLContentSelectionList*);
-    void addToSet(HTMLContentSelectionList*);
-
-    Vector<RefPtr<Node> > m_candidates;
-    HTMLContentSelectionSet m_selectionSet;
-    SelectingPhase m_phase;
-};
-
-inline bool HTMLContentSelector::isSelecting() const
-{
-    return m_phase != SelectionPrevented;
-}
-
-inline bool HTMLContentSelector::hasPopulated() const
-{
-    return m_phase == HostChildrenPopulated;
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/html/shadow/InsertionPoint.cpp b/Source/WebCore/html/shadow/InsertionPoint.cpp
index 37e5101c3..ca66c248a 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.cpp
+++ b/Source/WebCore/html/shadow/InsertionPoint.cpp
@@ -38,7 +38,6 @@ namespace WebCore {
 
 InsertionPoint::InsertionPoint(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
-    , m_selections()
 {
 }
 
@@ -65,7 +64,7 @@ void InsertionPoint::attach()
 
 void InsertionPoint::detach()
 {
-    ShadowRoot* root = toShadowRoot(shadowTreeRootNode());
+    ShadowRoot* root = shadowRoot();
     if (root && isActive()) {
         ElementShadow* shadow = root->owner();
 
@@ -76,10 +75,10 @@ void InsertionPoint::detach()
 
         // When shadow element is detached, shadow tree should be recreated to re-calculate selector for
         // other insertion points.
-        shadow->setNeedsReattachHostChildrenAndShadow();
+        shadow->setNeedsRedistributing();
     }
 
-    ASSERT(m_selections.isEmpty());
+    ASSERT(m_distribution.isEmpty());
     HTMLElement::detach();
 }
 
@@ -119,41 +118,58 @@ bool InsertionPoint::rendererIsNeeded(const NodeRenderingContext& context)
 
 inline void InsertionPoint::distributeHostChildren(ElementShadow* shadow)
 {
-    if (!shadow->selector().isSelecting()) {
-        // If HTMLContentSelector is not int selecting phase, it means InsertionPoint is attached from
+    if (!shadow->distributor().inDistribution()) {
+        // If ContentDistributor is not int selecting phase, it means InsertionPoint is attached from
         // non-ElementShadow node. To run distribute algorithm, we have to reattach ElementShadow.
-        shadow->setNeedsReattachHostChildrenAndShadow();
+        shadow->setNeedsRedistributing();
         return;
     }
 
-    shadow->selector().populateIfNecessary(shadow->host());
-    shadow->selector().unselect(&m_selections);
-    shadow->selector().select(this, &m_selections);
+    shadow->distributor().preparePoolFor(shadow->host());
+    shadow->distributor().clearDistribution(&m_distribution);
+    shadow->distributor().distribute(this, &m_distribution);
 }
 
 inline void InsertionPoint::clearDistribution(ElementShadow* shadow)
 {
-    shadow->selector().unselect(&m_selections);
+    shadow->distributor().clearDistribution(&m_distribution);
 }
 
 inline void InsertionPoint::attachDistributedNode()
 {
-    for (HTMLContentSelection* selection = m_selections.first(); selection; selection = selection->next())
-        selection->node()->attach();
+    for (size_t i = 0; i < m_distribution.size(); ++i)
+        m_distribution.at(i)->attach();
 }
 
 inline void InsertionPoint::assignShadowRoot(ShadowRoot* shadowRoot)
 {
     shadowRoot->setAssignedTo(this);
-    m_selections.clear();
+    m_distribution.clear();
     for (Node* node = shadowRoot->firstChild(); node; node = node->nextSibling())
-        m_selections.append(HTMLContentSelection::create(this, node));
+        m_distribution.append(node);
 }
 
 inline void InsertionPoint::clearAssignment(ShadowRoot* shadowRoot)
 {
     shadowRoot->setAssignedTo(0);
-    m_selections.clear();
+    m_distribution.clear();
 }
 
+Node* InsertionPoint::nextTo(const Node* node) const
+{
+    size_t index = m_distribution.find(node);
+    if (index == notFound || index + 1 == m_distribution.size())
+        return 0;
+    return m_distribution.at(index + 1).get();
+}
+
+Node* InsertionPoint::previousTo(const Node* node) const
+{
+    size_t index = m_distribution.find(node);
+    if (index == notFound || !index)
+        return 0;
+    return m_distribution.at(index - 1).get();
+}
+
+
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/InsertionPoint.h b/Source/WebCore/html/shadow/InsertionPoint.h
index 840dd0647..ac8c76caa 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.h
+++ b/Source/WebCore/html/shadow/InsertionPoint.h
@@ -31,7 +31,7 @@
 #ifndef InsertionPoint_h
 #define InsertionPoint_h
 
-#include "HTMLContentSelector.h"
+#include "ContentDistributor.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include <wtf/Forward.h>
@@ -42,8 +42,7 @@ class InsertionPoint : public HTMLElement {
 public:
     virtual ~InsertionPoint();
 
-    const HTMLContentSelectionList* selections() const { return &m_selections; }
-    bool hasSelection() const { return m_selections.first(); }
+    bool hasDistribution() const { return !m_distribution.isEmpty(); }
     bool isShadowBoundary() const;
     bool isActive() const;
 
@@ -57,6 +56,14 @@ public:
     virtual bool isInsertionPoint() const OVERRIDE { return true; }
     ShadowRoot* assignedFrom() const;
 
+    size_t indexOf(Node* node) const { return m_distribution.find(node); }
+    size_t size() const { return m_distribution.size(); }
+    Node* at(size_t index)  const { return m_distribution.at(index).get(); }
+    Node* first() const { return m_distribution.isEmpty() ? 0 : m_distribution.first().get(); }
+    Node* last() const { return m_distribution.isEmpty() ? 0 : m_distribution.last().get(); }
+    Node* nextTo(const Node*) const;
+    Node* previousTo(const Node*) const;
+
 protected:
     InsertionPoint(const QualifiedName&, Document*);
     virtual bool rendererIsNeeded(const NodeRenderingContext&) OVERRIDE;
@@ -69,7 +76,7 @@ private:
     void assignShadowRoot(ShadowRoot*);
     void clearAssignment(ShadowRoot*);
 
-    HTMLContentSelectionList m_selections;
+    ContentDistribution m_distribution;
 };
 
 inline bool isInsertionPoint(const Node* node)
diff --git a/Source/WebCore/html/shadow/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index 6ea485d1e..a82c8fb0b 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -256,8 +256,6 @@ void MediaControlPanelElement::makeTransparent()
     setInlineStyleProperty(CSSPropertyOpacity, 0.0, CSSPrimitiveValue::CSS_NUMBER);
 
     m_opaque = false;
-
-    startTimer();
 }
 
 void MediaControlPanelElement::defaultEventHandler(Event* event)
@@ -322,6 +320,36 @@ const AtomicString& MediaControlTimelineContainerElement::shadowPseudoId() const
 
 // ----------------------------
 
+class RenderMediaVolumeSliderContainer : public RenderBlock {
+public:
+    RenderMediaVolumeSliderContainer(Node*);
+
+private:
+    virtual void layout();
+};
+
+RenderMediaVolumeSliderContainer::RenderMediaVolumeSliderContainer(Node* node)
+    : RenderBlock(node)
+{
+}
+
+void RenderMediaVolumeSliderContainer::layout()
+{
+    RenderBlock::layout();
+
+    if (style()->display() == NONE || !nextSibling() || !nextSibling()->isBox())
+        return;
+
+    RenderBox* buttonBox = toRenderBox(nextSibling());
+    int absoluteOffsetTop = buttonBox->localToAbsolute(FloatPoint(0, -size().height())).y();
+
+    LayoutStateDisabler layoutStateDisabler(view());
+
+    // If the slider would be rendered outside the page, it should be moved below the controls.
+    if (UNLIKELY(absoluteOffsetTop < 0))
+        setY(buttonBox->offsetTop() + theme()->volumeSliderOffsetFromMuteButton(buttonBox, pixelSnappedSize()).y());
+}
+
 inline MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement(Document* document)
     : MediaControlElement(document)
 {
@@ -334,6 +362,11 @@ PassRefPtr<MediaControlVolumeSliderContainerElement> MediaControlVolumeSliderCon
     return element.release();
 }
 
+RenderObject* MediaControlVolumeSliderContainerElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderMediaVolumeSliderContainer(this);
+}
+
 void MediaControlVolumeSliderContainerElement::defaultEventHandler(Event* event)
 {
     if (!event->isMouseEvent() || event->type() != eventNames().mouseoutEvent)
diff --git a/Source/WebCore/html/shadow/MediaControlElements.h b/Source/WebCore/html/shadow/MediaControlElements.h
index 467e31d78..03570f755 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.h
+++ b/Source/WebCore/html/shadow/MediaControlElements.h
@@ -161,6 +161,7 @@ public:
 
 private:
     MediaControlVolumeSliderContainerElement(Document*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void defaultEventHandler(Event*);
     virtual MediaControlElementType displayType() const;
     virtual const AtomicString& shadowPseudoId() const;
diff --git a/Source/WebCore/html/shadow/MediaControlRootElement.cpp b/Source/WebCore/html/shadow/MediaControlRootElement.cpp
index 7f831bc42..e5c8bc2c2 100644
--- a/Source/WebCore/html/shadow/MediaControlRootElement.cpp
+++ b/Source/WebCore/html/shadow/MediaControlRootElement.cpp
@@ -186,6 +186,15 @@ PassRefPtr<MediaControlRootElement> MediaControlRootElement::create(Document* do
         if (ec)
             return 0;
 
+        // This is a duplicate mute button, which is visible in some ports at the bottom of the volume bar.
+        // It's important only when the volume bar is displayed below the controls.
+        RefPtr<MediaControlVolumeSliderMuteButtonElement> volumeSliderMuteButton = MediaControlVolumeSliderMuteButtonElement::create(document);
+        controls->m_volumeSliderMuteButton = volumeSliderMuteButton.get();
+        volumeSliderContainer->appendChild(volumeSliderMuteButton.release(), ec, true);
+
+        if (ec)
+            return 0;
+
         controls->m_volumeSliderContainer = volumeSliderContainer.get();
         panelVolumeControlContainer->appendChild(volumeSliderContainer.release(), ec, true);
         if (ec)
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index ab318ea8c..100daeb64 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -53,7 +53,7 @@ using namespace HTMLNames;
 TextControlInnerElement::TextControlInnerElement(Document* document)
     : HTMLDivElement(divTag, document)
 {
-    setHasCustomStyleForRenderer();
+    setHasCustomCallbacks();
 }
 
 PassRefPtr<TextControlInnerElement> TextControlInnerElement::create(Document* document)
@@ -72,7 +72,7 @@ PassRefPtr<RenderStyle> TextControlInnerElement::customStyleForRenderer()
 inline TextControlInnerTextElement::TextControlInnerTextElement(Document* document)
     : HTMLDivElement(divTag, document)
 {
-    setHasCustomStyleForRenderer();
+    setHasCustomCallbacks();
 }
 
 PassRefPtr<TextControlInnerTextElement> TextControlInnerTextElement::create(Document* document)
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.h b/Source/WebCore/html/shadow/TextControlInnerElements.h
index c231f88dc..c2280f1e8 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.h
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.h
@@ -42,7 +42,7 @@ public:
 
 protected:
     TextControlInnerElement(Document*);
-    virtual PassRefPtr<RenderStyle> customStyleForRenderer();
+    virtual PassRefPtr<RenderStyle> customStyleForRenderer() OVERRIDE;
 
 private:
     virtual bool isMouseFocusable() const { return false; }
@@ -57,7 +57,7 @@ public:
 private:
     TextControlInnerTextElement(Document*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual PassRefPtr<RenderStyle> customStyleForRenderer();
+    virtual PassRefPtr<RenderStyle> customStyleForRenderer() OVERRIDE;
     virtual bool isMouseFocusable() const { return false; }
 };
 
diff --git a/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp b/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp
index 580ebadcb..ca1c7c9dd 100644
--- a/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp
+++ b/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp
@@ -58,7 +58,7 @@ TextFieldDecorationElement::TextFieldDecorationElement(Document* document, TextF
     , m_textFieldDecorator(decorator)
 {
     ASSERT(decorator);
-    setHasCustomStyleForRenderer();
+    setHasCustomCallbacks();
 }
 
 PassRefPtr<TextFieldDecorationElement> TextFieldDecorationElement::create(Document* document, TextFieldDecorator* decorator)
diff --git a/Source/WebCore/inspector/CodeGeneratorInspector.py b/Source/WebCore/inspector/CodeGeneratorInspector.py
index 74aa14c90..ddae7a290 100755
--- a/Source/WebCore/inspector/CodeGeneratorInspector.py
+++ b/Source/WebCore/inspector/CodeGeneratorInspector.py
@@ -185,7 +185,7 @@ class DomainNameFixes:
 
         return Res
 
-    skip_js_bind_domains = set(["Runtime", "DOMDebugger"])
+    skip_js_bind_domains = set(["DOMDebugger"])
 
 
 class RawTypes(object):
diff --git a/Source/WebCore/inspector/DOMPatchSupport.cpp b/Source/WebCore/inspector/DOMPatchSupport.cpp
index d7fcb9aac..b7fdbb017 100644
--- a/Source/WebCore/inspector/DOMPatchSupport.cpp
+++ b/Source/WebCore/inspector/DOMPatchSupport.cpp
@@ -180,7 +180,7 @@ bool DOMPatchSupport::innerPatchNode(Digest* oldDigest, Digest* newDigest, Excep
             }
         }
 
-        // FIXME: Create a function in Element for copying properties. setAttributesFromElement() is close but not enough for this case.
+        // FIXME: Create a function in Element for copying properties. cloneDataFromElement() is close but not enough for this case.
         if (newElement->hasAttributesWithoutUpdate()) {
             size_t numAttrs = newElement->attributeCount();
             for (size_t i = 0; i < numAttrs; ++i) {
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 1a31f06ed..2f0e61784 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -190,6 +190,18 @@ PassRefPtr<TypeBuilder::Runtime::RemoteObject> InjectedScript::wrapSerializedObj
     return scriptValue.hasNoValue() ? 0 : wrapObject(scriptValue, groupName);
 }
 
+ScriptValue InjectedScript::findObjectById(const String& objectId) const
+{
+    ASSERT(!hasNoValue());
+    ScriptFunctionCall function(m_injectedScriptObject, "findObjectById");
+    function.appendArgument(objectId);
+
+    bool hadException = false;
+    ScriptValue resultValue = callFunctionWithEvalEnabled(function, hadException);
+    ASSERT(!hadException);
+    return resultValue;
+}
+
 void InjectedScript::inspectNode(Node* node)
 {
     ASSERT(!hasNoValue());
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index 6ef35251b..8c6736d93 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -93,6 +93,8 @@ public:
     PassRefPtr<TypeBuilder::Runtime::RemoteObject> wrapObject(ScriptValue, const String& groupName) const;
     PassRefPtr<TypeBuilder::Runtime::RemoteObject> wrapNode(Node*, const String& groupName);
     PassRefPtr<TypeBuilder::Runtime::RemoteObject> wrapSerializedObject(SerializedScriptValue*, const String& groupName) const;
+    ScriptValue findObjectById(const String& objectId) const;
+
     void inspectNode(Node*);
     void releaseObjectGroup(const String&);
     ScriptState* scriptState() const { return m_injectedScriptObject.scriptState(); }
diff --git a/Source/WebCore/inspector/InjectedScriptManager.cpp b/Source/WebCore/inspector/InjectedScriptManager.cpp
index 60517135d..8ee5a98cc 100644
--- a/Source/WebCore/inspector/InjectedScriptManager.cpp
+++ b/Source/WebCore/inspector/InjectedScriptManager.cpp
@@ -79,7 +79,24 @@ InjectedScriptHost* InjectedScriptManager::injectedScriptHost()
 
 InjectedScript InjectedScriptManager::injectedScriptForId(long id)
 {
-    return m_idToInjectedScript.get(id);
+    IdToInjectedScriptMap::iterator it = m_idToInjectedScript.find(id);
+    if (it != m_idToInjectedScript.end())
+        return it->second;
+    for (ScriptStateToId::iterator it = m_scriptStateToId.begin(); it != m_scriptStateToId.end(); ++it) {
+        if (it->second == id)
+            return injectedScriptFor(it->first);
+    }
+    return InjectedScript();
+}
+
+long InjectedScriptManager::injectedScriptIdFor(ScriptState* scriptState)
+{
+    ScriptStateToId::iterator it = m_scriptStateToId.find(scriptState);
+    if (it != m_scriptStateToId.end())
+        return it->second;
+    long id = m_nextInjectedScriptId++;
+    m_scriptStateToId.set(scriptState, id);
+    return id;
 }
 
 InjectedScript InjectedScriptManager::injectedScriptForObjectId(const String& objectId)
@@ -89,7 +106,7 @@ InjectedScript InjectedScriptManager::injectedScriptForObjectId(const String& ob
         long injectedScriptId = 0;
         bool success = parsedObjectId->asObject()->getNumber("injectedScriptId", &injectedScriptId);
         if (success)
-            return injectedScriptForId(injectedScriptId);
+            return m_idToInjectedScript.get(injectedScriptId);
     }
     return InjectedScript();
 }
@@ -100,10 +117,14 @@ void InjectedScriptManager::discardInjectedScripts()
     for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != end; ++it)
         discardInjectedScript(it->second.scriptState());
     m_idToInjectedScript.clear();
+    m_scriptStateToId.clear();
 }
 
 void InjectedScriptManager::discardInjectedScriptsFor(DOMWindow* window)
 {
+    if (m_scriptStateToId.isEmpty())
+        return;
+
     Vector<long> idsToRemove;
     IdToInjectedScriptMap::iterator end = m_idToInjectedScript.end();
     for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != end; ++it) {
@@ -111,11 +132,22 @@ void InjectedScriptManager::discardInjectedScriptsFor(DOMWindow* window)
         if (window != domWindowFromScriptState(scriptState))
             continue;
         discardInjectedScript(scriptState);
+        m_scriptStateToId.remove(scriptState);
         idsToRemove.append(it->first);
     }
 
     for (size_t i = 0; i < idsToRemove.size(); i++)
         m_idToInjectedScript.remove(idsToRemove[i]);
+
+    // Now remove script states that have id but no injected script.
+    Vector<ScriptState*> scriptStatesToRemove;
+    for (ScriptStateToId::iterator it = m_scriptStateToId.begin(); it != m_scriptStateToId.end(); ++it) {
+        ScriptState* scriptState = it->first;
+        if (window == domWindowFromScriptState(scriptState))
+            scriptStatesToRemove.append(scriptState);
+    }
+    for (size_t i = 0; i < scriptStatesToRemove.size(); i++)
+        m_scriptStateToId.remove(scriptStatesToRemove[i]);
 }
 
 bool InjectedScriptManager::canAccessInspectedWorkerContext(ScriptState*)
@@ -136,7 +168,7 @@ String InjectedScriptManager::injectedScriptSource()
 
 pair<long, ScriptObject> InjectedScriptManager::injectScript(const String& source, ScriptState* scriptState)
 {
-    long id = m_nextInjectedScriptId++;
+    long id = injectedScriptIdFor(scriptState);
     return std::make_pair(id, createInjectedScript(source, scriptState, id));
 }
 
diff --git a/Source/WebCore/inspector/InjectedScriptManager.h b/Source/WebCore/inspector/InjectedScriptManager.h
index bbdb166c8..4df3bd9e5 100644
--- a/Source/WebCore/inspector/InjectedScriptManager.h
+++ b/Source/WebCore/inspector/InjectedScriptManager.h
@@ -58,6 +58,7 @@ public:
     pair<long, ScriptObject> injectScript(const String& source, ScriptState*);
     InjectedScript injectedScriptFor(ScriptState*);
     InjectedScript injectedScriptForId(long);
+    long injectedScriptIdFor(ScriptState*);
     InjectedScript injectedScriptForObjectId(const String& objectId);
     void discardInjectedScripts();
     void discardInjectedScriptsFor(DOMWindow*);
@@ -80,6 +81,8 @@ private:
     IdToInjectedScriptMap m_idToInjectedScript;
     RefPtr<InjectedScriptHost> m_injectedScriptHost;
     InspectedStateAccessCheck m_inspectedStateAccessCheck;
+    typedef HashMap<ScriptState*, long> ScriptStateToId;
+    ScriptStateToId m_scriptStateToId;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index 8869d7a40..0c9b05dad 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -271,7 +271,7 @@ InjectedScript.prototype = {
     {
         var parsedObjectId = this._parseObjectId(objectId);
         var object = this._objectForId(parsedObjectId);
-        if (!object)
+        if (!this._isDefined(object))
             return "Could not find object with given id";
 
         if (args) {
@@ -384,10 +384,15 @@ InjectedScript.prototype = {
         return this._idToWrappedObject[objectId.id];
     },
 
-    nodeForObjectId: function(objectId)
+    findObjectById: function(objectId)
     {
         var parsedObjectId = this._parseObjectId(objectId);
-        var object = this._objectForId(parsedObjectId);
+        return this._objectForId(parsedObjectId);
+    },
+
+    nodeForObjectId: function(objectId)
+    {
+        var object = this.findObjectById(objectId);
         if (!object || this._subtype(object) !== "node")
             return null;
         return object;
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index 7b8c3f6a8..b458b0417 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -427,7 +427,26 @@
                     { "name": "value", "type": "any", "optional": true, "description": "Primitive value." },
                     { "name": "objectId", "$ref": "RemoteObjectId", "optional": true, "description": "Remote object handle." }
                 ]
+            },
+            {
+                "id": "ExecutionContextId",
+                "type": "integer",
+                "description": "Id of an execution context.",
+                "hidden": true
+            },
+            {
+                "id": "ExecutionContextDescription",
+                "type": "object",
+                "description": "Description of an isolated world.",
+                "properties": [
+                    { "name": "id", "$ref": "ExecutionContextId", "description": "Unique id of the execution context. It can be used to specify in which execution context script evaluation should be performed." },
+                    { "name": "isPageContext", "type": "boolean", "description": "True if this is a context where inpspected web page scripts run. False if it is a content script isolated context." },
+                    { "name": "name", "type": "string", "description": "Human readable name describing given context." },
+                    { "name": "frameId", "$ref": "Network.FrameId", "description": "Id of the owning frame." }
+                ],
+                "hidden": true
             }
+
         ],
         "commands": [
             {
@@ -437,7 +456,7 @@
                     { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." },
                     { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Determines whether Command Line API should be available during the evaluation.", "hidden": true },
                     { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether evaluation should stop on exceptions and mute console. Overrides setPauseOnException state.", "hidden": true },
-                    { "name": "frameId", "$ref": "Network.FrameId", "optional": true, "description": "Specifies in which frame to perform evaluation.", "hidden": true },
+                    { "name": "contextId", "type": "integer", "optional": true, "description": "Specifies in which isolated context to perform evaluation. Each content script lives in an isolated context and this parameter may be used to specify on of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page.", "hidden": true },
                     { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object that should be sent by value." }
                 ],
                 "returns": [
@@ -490,6 +509,24 @@
                 "name": "run",
                 "hidden": true,
                 "description": "Tells inspected instance(worker or page) that it can run in case it was started paused."
+            },
+            {
+                "name": "setReportExecutionContextCreation",
+                "parameters": [
+                    { "name": "enabled", "type": "boolean", "description": "Reporting enabled state." }
+                ],
+                "hidden": true,
+                "description": "Enables reporting about creation of isolated contexts by means of <code>isolatedContextCreated</code> event. When the reporting gets enabled the event will be sent immediately for each existing isolated context."
+            }
+
+        ],
+        "events": [
+            {
+                "name": "isolatedContextCreated",
+                "parameters": [
+                    { "name": "context", "$ref": "ExecutionContextDescription", "description": "A newly created isolated contex." }
+                ],
+                "description": "Issued when new isolated context is created."
             }
         ]
     },
@@ -2559,6 +2596,11 @@
                     { "name": "head", "type": "object", "optional": true },
                     { "name": "bottomUpHead", "type": "object", "optional": true }
                 ]
+            },
+            {
+                "id": "HeapSnapshotObjectId",
+                "type": "string",
+                "description": "Heap snashot object id."
             }
         ],
         "commands": [
@@ -2627,12 +2669,21 @@
             {
                 "name": "getObjectByHeapObjectId",
                 "parameters": [
-                    { "name": "objectId", "type": "integer" },
+                    { "name": "objectId", "$ref": "HeapSnapshotObjectId" },
                     { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." }
                 ],
                 "returns": [
                     { "name": "result", "$ref": "Runtime.RemoteObject", "description": "Evaluation result." }
                 ]
+            },
+            {
+                "name": "getHeapObjectId",
+                "parameters": [
+                    { "name": "objectId", "$ref": "Runtime.RemoteObjectId", "description": "Identifier of the object to get heap object id for." }
+                ],
+                "returns": [
+                    { "name": "heapSnapshotObjectId", "$ref": "HeapSnapshotObjectId", "description": "Id of the heap snapshot object corresponding to the passed remote object id." }
+                ]
             }
         ],
         "events": [
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
index ba7a73351..35e531439 100644
--- a/Source/WebCore/inspector/InspectorAgent.cpp
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -80,12 +80,6 @@ InspectorAgent::~InspectorAgent()
     m_instrumentingAgents->setInspectorAgent(0);
 }
 
-void InspectorAgent::emitCommitLoadIfNeeded()
-{
-    if (m_didCommitLoadFired)
-        InspectorInstrumentation::didCommitLoad(m_inspectedPage->mainFrame(), m_inspectedPage->mainFrame()->loader()->documentLoader());
-}
-
 void InspectorAgent::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
 {
     if (world != mainThreadNormalWorld())
diff --git a/Source/WebCore/inspector/InspectorAgent.h b/Source/WebCore/inspector/InspectorAgent.h
index 49e79fa0f..52f31e2c8 100644
--- a/Source/WebCore/inspector/InspectorAgent.h
+++ b/Source/WebCore/inspector/InspectorAgent.h
@@ -80,7 +80,7 @@ public:
 
     void didCommitLoad();
     void domContentLoadedEventFired();
-    void emitCommitLoadIfNeeded();
+    bool didCommitLoadFired() { return m_didCommitLoadFired; }
 
 #if ENABLE(WORKERS)
     void didCreateWorker(intptr_t, const String& url, bool isSharedWorker);
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index 2db8a0995..951733f5f 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -84,7 +84,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     m_inspectorAgent = inspectorAgentPtr.get();
     m_agents.append(inspectorAgentPtr.release());
 
-    OwnPtr<InspectorPageAgent> pageAgentPtr(InspectorPageAgent::create(m_instrumentingAgents.get(), page, m_state.get(), m_injectedScriptManager.get(), inspectorClient));
+    OwnPtr<InspectorPageAgent> pageAgentPtr(InspectorPageAgent::create(m_instrumentingAgents.get(), page, m_inspectorAgent, m_state.get(), m_injectedScriptManager.get(), inspectorClient));
     InspectorPageAgent* pageAgent = pageAgentPtr.get();
     m_pageAgent = pageAgentPtr.get();
     m_agents.append(pageAgentPtr.release());
@@ -274,7 +274,6 @@ void InspectorController::restoreInspectorStateFromCookie(const String& inspecto
 
     for (Agents::iterator it = m_agents.begin(); it != m_agents.end(); ++it)
         (*it)->restore();
-    m_inspectorAgent->emitCommitLoadIfNeeded();
 }
 
 void InspectorController::setProcessId(long processId)
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 8996f66e1..7ca046119 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -307,7 +307,6 @@ void InspectorDOMAgent::setDocument(Document* doc)
 
 void InspectorDOMAgent::releaseDanglingNodes()
 {
-    deleteAllValues(m_danglingNodeToIdMaps);
     m_danglingNodeToIdMaps.clear();
 }
 
@@ -532,8 +531,9 @@ int InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
         Node* parent = innerParentNode(node);
         if (!parent) {
             // Node being pushed is detached -> push subtree root.
-            danglingMap = new NodeToIdMap();
-            m_danglingNodeToIdMaps.append(danglingMap);
+            OwnPtr<NodeToIdMap> newMap = adoptPtr(new NodeToIdMap);
+            danglingMap = newMap.get();
+            m_danglingNodeToIdMaps.append(newMap.release());
             RefPtr<TypeBuilder::Array<TypeBuilder::DOM::Node> > children = TypeBuilder::Array<TypeBuilder::DOM::Node>::create();
             children->addItem(buildObjectForNode(node, 0, danglingMap));
             m_frontend->setChildNodes(0, children);
@@ -653,7 +653,7 @@ void InspectorDOMAgent::setNodeName(ErrorString* errorString, int nodeId, const
         return;
 
     // Copy over the original node's attributes.
-    newElem->setAttributesFromElement(*toElement(oldNode));
+    newElem->cloneAttributesFromElement(*toElement(oldNode));
 
     // Copy over the original node's children.
     Node* child;
@@ -884,6 +884,19 @@ void InspectorDOMAgent::performSearch(ErrorString*, const String& whitespaceTrim
                 resultCollector.add(node);
             }
         }
+
+        // Selector evaluation
+        for (Vector<Document*>::iterator it = docs.begin(); it != docs.end(); ++it) {
+            Document* document = *it;
+            ExceptionCode ec = 0;
+            RefPtr<NodeList> nodeList = document->querySelectorAll(whitespaceTrimmedQuery, ec);
+            if (ec || !nodeList)
+                continue;
+
+            unsigned size = nodeList->length();
+            for (unsigned i = 0; i < size; ++i)
+                resultCollector.add(nodeList->item(i));
+        }
     }
 
     *searchId = IdentifiersFactory::createIdentifier();
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index 6b96c2b9c..510c8e695 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -244,7 +244,7 @@ private:
     DOMListener* m_domListener;
     NodeToIdMap m_documentNodeToIdMap;
     // Owns node mappings for dangling nodes.
-    Vector<NodeToIdMap*> m_danglingNodeToIdMaps;
+    Vector<OwnPtr<NodeToIdMap> > m_danglingNodeToIdMaps;
     HashMap<int, Node*> m_idToNode;
     HashMap<int, NodeToIdMap*> m_idToNodesMap;
     HashSet<int> m_childrenRequested;
diff --git a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
index e8f5d4aec..ccb003c3f 100644
--- a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
@@ -288,7 +288,7 @@ void InspectorDatabaseAgent::disable(ErrorString*)
 
 void InspectorDatabaseAgent::restore()
 {
-    m_enabled =  m_state->getBoolean(DatabaseAgentState::databaseAgentEnabled);
+    m_enabled = m_state->getBoolean(DatabaseAgentState::databaseAgentEnabled);
 }
 
 void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString* error, const String& databaseId, RefPtr<TypeBuilder::Array<String> >& names)
diff --git a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
index 641ccc148..d9ea4b31a 100644
--- a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
+++ b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
@@ -361,7 +361,7 @@ static PassRefPtr<IDBKeyRange> idbKeyRangeFromKeyRange(InspectorObject* keyRange
 
 static PassRefPtr<Key> keyFromIDBKey(IDBKey* idbKey)
 {
-    if (!idbKey || !idbKey->valid())
+    if (!idbKey || !idbKey->isValid())
         return 0;
 
     RefPtr<Key> key;
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index 05a8ad696..77f4d314a 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -61,6 +61,7 @@
 #include "InspectorTimelineAgent.h"
 #include "InspectorWorkerAgent.h"
 #include "InstrumentingAgents.h"
+#include "PageRuntimeAgent.h"
 #include "ScriptArguments.h"
 #include "ScriptCallStack.h"
 #include "ScriptProfile.h"
@@ -112,6 +113,10 @@ void InspectorInstrumentation::didClearWindowObjectInWorldImpl(InstrumentingAgen
             debuggerAgent->didClearMainFrameWindowObject();
     }
 #endif
+    if (PageRuntimeAgent* pageRuntimeAgent = instrumentingAgents->pageRuntimeAgent()) {
+        if (world == mainThreadNormalWorld())
+            pageRuntimeAgent->didClearWindowObject(frame);
+    }
 }
 
 bool InspectorInstrumentation::isDebuggerPausedImpl(InstrumentingAgents* instrumentingAgents)
@@ -363,6 +368,12 @@ void InspectorInstrumentation::didEvaluateScriptImpl(const InspectorInstrumentat
         timelineAgent->didEvaluateScript();
 }
 
+void InspectorInstrumentation::didCreateIsolatedContextImpl(InstrumentingAgents* instrumentingAgents, Frame* frame, ScriptState* scriptState, SecurityOrigin* origin)
+{
+    if (PageRuntimeAgent* runtimeAgent = instrumentingAgents->pageRuntimeAgent())
+        runtimeAgent->didCreateIsolatedContext(frame, scriptState, origin);
+}
+
 InspectorInstrumentationCookie InspectorInstrumentation::willFireTimerImpl(InstrumentingAgents* instrumentingAgents, int timerId)
 {
     pauseOnNativeEventIfNeeded(instrumentingAgents, false, timerFiredEventName, false);
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index a172034b1..68b737748 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -39,6 +39,12 @@
 #include "Page.h"
 #include "ScriptExecutionContext.h"
 
+#if USE(JSC)
+namespace JSC {
+class ExecState;
+}
+#endif
+
 namespace WebCore {
 
 class CSSRule;
@@ -63,6 +69,7 @@ class ScriptArguments;
 class ScriptCallStack;
 class ScriptExecutionContext;
 class ScriptProfile;
+class SecurityOrigin;
 class ShadowRoot;
 class StorageArea;
 class StyleRule;
@@ -70,6 +77,12 @@ class WorkerContext;
 class WorkerContextProxy;
 class XMLHttpRequest;
 
+#if USE(JSC)
+typedef JSC::ExecState ScriptState;
+#else
+class ScriptState;
+#endif
+
 #if ENABLE(WEB_SOCKETS)
 struct WebSocketFrame;
 class WebSocketHandshakeRequest;
@@ -119,6 +132,7 @@ public:
     static void didDispatchEventOnWindow(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willEvaluateScript(Frame*, const String& url, int lineNumber);
     static void didEvaluateScript(const InspectorInstrumentationCookie&);
+    static void didCreateIsolatedContext(Frame*, ScriptState*, SecurityOrigin*);
     static InspectorInstrumentationCookie willFireTimer(ScriptExecutionContext*, int timerId);
     static void didFireTimer(const InspectorInstrumentationCookie&);
     static void didBeginFrame(Page*);
@@ -278,6 +292,7 @@ private:
     static void didDispatchEventOnWindowImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willEvaluateScriptImpl(InstrumentingAgents*, const String& url, int lineNumber);
     static void didEvaluateScriptImpl(const InspectorInstrumentationCookie&);
+    static void didCreateIsolatedContextImpl(InstrumentingAgents*, Frame*, ScriptState*, SecurityOrigin*);
     static InspectorInstrumentationCookie willFireTimerImpl(InstrumentingAgents*, int timerId);
     static void didFireTimerImpl(const InspectorInstrumentationCookie&);
     static void didBeginFrameImpl(InstrumentingAgents*);
@@ -706,6 +721,15 @@ inline void InspectorInstrumentation::didEvaluateScript(const InspectorInstrumen
 #endif
 }
 
+inline void InspectorInstrumentation::didCreateIsolatedContext(Frame* frame, ScriptState* scriptState, SecurityOrigin* origin)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(void());
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForFrame(frame))
+        return didCreateIsolatedContextImpl(instrumentingAgents, frame, scriptState, origin);
+#endif
+}
+
 inline InspectorInstrumentationCookie InspectorInstrumentation::willFireTimer(ScriptExecutionContext* context, int timerId)
 {
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
index 61fe0a7e8..4e06a436b 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -55,6 +55,7 @@
 #include "HTMLNames.h"
 #include "IdentifiersFactory.h"
 #include "InjectedScriptManager.h"
+#include "InspectorAgent.h"
 #include "InspectorClient.h"
 #include "InspectorFrontend.h"
 #include "InspectorInstrumentation.h"
@@ -222,9 +223,9 @@ bool InspectorPageAgent::sharedBufferContent(PassRefPtr<SharedBuffer> buffer, co
     return decodeSharedBuffer(buffer, textEncodingName, result);
 }
 
-PassOwnPtr<InspectorPageAgent> InspectorPageAgent::create(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorClient* client)
+PassOwnPtr<InspectorPageAgent> InspectorPageAgent::create(InstrumentingAgents* instrumentingAgents, Page* page, InspectorAgent* inspectorAgent, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorClient* client)
 {
-    return adoptPtr(new InspectorPageAgent(instrumentingAgents, page, state, injectedScriptManager, client));
+    return adoptPtr(new InspectorPageAgent(instrumentingAgents, page, inspectorAgent, state, injectedScriptManager, client));
 }
 
 // static
@@ -307,9 +308,10 @@ TypeBuilder::Page::ResourceType::Enum InspectorPageAgent::cachedResourceTypeJson
     return resourceTypeJson(cachedResourceType(cachedResource));
 }
 
-InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager, InspectorClient* client)
+InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents, Page* page, InspectorAgent* inspectorAgent, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager, InspectorClient* client)
     : InspectorBaseAgent<InspectorPageAgent>("Page", instrumentingAgents, inspectorState)
     , m_page(page)
+    , m_inspectorAgent(inspectorAgent)
     , m_injectedScriptManager(injectedScriptManager)
     , m_client(client)
     , m_frontend(0)
@@ -343,6 +345,9 @@ void InspectorPageAgent::restore()
         double fontScaleFactor = m_state->getDouble(PageAgentState::pageAgentFontScaleFactorOverride);
         bool fitWindow = m_state->getBoolean(PageAgentState::pageAgentFitWindow);
         updateViewMetrics(width, height, fontScaleFactor, fitWindow);
+
+        if (m_inspectorAgent->didCommitLoadFired())
+            frameNavigated(m_page->mainFrame()->loader()->documentLoader());
     }
 }
 
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
index acc77d63c..964bc85fc 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.h
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -49,6 +49,7 @@ class DocumentLoader;
 class Frame;
 class Frontend;
 class InjectedScriptManager;
+class InspectorAgent;
 class InspectorArray;
 class InspectorClient;
 class InspectorObject;
@@ -76,7 +77,7 @@ public:
         OtherResource
     };
 
-    static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*, InspectorClient*);
+    static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InspectorAgent*, InspectorState*, InjectedScriptManager*, InspectorClient*);
 
     static bool cachedResourceContent(CachedResource*, String* result, bool* base64Encoded);
     static bool sharedBufferContent(PassRefPtr<SharedBuffer>, const String& textEncodingName, bool withBase64Encode, String* result);
@@ -136,12 +137,13 @@ public:
     static DocumentLoader* assertDocumentLoader(ErrorString*, Frame*);
 
 private:
-    InspectorPageAgent(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*, InspectorClient*);
+    InspectorPageAgent(InstrumentingAgents*, Page*, InspectorAgent*, InspectorState*, InjectedScriptManager*, InspectorClient*);
     void updateViewMetrics(int, int, double, bool);
 
     PassRefPtr<TypeBuilder::Page::Frame> buildObjectForFrame(Frame*);
     PassRefPtr<TypeBuilder::Page::FrameResourceTree> buildObjectForFrameTree(Frame*);
     Page* m_page;
+    InspectorAgent* m_inspectorAgent;
     InjectedScriptManager* m_injectedScriptManager;
     InspectorClient* m_client;
     InspectorFrontend::Page* m_frontend;
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.cpp b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
index c1bc8a4ac..70bc92b31 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -428,8 +428,14 @@ void InspectorProfilerAgent::toggleRecordButton(bool isProfiling)
         m_frontend->setRecordingProfile(isProfiling);
 }
 
-void InspectorProfilerAgent::getObjectByHeapObjectId(ErrorString* error, int id, const String* objectGroup, RefPtr<TypeBuilder::Runtime::RemoteObject>& result)
+void InspectorProfilerAgent::getObjectByHeapObjectId(ErrorString* error, const String& heapSnapshotObjectId, const String* objectGroup, RefPtr<TypeBuilder::Runtime::RemoteObject>& result)
 {
+    bool ok;
+    unsigned id = heapSnapshotObjectId.toUInt(&ok);
+    if (!ok) {
+        *error = "Invalid heap snapshot object id";
+        return;
+    }
     ScriptObject heapObject = ScriptProfiler::objectByHeapObjectId(id);
     if (heapObject.hasNoValue()) {
         *error = "Object is not available";
@@ -445,6 +451,22 @@ void InspectorProfilerAgent::getObjectByHeapObjectId(ErrorString* error, int id,
         *error = "Failed to wrap object";
 }
 
+void InspectorProfilerAgent::getHeapObjectId(ErrorString* errorString, const String& objectId, String* heapSnapshotObjectId)
+{
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
+    if (injectedScript.hasNoValue()) {
+        *errorString = "Inspected context has gone";
+        return;
+    }
+    ScriptValue value = injectedScript.findObjectById(objectId);
+    if (value.hasNoValue() || value.isUndefined()) {
+        *errorString = "Object with given id not found";
+        return;
+    }
+    unsigned id = ScriptProfiler::getHeapObjectId(value);
+    *heapSnapshotObjectId = String::number(id);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.h b/Source/WebCore/inspector/InspectorProfilerAgent.h
index b15839880..5082666d7 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.h
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.h
@@ -96,7 +96,8 @@ public:
     virtual void takeHeapSnapshot(ErrorString*);
     void toggleRecordButton(bool isProfiling);
 
-    virtual void getObjectByHeapObjectId(ErrorString*, int id, const String* objectGroup, RefPtr<TypeBuilder::Runtime::RemoteObject>& result);
+    virtual void getObjectByHeapObjectId(ErrorString*, const String& heapSnapshotObjectId, const String* objectGroup, RefPtr<TypeBuilder::Runtime::RemoteObject>& result);
+    virtual void getHeapObjectId(ErrorString*, const String& objectId, String* heapSnapshotObjectId);
 
 protected:
     InspectorProfilerAgent(InstrumentingAgents*, InspectorConsoleAgent*, InspectorState*, InjectedScriptManager*);
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
index bbd7ce8ee..7e4fd4b62 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
@@ -83,16 +83,11 @@ static ScriptDebugServer::PauseOnExceptionsState setPauseOnExceptionsState(Scrip
 }
 #endif
 
-void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const doNotPauseOnExceptionsAndMuteConsole, const String* const frameId, const bool* const returnByValue, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
+void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const doNotPauseOnExceptionsAndMuteConsole, const int* executionContextId, const bool* const returnByValue, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
 {
-    ScriptState* scriptState = scriptStateForEval(errorString, frameId);
-    if (!scriptState)
+    InjectedScript injectedScript = injectedScriptForEval(errorString, executionContextId);
+    if (injectedScript.hasNoValue())
         return;
-    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(scriptState);
-    if (injectedScript.hasNoValue()) {
-        *errorString = "Inspected frame has gone";
-        return;
-    }
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     ScriptDebugServer::PauseOnExceptionsState previousPauseOnExceptionsState = ScriptDebugServer::DontPauseOnExceptions;
     if (asBool(doNotPauseOnExceptionsAndMuteConsole))
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.h b/Source/WebCore/inspector/InspectorRuntimeAgent.h
index e8e3bab93..f8e345e2b 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.h
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.h
@@ -40,6 +40,7 @@
 
 namespace WebCore {
 
+class InjectedScript;
 class InjectedScriptManager;
 class InspectorArray;
 class InspectorFrontend;
@@ -62,7 +63,7 @@ public:
                   const String* objectGroup,
                   const bool* includeCommandLineAPI,
                   const bool* doNotPauseOnExceptionsAndMuteConsole,
-                  const String* frameId,
+                  const int* executionContextId,
                   const bool* returnByValue,
                   RefPtr<TypeBuilder::Runtime::RemoteObject>& result,
                   TypeBuilder::OptOutput<bool>* wasThrown);
@@ -88,11 +89,13 @@ public:
 
 protected:
     InspectorRuntimeAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*);
-    virtual ScriptState* scriptStateForEval(ErrorString*, const String* frameId) = 0;
+    virtual InjectedScript injectedScriptForEval(ErrorString*, const int* executionContextId) = 0;
 
     virtual void muteConsole() = 0;
     virtual void unmuteConsole() = 0;
 
+    InjectedScriptManager* injectedScriptManager() { return m_injectedScriptManager; }
+
 private:
     InjectedScriptManager* m_injectedScriptManager;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/inspector/InstrumentingAgents.h b/Source/WebCore/inspector/InstrumentingAgents.h
index f77e8cf60..194eb865e 100644
--- a/Source/WebCore/inspector/InstrumentingAgents.h
+++ b/Source/WebCore/inspector/InstrumentingAgents.h
@@ -53,6 +53,7 @@ class InspectorRuntimeAgent;
 class InspectorTimelineAgent;
 class InspectorWorkerAgent;
 class Page;
+class PageRuntimeAgent;
 class WorkerContext;
 
 class InstrumentingAgents {
@@ -67,6 +68,7 @@ public:
         , m_inspectorDOMAgent(0)
         , m_inspectorResourceAgent(0)
         , m_inspectorRuntimeAgent(0)
+        , m_pageRuntimeAgent(0)
         , m_inspectorTimelineAgent(0)
         , m_inspectorDOMStorageAgent(0)
 #if ENABLE(SQL_DATABASE)
@@ -108,6 +110,9 @@ public:
     InspectorRuntimeAgent* inspectorRuntimeAgent() const { return m_inspectorRuntimeAgent; }
     void setInspectorRuntimeAgent(InspectorRuntimeAgent* agent) { m_inspectorRuntimeAgent = agent; }
 
+    PageRuntimeAgent* pageRuntimeAgent() const { return m_pageRuntimeAgent; }
+    void setPageRuntimeAgent(PageRuntimeAgent* agent) { m_pageRuntimeAgent = agent; }
+
     InspectorTimelineAgent* inspectorTimelineAgent() const { return m_inspectorTimelineAgent; }
     void setInspectorTimelineAgent(InspectorTimelineAgent* agent) { m_inspectorTimelineAgent = agent; }
 
@@ -150,6 +155,7 @@ private:
     InspectorDOMAgent* m_inspectorDOMAgent;
     InspectorResourceAgent* m_inspectorResourceAgent;
     InspectorRuntimeAgent* m_inspectorRuntimeAgent;
+    PageRuntimeAgent* m_pageRuntimeAgent;
     InspectorTimelineAgent* m_inspectorTimelineAgent;
     InspectorDOMStorageAgent* m_inspectorDOMStorageAgent;
 #if ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/inspector/PageRuntimeAgent.cpp b/Source/WebCore/inspector/PageRuntimeAgent.cpp
index caa1ed9de..4e9f21a45 100644
--- a/Source/WebCore/inspector/PageRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/PageRuntimeAgent.cpp
@@ -35,16 +35,28 @@
 #include "PageRuntimeAgent.h"
 
 #include "Console.h"
+#include "Document.h"
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
 #include "InspectorPageAgent.h"
+#include "InspectorState.h"
+#include "InstrumentingAgents.h"
 #include "Page.h"
-#include "ScriptState.h"
+#include "SecurityOrigin.h"
+
+using WebCore::TypeBuilder::Runtime::ExecutionContextDescription;
 
 namespace WebCore {
 
+namespace PageRuntimeAgentState {
+static const char reportExecutionContextCreation[] = "reportExecutionContextCreation";
+};
+
 PageRuntimeAgent::PageRuntimeAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, Page* page, InspectorPageAgent* pageAgent)
     : InspectorRuntimeAgent(instrumentingAgents, state, injectedScriptManager)
     , m_inspectedPage(page)
     , m_pageAgent(pageAgent)
+    , m_frontend(0)
 {
 }
 
@@ -52,17 +64,78 @@ PageRuntimeAgent::~PageRuntimeAgent()
 {
 }
 
-ScriptState* PageRuntimeAgent::scriptStateForEval(ErrorString* errorString, const String* frameId)
+void PageRuntimeAgent::setFrontend(InspectorFrontend* frontend)
+{
+    m_frontend = frontend->runtime();
+    m_instrumentingAgents->setPageRuntimeAgent(this);
+}
+
+void PageRuntimeAgent::clearFrontend()
+{
+    m_instrumentingAgents->setPageRuntimeAgent(0);
+    m_frontend = 0;
+    m_state->setBoolean(PageRuntimeAgentState::reportExecutionContextCreation, false);
+}
+
+void PageRuntimeAgent::restore()
+{
+    if (!m_state->getBoolean(PageRuntimeAgentState::reportExecutionContextCreation))
+        return;
+    String error;
+    setReportExecutionContextCreation(&error, true);
+}
+
+void PageRuntimeAgent::setReportExecutionContextCreation(ErrorString*, bool enable)
+{
+    m_state->setBoolean(PageRuntimeAgentState::reportExecutionContextCreation, enable);
+    if (!enable)
+        return;
+    Vector<std::pair<ScriptState*, SecurityOrigin*> > isolatedContexts;
+    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
+            continue;
+        String frameId = m_pageAgent->frameId(frame);
+
+        ScriptState* scriptState = mainWorldScriptState(frame);
+        notifyContextCreated(frameId, scriptState, 0, true);
+        frame->script()->collectIsolatedContexts(isolatedContexts);
+        if (isolatedContexts.isEmpty())
+            continue;
+        for (size_t i = 0; i< isolatedContexts.size(); i++)
+            notifyContextCreated(frameId, isolatedContexts[i].first, isolatedContexts[i].second, false);
+        isolatedContexts.clear();
+    }
+}
+
+void PageRuntimeAgent::didClearWindowObject(Frame* frame)
+{
+    if (!m_state->getBoolean(PageRuntimeAgentState::reportExecutionContextCreation))
+        return;
+    ASSERT(m_frontend);
+    String frameId = m_pageAgent->frameId(frame);
+    ScriptState* scriptState = mainWorldScriptState(frame);
+    notifyContextCreated(frameId, scriptState, 0, true);
+}
+
+void PageRuntimeAgent::didCreateIsolatedContext(Frame* frame, ScriptState* scriptState, SecurityOrigin* origin)
 {
-    if (!frameId)
-        return mainWorldScriptState(m_inspectedPage->mainFrame());
+    if (!m_state->getBoolean(PageRuntimeAgentState::reportExecutionContextCreation))
+        return;
+    ASSERT(m_frontend);
+    String frameId = m_pageAgent->frameId(frame);
+    notifyContextCreated(frameId, scriptState, origin, false);
+}
 
-    Frame* frame = m_pageAgent->frameForId(*frameId);
-    if (!frame) {
-        *errorString = "Frame with given id not found.";
-        return 0;
+InjectedScript PageRuntimeAgent::injectedScriptForEval(ErrorString* errorString, const int* executionContextId)
+{
+    if (!executionContextId) {
+        ScriptState* scriptState = mainWorldScriptState(m_inspectedPage->mainFrame());
+        return injectedScriptManager()->injectedScriptFor(scriptState);
     }
-    return mainWorldScriptState(frame);
+    InjectedScript injectedScript = injectedScriptManager()->injectedScriptForId(*executionContextId);
+    if (injectedScript.hasNoValue())
+        *errorString = "Execution context with given id not found.";
+    return injectedScript;
 }
 
 void PageRuntimeAgent::muteConsole()
@@ -75,6 +148,19 @@ void PageRuntimeAgent::unmuteConsole()
     Console::unmute();
 }
 
+void PageRuntimeAgent::notifyContextCreated(const String& frameId, ScriptState* scriptState, SecurityOrigin* securityOrigin, bool isPageContext)
+{
+    ASSERT(securityOrigin || isPageContext);
+    long executionContextId = injectedScriptManager()->injectedScriptIdFor(scriptState);
+    String name = securityOrigin ? securityOrigin->toString() : "";
+    m_frontend->isolatedContextCreated(ExecutionContextDescription::create()
+        .setId(executionContextId)
+        .setIsPageContext(isPageContext)
+        .setName(name)
+        .setFrameId(frameId)
+        .release());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/PageRuntimeAgent.h b/Source/WebCore/inspector/PageRuntimeAgent.h
index e806ed3d3..483217f44 100644
--- a/Source/WebCore/inspector/PageRuntimeAgent.h
+++ b/Source/WebCore/inspector/PageRuntimeAgent.h
@@ -33,13 +33,16 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "InspectorFrontend.h"
 #include "InspectorRuntimeAgent.h"
+#include "ScriptState.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
 class InspectorPageAgent;
 class Page;
+class SecurityOrigin;
 
 class PageRuntimeAgent : public InspectorRuntimeAgent {
 public:
@@ -48,15 +51,25 @@ public:
         return adoptPtr(new PageRuntimeAgent(instrumentingAgents, state, injectedScriptManager, page, pageAgent));
     }
     virtual ~PageRuntimeAgent();
+    virtual void setFrontend(InspectorFrontend*);
+    virtual void clearFrontend();
+    virtual void restore();
+    virtual void setReportExecutionContextCreation(ErrorString*, bool);
+
+    void didClearWindowObject(Frame*);
+    void didCreateIsolatedContext(Frame*, ScriptState*, SecurityOrigin*);
 
 private:
     PageRuntimeAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*, Page*, InspectorPageAgent*);
 
-    virtual ScriptState* scriptStateForEval(ErrorString*, const String* frameId);
+    virtual InjectedScript injectedScriptForEval(ErrorString*, const int* executionContextId);
     virtual void muteConsole();
     virtual void unmuteConsole();
+    void notifyContextCreated(const String& frameId, ScriptState*, SecurityOrigin*, bool isPageContext);
+
     Page* m_inspectedPage;
     InspectorPageAgent* m_pageAgent;
+    InspectorFrontend::Runtime* m_frontend;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
index 2c6f2bda1..d80b9c711 100644
--- a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
@@ -67,12 +67,12 @@ public:
     {
         // Process all queued debugger commands. It is safe to use m_workerContext here
         // because it is alive if RunWorkerLoop is not terminated, otherwise it will
-        // just be ignored.
+        // just be ignored. WorkerThread is certainly alive if this task is being executed.
         while (MessageQueueMessageReceived == m_thread->runLoop().runInMode(m_workerContext, WorkerDebuggerAgent::debuggerTaskMode, WorkerRunLoop::DontWaitForMessage)) { }
     }
 
 private:
-    RefPtr<WorkerThread> m_thread;
+    WorkerThread* m_thread;
     WorkerContext* m_workerContext;
 };
 
diff --git a/Source/WebCore/inspector/WorkerRuntimeAgent.cpp b/Source/WebCore/inspector/WorkerRuntimeAgent.cpp
index 1d82e59ac..30c077001 100644
--- a/Source/WebCore/inspector/WorkerRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/WorkerRuntimeAgent.cpp
@@ -34,6 +34,7 @@
 
 #include "WorkerRuntimeAgent.h"
 
+#include "InjectedScript.h"
 #include "ScriptState.h"
 
 namespace WebCore {
@@ -48,13 +49,19 @@ WorkerRuntimeAgent::~WorkerRuntimeAgent()
 {
 }
 
-ScriptState* WorkerRuntimeAgent::scriptStateForEval(ErrorString* error, const String* frameId)
+void WorkerRuntimeAgent::setReportExecutionContextCreation(ErrorString* error, bool)
 {
-    if (frameId) {
-        *error = "Frame id is not supported for workers.";
-        return 0;
+    *error = "Isolated contexts are not supported for workers.";
+}
+
+InjectedScript WorkerRuntimeAgent::injectedScriptForEval(ErrorString* error, const int* executionContextId)
+{
+    if (executionContextId) {
+        *error = "Execution context id is not supported for workers as there is only one execution context.";
+        return InjectedScript();
     }
-    return scriptStateFromWorkerContext(m_workerContext);
+    ScriptState* scriptState = scriptStateFromWorkerContext(m_workerContext);
+    return injectedScriptManager()->injectedScriptFor(scriptState);
 }
 
 void WorkerRuntimeAgent::muteConsole()
diff --git a/Source/WebCore/inspector/WorkerRuntimeAgent.h b/Source/WebCore/inspector/WorkerRuntimeAgent.h
index 24f56af20..6311093bf 100644
--- a/Source/WebCore/inspector/WorkerRuntimeAgent.h
+++ b/Source/WebCore/inspector/WorkerRuntimeAgent.h
@@ -47,10 +47,11 @@ public:
         return adoptPtr(new WorkerRuntimeAgent(instrumentingAgents, state, injectedScriptManager, context));
     }
     virtual ~WorkerRuntimeAgent();
+    virtual void setReportExecutionContextCreation(ErrorString*, bool);
 
 private:
     WorkerRuntimeAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*, WorkerContext*);
-    virtual ScriptState* scriptStateForEval(ErrorString*, const String* frameId);
+    virtual InjectedScript injectedScriptForEval(ErrorString*, const int* executionContextId);
     virtual void muteConsole();
     virtual void unmuteConsole();
     WorkerContext* m_workerContext;
diff --git a/Source/WebCore/inspector/compile-front-end.py b/Source/WebCore/inspector/compile-front-end.py
index 06028e4be..0a043dcf0 100755
--- a/Source/WebCore/inspector/compile-front-end.py
+++ b/Source/WebCore/inspector/compile-front-end.py
@@ -73,7 +73,8 @@ modules = [
             "DOMAgent.js",
             "DOMStorage.js",
             "DebuggerModel.js",
-            "DebuggerPresentationModel.js",
+            "DebuggerResourceBinding.js",
+            "DebuggerScriptMapping.js",
             "FileManager.js",
             "HAREntry.js",
             "IndexedDBModel.js",
@@ -82,8 +83,9 @@ modules = [
             "Placard.js",
             "Script.js",
             "ScriptFormatter.js",
-            "ScriptMapping.js",
-            "SnippetsModel.js",
+            "ScriptSnippetModel.js",
+            "SnippetStorage.js",
+            "SourceMapping.js",
             "TimelineManager.js",
             "TimelineModel.js",
             "RawSourceCode.js",
@@ -213,6 +215,7 @@ modules = [
             "CallStackSidebarPane.js",
             "ScopeChainSidebarPane.js",
             "JavaScriptSourceFrame.js",
+            "PresentationConsoleMessageHelper.js",
             "TabbedEditorContainer.js",
             "ScriptsNavigator.js",
             "ScriptsPanel.js",
@@ -290,6 +293,7 @@ modules = [
         "dependencies": ["components"],
         "sources": [
             "BottomUpProfileDataGridTree.js",
+            "CPUProfileView.js",
             "CSSSelectorProfileView.js",
             "HeapSnapshot.js",
             "HeapSnapshotDataGrids.js",
@@ -302,7 +306,6 @@ modules = [
             "ProfileDataGridTree.js",
             "ProfilesPanel.js",
             "ProfileLauncherView.js",
-            "ProfileView.js",
             "TopDownProfileDataGridTree.js",
         ]
     },
diff --git a/Source/WebCore/inspector/front-end/AdvancedSearchController.js b/Source/WebCore/inspector/front-end/AdvancedSearchController.js
index 8ee15b2d8..acc9dfe53 100644
--- a/Source/WebCore/inspector/front-end/AdvancedSearchController.js
+++ b/Source/WebCore/inspector/front-end/AdvancedSearchController.js
@@ -92,7 +92,7 @@ WebInspector.AdvancedSearchController.prototype = {
 
     /**
      * @param {number} searchId
-     * @param {Object} searchResult
+     * @param {WebInspector.FileBasedSearchResultsPane.SearchResult} searchResult
      */
     _onSearchResult: function(searchId, searchResult)
     {
@@ -323,7 +323,7 @@ WebInspector.SearchView.prototype = {
     },
 
     /**
-     * @param {Object} searchResult
+     * @param {WebInspector.FileBasedSearchResultsPane.SearchResult} searchResult
      */
     addSearchResult: function(searchResult)
     {
@@ -356,7 +356,7 @@ WebInspector.SearchView.prototype = {
         this.focus();
     },
 
-    wasHidden: function()
+    willHide: function()
     {
         this._controller.stopSearch();
     },
@@ -437,7 +437,7 @@ WebInspector.SearchScope = function()
 WebInspector.SearchScope.prototype = {
     /**
      * @param {WebInspector.SearchConfig} searchConfig
-     * @param {function(Object)} searchResultCallback
+     * @param {function(WebInspector.FileBasedSearchResultsPane.SearchResult)} searchResultCallback
      * @param {function(boolean)} searchFinishedCallback
      */
     performSearch: function(searchConfig, searchResultCallback, searchFinishedCallback) { },
@@ -453,6 +453,17 @@ WebInspector.SearchScope.prototype = {
 
 /**
  * @constructor
+ * @param {number} offset
+ * @param {number} length
+ */
+WebInspector.SearchResult = function(offset, length)
+{
+    this.offset = offset;
+    this.length = length;    
+}
+
+/**
+ * @constructor
  * @param {WebInspector.SearchConfig} searchConfig
  */
 WebInspector.SearchResultsPane = function(searchConfig)
@@ -471,7 +482,7 @@ WebInspector.SearchResultsPane.prototype = {
     },
 
     /**
-     * @param {Object} searchResult
+     * @param {WebInspector.FileBasedSearchResultsPane.SearchResult} searchResult
      */
     addSearchResult: function(searchResult) { }
 }
@@ -503,34 +514,35 @@ WebInspector.FileBasedSearchResultsPane.fileMatchesShownAtOnce = 20;
 
 WebInspector.FileBasedSearchResultsPane.prototype = {
     /**
-     * @param {Object} file
+     * @param {WebInspector.UISourceCode} uiSourceCode
      * @param {number} lineNumber
      * @param {number} columnNumber
      * @return {Element}
      */
-    createAnchor: function(file, lineNumber, columnNumber) { },
-
-    /**
-     * @param {Object} file
-     * @return {string}
-     */
-    fileName: function(file) { },
+    _createAnchor: function(uiSourceCode, lineNumber, columnNumber)
+    {
+        var anchor = document.createElement("a");
+        anchor.preferredPanel = "scripts";
+        anchor.href = uiSourceCode.url;
+        anchor.uiSourceCode = uiSourceCode;
+        anchor.lineNumber = lineNumber;
+        return anchor;
+    },
 
     /**
-     * @param {Object} searchResult
+     * @param {WebInspector.FileBasedSearchResultsPane.SearchResult} searchResult
      */
     addSearchResult: function(searchResult)
     {
         this._searchResults.push(searchResult);
-        var file = searchResult.file;
-        var fileName = this.fileName(file);
+        var uiSourceCode = searchResult.uiSourceCode;
         var searchMatches = searchResult.searchMatches;
 
-        var fileTreeElement = this._addFileTreeElement(fileName, searchMatches.length, this._searchResults.length - 1);
+        var fileTreeElement = this._addFileTreeElement(uiSourceCode.url, searchMatches.length, this._searchResults.length - 1);
     },
 
     /**
-     * @param {Object} searchResult
+     * @param {WebInspector.FileBasedSearchResultsPane.SearchResult} searchResult
      * @param {TreeElement} fileTreeElement
      */
     _fileTreeElementExpanded: function(searchResult, fileTreeElement)
@@ -550,23 +562,22 @@ WebInspector.FileBasedSearchResultsPane.prototype = {
 
     /**
      * @param {TreeElement} fileTreeElement
-     * @param {Object} searchResult
+     * @param {WebInspector.FileBasedSearchResultsPane.SearchResult} searchResult
      * @param {number} fromIndex
      * @param {number} toIndex
      */
     _appendSearchMatches: function(fileTreeElement, searchResult, fromIndex, toIndex)
     {
-        var file = searchResult.file;
-        var fileName = this.fileName(file);
+        var uiSourceCode = searchResult.uiSourceCode;
         var searchMatches = searchResult.searchMatches;
-        
+
         var regex = createSearchRegex(this._searchConfig.query, !this._searchConfig.ignoreCase, this._searchConfig.isRegex);
         for (var i = fromIndex; i < toIndex; ++i) {
             var lineNumber = searchMatches[i].lineNumber;
             var lineContent = searchMatches[i].lineContent;
             var matchRanges = this._regexMatchRanges(lineContent, regex);
             
-            var anchor = this.createAnchor(file, lineNumber, matchRanges[0].offset);
+            var anchor = this._createAnchor(uiSourceCode, lineNumber, matchRanges[0].offset);
             
             var numberString = numberToStringWithSpacesPadding(lineNumber + 1, 4);
             var lineNumberSpan = document.createElement("span");
@@ -587,7 +598,7 @@ WebInspector.FileBasedSearchResultsPane.prototype = {
 
     /**
      * @param {TreeElement} fileTreeElement
-     * @param {Object} searchResult
+     * @param {WebInspector.FileBasedSearchResultsPane.SearchResult} searchResult
      * @param {number} startMatchIndex
      */
     _appendShowMoreMatchesElement: function(fileTreeElement, searchResult, startMatchIndex)
@@ -601,7 +612,7 @@ WebInspector.FileBasedSearchResultsPane.prototype = {
     },
 
     /**
-     * @param {Object} searchResult
+     * @param {WebInspector.FileBasedSearchResultsPane.SearchResult} searchResult
      * @param {number} startMatchIndex
      * @param {TreeElement} showMoreMatchesElement
      */
@@ -654,7 +665,7 @@ WebInspector.FileBasedSearchResultsPane.prototype = {
     /**
      * @param {string} lineContent
      * @param {RegExp} regex
-     * @return {Array.<Object>}
+     * @return {Array.<WebInspector.SearchResult>}
      */
     _regexMatchRanges: function(lineContent, regex)
     {
@@ -663,14 +674,14 @@ WebInspector.FileBasedSearchResultsPane.prototype = {
         var offset = 0;
         var matchRanges = [];
         while ((regex.lastIndex < lineContent.length) && (match = regex.exec(lineContent)))
-            matchRanges.push({ offset: match.index, length: match[0].length });
-        
+            matchRanges.push(new WebInspector.SearchResult(match.index, match[0].length));
+
         return matchRanges;
     },
     
     /**
      * @param {string} lineContent
-     * @param {Array.<Object>} matchRanges
+     * @param {Array.<WebInspector.SearchResult>} matchRanges
      */
     _createContentSpan: function(lineContent, matchRanges)
     {
@@ -686,11 +697,11 @@ WebInspector.FileBasedSearchResultsPane.prototype.__proto__ = WebInspector.Searc
 
 /**
  * @constructor
- * @param {Object} file
+ * @param {WebInspector.UISourceCode} uiSourceCode
  * @param {Array.<Object>} searchMatches
  */
-WebInspector.FileBasedSearchResultsPane.SearchResult = function(file, searchMatches) {
-    this.file = file;
+WebInspector.FileBasedSearchResultsPane.SearchResult = function(uiSourceCode, searchMatches) {
+    this.uiSourceCode = uiSourceCode;
     this.searchMatches = searchMatches;
 }
 
diff --git a/Source/WebCore/inspector/front-end/AuditFormatters.js b/Source/WebCore/inspector/front-end/AuditFormatters.js
index a413a9d87..33c41e8d1 100644
--- a/Source/WebCore/inspector/front-end/AuditFormatters.js
+++ b/Source/WebCore/inspector/front-end/AuditFormatters.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,38 +28,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.applyFormatters = function(value)
+/**
+ * @constructor
+ */
+WebInspector.AuditFormatters = function()
 {
-    var formatter;
-    var type = typeof value;
-    var args;
-
-    switch (type) {
-        case "string":
-        case "boolean":
-        case "number":
-            formatter = WebInspector.AuditFormatters.text;
-            args = [ value.toString() ];
-            break;
-
-        case "object":
-            if (value instanceof Node)
-                return value;
-            if (value instanceof Array) {
-                formatter = WebInspector.AuditFormatters.concat;
-                args = value;
-            } else if (value.type && value.arguments) {
-                formatter = WebInspector.AuditFormatters[value.type];
-                args = value.arguments;
-            }
-    }
-    if (!formatter)
-        throw "Invalid value or formatter: " + type + JSON.stringify(value);
-
-    return formatter.apply(null, args);
 }
 
-WebInspector.AuditFormatters = {
+WebInspector.AuditFormatters.Registry = {
     text: function(text)
     {
         return document.createTextNode(text);
@@ -77,7 +53,7 @@ WebInspector.AuditFormatters = {
     {
         var parent = document.createElement("span");
         for (var arg = 0; arg < arguments.length; ++arg)
-            parent.appendChild(WebInspector.applyFormatters(arguments[arg]));
+            parent.appendChild(WebInspector.auditFormatters.apply(arguments[arg]));
         return parent;
     },
 
@@ -94,7 +70,59 @@ WebInspector.AuditFormatters = {
 
     resourceLink: function(url, line)
     {
-        // FIXME: use WebInspector.DebuggerPresentationModel.Linkifier
+        // FIXME: use WebInspector.Linkifier
         return WebInspector.linkifyResourceAsNode(url, line, "console-message-url webkit-html-resource-link");
     }
 };
+
+WebInspector.AuditFormatters.prototype = {
+    /**
+     * @param {string|boolean|number|Object} value
+     */
+    apply: function(value)
+    {
+        var formatter;
+        var type = typeof value;
+        var args;
+
+        switch (type) {
+        case "string":
+        case "boolean":
+        case "number":
+            formatter = WebInspector.AuditFormatters.Registry.text;
+        args = [ value.toString() ];
+        break;
+
+        case "object":
+            if (value instanceof Node)
+                return value;
+            if (value instanceof Array) {
+                formatter = WebInspector.AuditFormatters.Registry.concat;
+                args = value;
+            } else if (value.type && value.arguments) {
+                formatter = WebInspector.AuditFormatters.Registry[value.type];
+                args = value.arguments;
+            }
+        }
+        if (!formatter)
+            throw "Invalid value or formatter: " + type + JSON.stringify(value);
+
+        return formatter.apply(null, args);
+    },
+
+    /**
+     * @param {Object} formatters
+     * @param {Object} thisArgument
+     * @param {string|boolean|number|Object} value
+     */
+    partiallyApply: function(formatters, thisArgument, value)
+    {
+        if (value instanceof Array)
+            return value.map(this.partiallyApply.bind(this, formatters, thisArgument));
+        if (typeof value === "object" && typeof formatters[value.type] === "function" && value.arguments)
+            return formatters[value.type].apply(thisArgument, value.arguments);
+        return value;
+    }
+}
+
+WebInspector.auditFormatters = new WebInspector.AuditFormatters();
diff --git a/Source/WebCore/inspector/front-end/AuditResultView.js b/Source/WebCore/inspector/front-end/AuditResultView.js
index 63655e100..57f57ad85 100644
--- a/Source/WebCore/inspector/front-end/AuditResultView.js
+++ b/Source/WebCore/inspector/front-end/AuditResultView.js
@@ -114,7 +114,7 @@ WebInspector.AuditCategoryResultPane.prototype = {
         if (result.className)
             treeElement.listItemElement.addStyleClass(result.className);
         if (typeof result.value !== "string")
-            treeElement.listItemElement.appendChild(WebInspector.applyFormatters(result.value));
+            treeElement.listItemElement.appendChild(WebInspector.auditFormatters.apply(result.value));
 
         if (result.children) {
             for (var i = 0; i < result.children.length; ++i)
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index e93fbbe87..a6459b208 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -107,7 +107,7 @@ WebInspector.AuditRules.GzipRule.prototype = {
 
     _isCompressed: function(request)
     {
-        var encodingHeader = request.responseHeaders["Content-Encoding"];
+        var encodingHeader = request.responseHeaderValue("Content-Encoding");
         if (!encodingHeader)
             return false;
 
@@ -517,12 +517,12 @@ WebInspector.AuditRules.CacheControlRule.prototype = {
 
     responseHeader: function(request, header)
     {
-        return request.responseHeaders[header];
+        return request.responseHeaderValue(header);
     },
 
     hasResponseHeader: function(request, header)
     {
-        return request.responseHeaders[header] !== undefined;
+        return request.responseHeaderValue(header) !== undefined;
     },
 
     isCompressible: function(request)
@@ -543,8 +543,8 @@ WebInspector.AuditRules.CacheControlRule.prototype = {
 
     responseHeaderMatch: function(request, header, regexp)
     {
-        return request.responseHeaders[header]
-            ? request.responseHeaders[header].match(new RegExp(regexp, "im"))
+        return request.responseHeaderValue(header)
+            ? request.responseHeaderValue(header).match(new RegExp(regexp, "im"))
             : undefined;
     },
 
diff --git a/Source/WebCore/inspector/front-end/BreakpointManager.js b/Source/WebCore/inspector/front-end/BreakpointManager.js
index d1c0e9936..764621991 100644
--- a/Source/WebCore/inspector/front-end/BreakpointManager.js
+++ b/Source/WebCore/inspector/front-end/BreakpointManager.js
@@ -33,17 +33,15 @@
  * @extends {WebInspector.Object}
  * @param {WebInspector.Setting} breakpointStorage
  * @param {WebInspector.DebuggerModel} debuggerModel
- * @param {WebInspector.MainScriptMapping} sourceMapping
  */
-WebInspector.BreakpointManager = function(breakpointStorage, debuggerModel, sourceMapping)
+WebInspector.BreakpointManager = function(breakpointStorage, debuggerModel)
 {
     this._storage = new WebInspector.BreakpointManager.Storage(this, breakpointStorage);
     this._debuggerModel = debuggerModel;
-    this._sourceMapping = sourceMapping;
 
     this._breakpoints = [];
     this._breakpointForDebuggerId = {};
-    this._breakpointsForUILocation = {};
+    this._breakpointsForUISourceCode = new Map();
     this._sourceFilesWithRestoredBreakpoints = {};
 
     this._debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointResolved, this._breakpointResolved, this);
@@ -69,7 +67,7 @@ WebInspector.BreakpointManager.prototype = {
         // Erase provisional breakpoints prior to restoring them.
         for (var debuggerId in this._breakpointForDebuggerId) {
             var breakpoint = this._breakpointForDebuggerId[debuggerId];
-            if (breakpoint._primaryUILocation.uiSourceCode.id !== uiSourceCode.id)
+            if (breakpoint._sourceCodeStorageId !== sourceFileId)
                 continue;
             this._debuggerModel.removeBreakpoint(debuggerId);
             delete this._breakpointForDebuggerId[debuggerId];
@@ -116,8 +114,9 @@ WebInspector.BreakpointManager.prototype = {
      */
     findBreakpoint: function(uiSourceCode, lineNumber)
     {
-        var breakpoints = this._breakpointsForUILocation[uiSourceCode.id + ":" + lineNumber];
-        return breakpoints ? breakpoints[0] : null;
+        var breakpoints = this._breakpointsForUISourceCode.get(uiSourceCode);
+        var lineBreakpoints = breakpoints ? breakpoints[lineNumber] : null;
+        return lineBreakpoints ? lineBreakpoints[0] : null;
     },
 
     /**
@@ -168,7 +167,7 @@ WebInspector.BreakpointManager.prototype = {
             breakpoints[i]._isProvisional = true;
         }
         this._breakpoints = [];
-        this._breakpointsForUILocation = {};
+        this._breakpointsForUISourceCode.clear();
         this._sourceFilesWithRestoredBreakpoints = {};
     },
 
@@ -200,13 +199,19 @@ WebInspector.BreakpointManager.prototype = {
      */
     _uiLocationAdded: function(breakpoint, uiLocation)
     {
-        var key = uiLocation.uiSourceCode.id + ":" + uiLocation.lineNumber;
-        var breakpoints = this._breakpointsForUILocation[key];
+        var breakpoints = this._breakpointsForUISourceCode.get(uiLocation.uiSourceCode);
         if (!breakpoints) {
-            breakpoints = [];
-            this._breakpointsForUILocation[key] = breakpoints;
+            breakpoints = {};
+            this._breakpointsForUISourceCode.put(uiLocation.uiSourceCode, breakpoints);
         }
-        breakpoints.push(breakpoint);
+
+        var lineBreakpoints = breakpoints[uiLocation.lineNumber];
+        if (!lineBreakpoints) {
+            lineBreakpoints = [];
+            breakpoints[uiLocation.lineNumber] = lineBreakpoints;
+        }
+
+        lineBreakpoints.push(breakpoint);
         this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.BreakpointAdded, {breakpoint: breakpoint, uiLocation: uiLocation});
     },
 
@@ -216,13 +221,17 @@ WebInspector.BreakpointManager.prototype = {
      */
     _uiLocationRemoved: function(breakpoint, uiLocation)
     {
-        var key = uiLocation.uiSourceCode.id + ":" + uiLocation.lineNumber;
-        var breakpoints = this._breakpointsForUILocation[key];
+      var breakpoints = this._breakpointsForUISourceCode.get(uiLocation.uiSourceCode);
         if (!breakpoints)
             return;
-        breakpoints.remove(breakpoint);
-        if (!breakpoints.length)
-            delete this._breakpointsForUILocation[key];
+
+        var lineBreakpoints = breakpoints[uiLocation.lineNumber];
+        if (!lineBreakpoints)
+            return;
+
+        lineBreakpoints.remove(breakpoint);
+        if (!lineBreakpoints.length)
+            delete breakpoints[uiLocation.lineNumber];
         this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.BreakpointRemoved, {breakpoint: breakpoint, uiLocation: uiLocation});
     }
 }
@@ -241,6 +250,7 @@ WebInspector.BreakpointManager.Breakpoint = function(breakpointManager, uiSource
 {
     this._breakpointManager = breakpointManager;
     this._primaryUILocation = new WebInspector.UILocation(uiSourceCode, lineNumber, 0);
+    this._sourceCodeStorageId = uiSourceCode.breakpointStorageId();
     this._liveLocations = [];
     this._uiLocations = new Map();
 
@@ -345,7 +355,7 @@ WebInspector.BreakpointManager.Breakpoint.prototype = {
 
     _setInDebugger: function()
     {
-        var rawLocation = this._breakpointManager._sourceMapping.uiLocationToRawLocation(this._primaryUILocation.uiSourceCode, this._primaryUILocation.lineNumber, 0);
+        var rawLocation = this._primaryUILocation.uiLocationToRawLocation();
         this._breakpointManager._debuggerModel.setBreakpointByScriptLocation(rawLocation, this._condition, didSetBreakpoint.bind(this));
         /**
          * @this {WebInspector.BreakpointManager.Breakpoint}
@@ -499,3 +509,6 @@ WebInspector.BreakpointManager.Storage.Item = function(breakpoint)
     this.condition = breakpoint.condition();
     this.enabled = breakpoint.enabled();
 }
+
+/** @type {WebInspector.BreakpointManager} */
+WebInspector.breakpointManager = null;
diff --git a/Source/WebCore/inspector/front-end/ProfileView.js b/Source/WebCore/inspector/front-end/CPUProfileView.js
index a9e120868..b2cd5c145 100644
--- a/Source/WebCore/inspector/front-end/ProfileView.js
+++ b/Source/WebCore/inspector/front-end/CPUProfileView.js
@@ -23,8 +23,6 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-// FIXME: Rename the file.
-
 /**
  * @constructor
  * @extends {WebInspector.View}
@@ -564,14 +562,20 @@ WebInspector.CPUProfileType.prototype = {
         return this._recording ? WebInspector.UIString("Stop CPU profiling.") : WebInspector.UIString("Start CPU profiling.");
     },
 
+    /**
+     * @override
+     * @return {boolean}
+     */
     buttonClicked: function()
     {
         if (this._recording) {
             this.stopRecordingProfile();
             WebInspector.networkManager.enableResourceTracking();
+            return false;
         } else {
             WebInspector.networkManager.disableResourceTracking();
             this.startRecordingProfile();
+            return true;
         }
     },
 
@@ -620,11 +624,13 @@ WebInspector.CPUProfileType.prototype = {
 
     /**
      * @override
+     * @param {string=} title
      * @return {WebInspector.ProfileHeader}
      */
-    createTemporaryProfile: function()
+    createTemporaryProfile: function(title)
     {
-        return new WebInspector.ProfileHeader(WebInspector.CPUProfileType.TypeId, WebInspector.UIString("Recording\u2026"));
+        title = title || WebInspector.UIString("Recording\u2026");
+        return new WebInspector.ProfileHeader(WebInspector.CPUProfileType.TypeId, title);
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/CSSSelectorProfileView.js b/Source/WebCore/inspector/front-end/CSSSelectorProfileView.js
index a693cd5e6..ab1cf1477 100644
--- a/Source/WebCore/inspector/front-end/CSSSelectorProfileView.js
+++ b/Source/WebCore/inspector/front-end/CSSSelectorProfileView.js
@@ -283,12 +283,19 @@ WebInspector.CSSSelectorProfileType.prototype = {
         return this._recording ? WebInspector.UIString("Stop CSS selector profiling.") : WebInspector.UIString("Start CSS selector profiling.");
     },
 
+    /**
+     * @override
+     * @return {boolean}
+     */
     buttonClicked: function()
     {
-        if (this._recording)
+        if (this._recording) {
             this.stopRecordingProfile();
-        else
+            return false;
+        } else {
             this.startRecordingProfile();
+            return true;
+        }
     },
 
     get treeItemTitle()
@@ -353,11 +360,13 @@ WebInspector.CSSSelectorProfileType.prototype = {
 
     /**
      * @override
+     * @param {string=} title
      * @return {WebInspector.ProfileHeader}
      */
-    createTemporaryProfile: function()
+    createTemporaryProfile: function(title)
     {
-        return new WebInspector.ProfileHeader(WebInspector.CSSSelectorProfileType.TypeId, WebInspector.UIString("Recording\u2026"));
+        title = title || WebInspector.UIString("Recording\u2026");
+        return new WebInspector.ProfileHeader(WebInspector.CSSSelectorProfileType.TypeId, title);
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
index 454c13ccb..9bddf5af6 100644
--- a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -33,6 +33,8 @@ WebInspector.CallStackSidebarPane = function()
     this._model = WebInspector.debuggerModel;
 
     this.bodyElement.addEventListener("contextmenu", this._contextMenu.bind(this), true);
+    this.bodyElement.addEventListener("keydown", this._keyDown.bind(this), true);
+    this.bodyElement.tabIndex = 0;
 }
 
 WebInspector.CallStackSidebarPane.prototype = {
@@ -139,13 +141,31 @@ WebInspector.CallStackSidebarPane.prototype = {
 
     setStatus: function(status)
     {
-        var statusMessageElement = document.createElement("div");
-        statusMessageElement.className = "info";
+        if (!this._statusMessageElement) {
+            this._statusMessageElement = document.createElement("div");
+            this._statusMessageElement.className = "info";
+            this.bodyElement.appendChild(this._statusMessageElement);
+        }
         if (typeof status === "string")
-            statusMessageElement.textContent = status;
-        else
-            statusMessageElement.appendChild(status);
-        this.bodyElement.appendChild(statusMessageElement);
+            this._statusMessageElement.textContent = status;
+        else {
+            this._statusMessageElement.removeChildren();
+            this._statusMessageElement.appendChild(status);
+        }
+    },
+
+    _keyDown: function(event)
+    {
+        if (event.altKey || event.shiftKey || event.metaKey || event.ctrlKey)
+            return;
+
+        if (event.keyIdentifier === "Up") {
+            this._selectPreviousCallFrameOnStack();
+            event.consume();
+        } else if (event.keyIdentifier === "Down") {
+            this._selectNextCallFrameOnStack();
+            event.consume();
+        }
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/CompilerScriptMapping.js b/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
index a695aa4fd..2571cdf26 100644
--- a/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
+++ b/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
@@ -30,7 +30,9 @@
 
 /**
  * @constructor
- * @extends {WebInspector.ScriptMapping}
+ * @extends {WebInspector.Object}
+ * @implements {WebInspector.SourceMapping}
+ * @implements {WebInspector.UISourceCodeProvider}
  */
 WebInspector.CompilerScriptMapping = function()
 {
@@ -69,9 +71,9 @@ WebInspector.CompilerScriptMapping.prototype = {
     /**
      * @return {Array.<WebInspector.UISourceCode>}
      */
-    uiSourceCodeList: function()
+    uiSourceCodes: function()
     {
-        var result = []
+        var result = [];
         for (var url in this._uiSourceCodeByURL)
             result.push(this._uiSourceCodeByURL[url]);
         return result;
@@ -113,12 +115,11 @@ WebInspector.CompilerScriptMapping.prototype = {
             var sourceContent = sourceMap.sourceContent(sourceURL);
             var contentProvider;
             if (sourceContent)
-                contentProvider = new WebInspector.StaticContentProvider("text/javascript", sourceContent);
+                contentProvider = new WebInspector.StaticContentProvider(WebInspector.resourceTypes.Script, sourceContent);
             else
                 contentProvider = new WebInspector.CompilerSourceMappingContentProvider(sourceURL);
-            var uiSourceCode = new WebInspector.JavaScriptSource(sourceURL, sourceURL, contentProvider);
+            var uiSourceCode = new WebInspector.JavaScriptSource(sourceURL, contentProvider, this, false);
             uiSourceCode.isContentScript = script.isContentScript;
-            uiSourceCode.isEditable = false;
             this._uiSourceCodeByURL[sourceURL] = uiSourceCode;
             this._sourceMapForUISourceCode.put(uiSourceCode, sourceMap);
             uiSourceCodeList.push(uiSourceCode);
@@ -126,9 +127,10 @@ WebInspector.CompilerScriptMapping.prototype = {
 
         this._sourceMapForScriptId[script.scriptId] = sourceMap;
         this._scriptForSourceMap.put(sourceMap, script);
-        var data = { removedItems: [], addedItems: uiSourceCodeList };
-        this.dispatchEventToListeners(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, data);
         script.setSourceMapping(this);
+
+        for (var i = 0; i < uiSourceCodeList.length; ++i)
+            this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, uiSourceCodeList[i]);
     },
 
     /**
@@ -159,8 +161,9 @@ WebInspector.CompilerScriptMapping.prototype = {
 
     reset: function()
     {
-        var data = { removedItems: this.uiSourceCodeList(), addedItems: [] };
-        this.dispatchEventToListeners(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, data);
+        var uiSourceCodes = this.uiSourceCodes();
+        for (var i = 0; i < uiSourceCodes.length; ++i)
+            this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, uiSourceCodes[i]);
 
         this._sourceMapByURL = {};
         this._sourceMapForScriptId = {};
@@ -170,7 +173,7 @@ WebInspector.CompilerScriptMapping.prototype = {
     }
 }
 
-WebInspector.CompilerScriptMapping.prototype.__proto__ = WebInspector.ScriptMapping.prototype;
+WebInspector.CompilerScriptMapping.prototype.__proto__ = WebInspector.Object.prototype;
 
 /**
  * @constructor
diff --git a/Source/WebCore/inspector/front-end/ConsoleMessage.js b/Source/WebCore/inspector/front-end/ConsoleMessage.js
index e01b9dba8..49dbceb09 100644
--- a/Source/WebCore/inspector/front-end/ConsoleMessage.js
+++ b/Source/WebCore/inspector/front-end/ConsoleMessage.js
@@ -264,7 +264,9 @@ WebInspector.ConsoleMessageImpl.prototype = {
 
     _formatParameterAsObject: function(obj, elem)
     {
-        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description).element);
+        var section = new WebInspector.ObjectPropertiesSection(obj, obj.description);
+        section.enableContextMenu();
+        elem.appendChild(section.element);
     },
 
     _formatParameterAsNode: function(object, elem)
@@ -602,7 +604,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
     {
         // FIXME(62725): stack trace line/column numbers are one-based.
         var lineNumber = this.stackTrace ? this.stackTrace[0].lineNumber - 1 : this.line - 1;
-        var columnNumber = this.stackTrace ? this.stackTrace[0].columnNumber - 1 : 0;
+        var columnNumber = this.stackTrace && this.stackTrace[0].columnNumber ? this.stackTrace[0].columnNumber - 1 : 0;
         return WebInspector.debuggerModel.createRawLocationByURL(this.url, lineNumber, columnNumber);
     },
 
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index 08476805b..0558c3cd2 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -47,9 +47,16 @@ WebInspector.ConsoleView = function(hideContextSelector)
     this._contextSelectElement = document.createElement("select");
     this._contextSelectElement.id = "console-context";
     this._contextSelectElement.className = "status-bar-item";
+    this._contextSelectElement.addEventListener("change", this._updateIsolatedWorldSelector.bind(this), false);
 
-    if (hideContextSelector)
+    this._isolatedWorldSelectElement = document.createElement("select");
+    this._isolatedWorldSelectElement.id = "console-context";
+    this._isolatedWorldSelectElement.className = "status-bar-item";
+
+    if (hideContextSelector) {
         this._contextSelectElement.addStyleClass("hidden");
+        this._isolatedWorldSelectElement.addStyleClass("hidden");
+    }
 
     this.messagesElement = document.createElement("div");
     this.messagesElement.id = "console-messages";
@@ -127,7 +134,7 @@ WebInspector.ConsoleView.Events = {
 WebInspector.ConsoleView.prototype = {
     get statusBarItems()
     {
-        return [this._clearConsoleButton.element, this._contextSelectElement, this._filterBarElement];
+        return [this._clearConsoleButton.element, this._contextSelectElement, this._isolatedWorldSelectElement, this._filterBarElement];
     },
 
     addContext: function(context)
@@ -139,26 +146,87 @@ WebInspector.ConsoleView.prototype = {
         context._consoleOption = option;
         this._contextSelectElement.appendChild(option);
         context.addEventListener(WebInspector.FrameEvaluationContext.EventTypes.Updated, this._contextUpdated, this);
+        context.addEventListener(WebInspector.FrameEvaluationContext.EventTypes.AddedExecutionContext, this._addedExecutionContext, this);
+        this._updateIsolatedWorldSelector();
     },
 
     removeContext: function(context)
     {
         this._contextSelectElement.removeChild(context._consoleOption);
+        this._updateIsolatedWorldSelector();
+    },
+
+    _updateIsolatedWorldSelector: function()
+    {
+        var context = this._currentEvaluationContext();
+        if (!context) {
+            this._isolatedWorldSelectElement.addStyleClass("hidden");
+            return;
+        }
+
+        var isolatedContexts = context.isolatedContexts();
+        if (!isolatedContexts.length) {
+            this._isolatedWorldSelectElement.addStyleClass("hidden");
+            return;
+        }
+        this._isolatedWorldSelectElement.removeStyleClass("hidden");
+        this._isolatedWorldSelectElement.removeChildren();
+        this._appendIsolatedContextOption(context.mainWorldContext());
+        for (var i = 0; i < isolatedContexts.length; i++)
+            this._appendIsolatedContextOption(isolatedContexts[i]);
+    },
+
+    _appendIsolatedContextOption: function(isolatedContext)
+    {
+        if (!isolatedContext)
+            return;
+        var option = document.createElement("option");
+        option.text = isolatedContext.name;
+        option.title = isolatedContext.id;
+        option._executionContextId = isolatedContext.id;
+        this._isolatedWorldSelectElement.appendChild(option);
     },
 
     _contextUpdated: function(event)
     {
         var context = event.data;
-        var option= context._consoleOption;
+        var option = context._consoleOption;
         option.text = context.displayName;
         option.title = context.url;
     },
 
+    _addedExecutionContext: function(event)
+    {
+        var context = event.data;
+        if (context === this._currentEvaluationContext())
+            this._updateIsolatedWorldSelector();
+    },
+
     _currentEvaluationContextId: function()
     {
+        var result = this._currentIsolatedContextId();
+        if (result !== undefined)
+            return result;
+        var context = this._currentEvaluationContext();
+        if (context && context.mainWorldContext())
+            return context.mainWorldContext().id;
+        return undefined;
+    },
+
+    _currentEvaluationContext: function()
+    {
         if (this._contextSelectElement.selectedIndex === -1)
             return undefined;
-        return this._contextSelectElement[this._contextSelectElement.selectedIndex]._context.frameId;
+        return this._contextSelectElement[this._contextSelectElement.selectedIndex]._context;
+    },
+
+    _currentIsolatedContextId: function()
+    {
+        if (this._isolatedWorldSelectElement.hasStyleClass("hidden"))
+            return undefined;
+        if (this._isolatedWorldSelectElement.selectedIndex === -1)
+            return undefined;
+        return this._isolatedWorldSelectElement[this._isolatedWorldSelectElement.selectedIndex]._executionContextId;
     },
 
     _updateFilter: function(e)
@@ -620,7 +688,8 @@ WebInspector.ConsoleView.prototype = {
             else
                 callback(WebInspector.RemoteObject.fromPayload(result), !!wasThrown);
         }
-        RuntimeAgent.evaluate(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, this._currentEvaluationContextId(), returnByValue, evalCallback);
+        var contextId = this._currentEvaluationContextId();
+        RuntimeAgent.evaluate(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, contextId, returnByValue, evalCallback);
     },
 
     evaluateUsingTextPrompt: function(expression, showResultOnly)
diff --git a/Source/WebCore/inspector/front-end/ContentProvider.js b/Source/WebCore/inspector/front-end/ContentProvider.js
index d0cb6ce50..2c6f5198c 100644
--- a/Source/WebCore/inspector/front-end/ContentProvider.js
+++ b/Source/WebCore/inspector/front-end/ContentProvider.js
@@ -40,6 +40,11 @@ WebInspector.ContentProvider.prototype = {
     contentURL: function() { },
 
     /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function() { },
+
+    /**
      * @param {function(?string,boolean,string)} callback
      */
     requestContent: function(callback) { },
diff --git a/Source/WebCore/inspector/front-end/ContentProviders.js b/Source/WebCore/inspector/front-end/ContentProviders.js
index e5ffbe5a1..9da727c81 100644
--- a/Source/WebCore/inspector/front-end/ContentProviders.js
+++ b/Source/WebCore/inspector/front-end/ContentProviders.js
@@ -81,6 +81,14 @@ WebInspector.ConcatenatedScriptsContentProvider.prototype = {
     },
 
     /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function()
+    {
+        return WebInspector.resourceTypes.Document;
+    },
+    
+    /**
      * @param {function(?string,boolean,string)} callback
      */
     requestContent: function(callback)
@@ -180,7 +188,6 @@ WebInspector.ConcatenatedScriptsContentProvider.prototype.__proto__ = WebInspect
  */
 WebInspector.CompilerSourceMappingContentProvider = function(sourceURL)
 {
-    this._mimeType = "text/javascript";
     this._sourceURL = sourceURL;
 }
 
@@ -194,6 +201,14 @@ WebInspector.CompilerSourceMappingContentProvider.prototype = {
     },
 
     /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function()
+    {
+        return WebInspector.resourceTypes.Script;
+    },
+    
+    /**
      * @param {function(?string,boolean,string)} callback
      */
     requestContent: function(callback)
@@ -205,7 +220,7 @@ WebInspector.CompilerSourceMappingContentProvider.prototype = {
         } catch(e) {
             console.error(e.message);
         }
-        callback(sourceCode, false, this._mimeType);
+        callback(sourceCode, false, "text/javascript");
     },
 
     /**
@@ -225,11 +240,13 @@ WebInspector.CompilerSourceMappingContentProvider.prototype.__proto__ = WebInspe
 /**
  * @constructor
  * @implements {WebInspector.ContentProvider}
+ * @param {WebInspector.ResourceType} contentType 
+ * @param {string} content 
  */
-WebInspector.StaticContentProvider = function(mimeType, content)
+WebInspector.StaticContentProvider = function(contentType, content)
 {
-    this._mimeType = mimeType;
     this._content = content;
+    this._contentType = contentType;
 }
 
 WebInspector.StaticContentProvider.prototype = {
@@ -242,11 +259,19 @@ WebInspector.StaticContentProvider.prototype = {
     },
 
     /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function()
+    {
+        return WebInspector.resourceTypes.Script;
+    },
+
+    /**
      * @param {function(?string,boolean,string)} callback
      */
     requestContent: function(callback)
     {
-        callback(this._content, false, this._mimeType);
+        callback(this._content, false, this._contentType.canonicalMimeType());
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/ContextMenu.js b/Source/WebCore/inspector/front-end/ContextMenu.js
index 80df06c0e..876fc8e39 100644
--- a/Source/WebCore/inspector/front-end/ContextMenu.js
+++ b/Source/WebCore/inspector/front-end/ContextMenu.js
@@ -80,6 +80,14 @@ WebInspector.ContextMenu.prototype = {
         this._items.push({type: "separator"});
     },
 
+    /**
+     * @return {boolean}
+     */
+    isEmpty: function()
+    {
+        return !this._items.length;
+    },
+
     _itemSelected: function(id)
     {
         if (this._handlers[id])
diff --git a/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
index a6cfcce43..f8bd7fd89 100644
--- a/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
@@ -211,6 +211,15 @@ WebInspector.DOMBreakpointsSidebarPane.prototype = {
             DOMDebuggerAgent.setDOMBreakpoint(node.id, type);
     },
 
+    _removeAllBreakpoints: function()
+    {
+        for (var id in this._breakpointElements) {
+            var element = this._breakpointElements[id];
+            this._removeBreakpoint(element._node, element._type);
+        }
+        this._saveBreakpoints();
+    },
+
     _removeBreakpoint: function(node, type)
     {
         var breakpointId = this._createBreakpointId(node.id, type);
@@ -233,6 +242,7 @@ WebInspector.DOMBreakpointsSidebarPane.prototype = {
             this._saveBreakpoints();
         }
         contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), removeBreakpoint.bind(this));
+        contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Remove all DOM breakpoints" : "Remove All DOM Breakpoints"), this._removeAllBreakpoints.bind(this));
         contextMenu.show(event);
     },
 
diff --git a/Source/WebCore/inspector/front-end/DataGrid.js b/Source/WebCore/inspector/front-end/DataGrid.js
index c3e7c4367..cf66cb657 100644
--- a/Source/WebCore/inspector/front-end/DataGrid.js
+++ b/Source/WebCore/inspector/front-end/DataGrid.js
@@ -1606,6 +1606,12 @@ WebInspector.DataGridNode.prototype = {
 
         for (var i = 0; i < this.children.length; ++i)
             this.children[i]._detach();
+
+        this.wasDetached();
+    },
+
+    wasDetached: function()
+    {
     },
 
     savePosition: function()
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index 8d15b7319..d69cea135 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -518,7 +518,7 @@ WebInspector.DebuggerModel.prototype = {
     /**
      * @param {DebuggerAgent.Location} location
      * @param {function(WebInspector.UILocation):(boolean|undefined)} updateDelegate
-     * @return {WebInspector.LiveLocation}
+     * @return {WebInspector.Script.Location}
      */
     createLiveLocation: function(location, updateDelegate)
     {
diff --git a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
deleted file mode 100644
index b189f1679..000000000
--- a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
+++ /dev/null
@@ -1,403 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * @constructor
- * @extends {WebInspector.Object}
- */
-WebInspector.DebuggerPresentationModel = function()
-{
-    this._scriptMapping = new WebInspector.MainScriptMapping();
-    this._scriptMapping.addEventListener(WebInspector.MainScriptMapping.Events.UISourceCodeListChanged, this._handleUISourceCodeListChanged, this);
-
-    this._presentationCallFrames = [];
-
-    this._breakpointManager = new WebInspector.BreakpointManager(WebInspector.settings.breakpoints, WebInspector.debuggerModel, this._scriptMapping);
-    this._breakpointsActive = true;
-
-    this._pendingConsoleMessages = {};
-    this._consoleMessageLiveLocations = [];
-
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._failedToParseScriptSource, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.CallFrameSelected, this._callFrameSelected, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.GlobalObjectCleared, this._debuggerReset, this);
-
-    WebInspector.console.addEventListener(WebInspector.ConsoleModel.Events.MessageAdded, this._consoleMessageAdded, this);
-    WebInspector.console.addEventListener(WebInspector.ConsoleModel.Events.ConsoleCleared, this._consoleCleared, this);
-
-    new WebInspector.DebuggerPresentationModelResourceBinding(this);
-}
-
-WebInspector.DebuggerPresentationModel.Events = {
-    UISourceCodeAdded: "source-file-added",
-    UISourceCodeReplaced: "source-file-replaced",
-    UISourceCodeRemoved: "source-file-removed"
-}
-
-WebInspector.DebuggerPresentationModel.prototype = {
-    get breakpointManager()
-    {
-        return this._breakpointManager;
-    },
-
-    /**
-     * @param {DebuggerAgent.Location} rawLocation
-     * @return {?WebInspector.UILocation}
-     */
-    rawLocationToUILocation: function(rawLocation)
-    {
-        return this._scriptMapping.rawLocationToUILocation(rawLocation);
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {number} lineNumber
-     * @param {number} columnNumber
-     * @return {DebuggerAgent.Location}
-     */
-    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
-    {
-        return this._scriptMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
-    },
-
-    /**
-     * @param {DebuggerAgent.Location} rawLocation
-     * @param {function(WebInspector.UILocation):(boolean|undefined)} updateDelegate
-     * @return {WebInspector.LiveLocation}
-     */
-    createLiveLocation: function(rawLocation, updateDelegate)
-    {
-        var script = WebInspector.debuggerModel.scriptForId(rawLocation.scriptId);
-        return script.createLiveLocation(rawLocation, updateDelegate);
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _parsedScriptSource: function(event)
-    {
-        var script = /** @type {WebInspector.Script} */ event.data;
-        this._scriptMapping.addScript(script);
-        this._addPendingConsoleMessagesToScript(script);
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _failedToParseScriptSource: function(event)
-    {
-        this._parsedScriptSource(event);
-    },
-
-    _callFrameSelected: function(event)
-    {
-        var callFrame = /** @type {WebInspector.DebuggerModel.CallFrame} */ event.data;
-        this._scriptMapping.forceUpdateSourceMapping(callFrame.location);
-    },
-
-    /**
-     * @return {Array.<WebInspector.UISourceCode>}
-     */
-    uiSourceCodes: function()
-    {
-        return this._scriptMapping.uiSourceCodeList();
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _handleUISourceCodeListChanged: function(event)
-    {
-        var removedItems = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["removedItems"];
-        var addedItems = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["addedItems"];
-        
-        for (var i = 0; i < addedItems.length; ++i)
-            WebInspector.debuggerPresentationModel.breakpointManager.restoreBreakpoints(addedItems[i]);
-
-        if (!removedItems.length) {
-            for (var i = 0; i < addedItems.length; ++i)
-                this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeAdded, addedItems[i]);
-        } else if (!addedItems.length) {
-            for (var i = 0; i < addedItems.length; ++i)
-                this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeRemoved, removedItems[i]);
-        } else {
-            var eventData = { uiSourceCodeList: addedItems, oldUISourceCodeList: removedItems };
-            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeReplaced, eventData);
-        }
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @return {boolean}
-     */
-    canEditScriptSource: function(uiSourceCode)
-    {
-        return WebInspector.debuggerModel.canSetScriptSource() && uiSourceCode.isEditable;
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {string} newSource
-     * @param {function(?Protocol.Error)} callback
-     */
-    setScriptSource: function(uiSourceCode, newSource, callback)
-    {
-        var rawLocation = this.uiLocationToRawLocation(uiSourceCode, 0, 0);
-        var script = WebInspector.debuggerModel.scriptForId(rawLocation.scriptId);
-
-        /**
-         * @this {WebInspector.DebuggerPresentationModel}
-         * @param {?Protocol.Error} error
-         */
-        function didEditScriptSource(error)
-        {
-            callback(error);
-            if (error)
-                return;
-
-            var resource = WebInspector.resourceForURL(script.sourceURL);
-            if (resource)
-                resource.addRevision(newSource);
-
-            uiSourceCode.contentChanged(newSource);
-        }
-        WebInspector.debuggerModel.setScriptSource(script.scriptId, newSource, didEditScriptSource.bind(this));
-    },
-
-    /**
-     * @param {boolean} formatSource
-     */
-    setFormatSource: function(formatSource)
-    {
-        this._breakpointManager.reset();
-        this._scriptMapping.setFormatSource(formatSource);
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _consoleMessageAdded: function(event)
-    {
-        var message = /** @type {WebInspector.ConsoleMessage} */ event.data;
-        if (!message.url || !message.isErrorOrWarning())
-            return;
-
-        var rawLocation = message.location();
-        if (rawLocation)
-            this._addConsoleMessageToScript(message, rawLocation);
-        else
-            this._addPendingConsoleMessage(message);
-    },
-
-    /**
-     * @param {WebInspector.ConsoleMessage} message
-     * @param {DebuggerAgent.Location} rawLocation
-     */
-    _addConsoleMessageToScript: function(message, rawLocation)
-    {
-        function updateLocation(uiLocation)
-        {
-            var presentationMessage = new WebInspector.PresentationConsoleMessage(uiLocation.uiSourceCode, uiLocation.lineNumber, message);
-            uiLocation.uiSourceCode.consoleMessageAdded(presentationMessage);
-        }
-        var liveLocation = this.createLiveLocation(rawLocation, updateLocation.bind(this));
-        this._consoleMessageLiveLocations.push(liveLocation);
-    },
-
-    /**
-     * @param {WebInspector.ConsoleMessage} message
-     */
-    _addPendingConsoleMessage: function(message)
-    {
-        if (!this._pendingConsoleMessages[message.url])
-            this._pendingConsoleMessages[message.url] = [];
-        this._pendingConsoleMessages[message.url].push(message);
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     */
-    _addPendingConsoleMessagesToScript: function(script)
-    {
-        var messages = this._pendingConsoleMessages[script.sourceURL];
-        if (!messages)
-            return;
-
-        var pendingMessages = [];
-        for (var i = 0; i < messages.length; i++) {
-            var message = messages[i];
-            var rawLocation = message.location();
-            if (script.scriptId === rawLocation.scriptId)
-                this._addConsoleMessageToScript(messages, rawLocation);
-            else
-                pendingMessages.push(message);
-        }
-
-        if (pendingMessages.length)
-            this._pendingConsoleMessages[script.sourceURL] = pendingMessages;
-        else
-            delete this._pendingConsoleMessages[script.sourceURL];
-    },
-
-    _consoleCleared: function()
-    {
-        this._pendingConsoleMessages = {};
-        for (var i = 0; i < this._consoleMessageLiveLocations.length; ++i)
-            this._consoleMessageLiveLocations[i].dispose();
-        this._consoleMessageLiveLocations = [];
-        var uiSourceCodes = this.uiSourceCodes();
-        for (var i = 0; i < uiSourceCodes.length; ++i)
-            uiSourceCodes[i].consoleMessagesCleared();
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {number} lineNumber
-     */
-    continueToLine: function(uiSourceCode, lineNumber)
-    {
-        var rawLocation = this.uiLocationToRawLocation(uiSourceCode, lineNumber, 0);
-        WebInspector.debuggerModel.continueToLocation(rawLocation);
-    },
-
-    removeAllBreakpoints: function()
-    {
-        this._breakpointManager.removeAllBreakpoints();
-    },
-
-    _debuggerReset: function()
-    {
-        this._scriptMapping.reset();
-        this._pendingConsoleMessages = {};
-        this._consoleMessageLiveLocations = [];
-    }
-}
-
-WebInspector.DebuggerPresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
-
-/**
- * @constructor
- * @param {WebInspector.UISourceCode} uiSourceCode
- * @param {number} lineNumber
- * @param {WebInspector.ConsoleMessage} originalMessage
- */
-WebInspector.PresentationConsoleMessage = function(uiSourceCode, lineNumber, originalMessage)
-{
-    this.uiSourceCode = uiSourceCode;
-    this.lineNumber = lineNumber;
-    this.originalMessage = originalMessage;
-}
-
-/**
- * @constructor
- * @implements {WebInspector.ResourceDomainModelBinding}
- * @param {WebInspector.DebuggerPresentationModel} model
- */
-WebInspector.DebuggerPresentationModelResourceBinding = function(model)
-{
-    this._presentationModel = model;
-    WebInspector.Resource.registerDomainModelBinding(WebInspector.resourceTypes.Script, this);
-}
-
-WebInspector.DebuggerPresentationModelResourceBinding.prototype = {
-    /**
-     * @param {WebInspector.Resource} resource
-     * @return {boolean}
-     */
-    canSetContent: function(resource)
-    {
-        var uiSourceCode = this._uiSourceCodeForResource(resource);
-        return !!uiSourceCode && this._presentationModel.canEditScriptSource(uiSourceCode);
-    },
-
-    /**
-     * @param {WebInspector.Resource} resource
-     * @param {string} content
-     * @param {boolean} majorChange
-     * @param {function(?string)} userCallback
-     */
-    setContent: function(resource, content, majorChange, userCallback)
-    {
-        if (!majorChange)
-            return;
-
-        var uiSourceCode = this._uiSourceCodeForResource(resource);
-        if (!uiSourceCode) {
-            userCallback("Resource is not editable");
-            return;
-        }
-
-        resource.requestContent(this._setContentWithInitialContent.bind(this, uiSourceCode, content, userCallback));
-    },
-
-    /**
-     * @param {WebInspector.Resource} resource
-     * @return {WebInspector.UISourceCode}
-     */
-    _uiSourceCodeForResource: function(resource)
-    {
-        var uiSourceCodes = this._presentationModel.uiSourceCodes();
-        for (var i = 0; i < uiSourceCodes.length; ++i) {
-            if (uiSourceCodes[i].url === resource.url)
-                return uiSourceCodes[i];
-        }
-        return null;
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {string} content
-     * @param {function(?string)} userCallback
-     * @param {?string} oldContent
-     * @param {boolean} oldContentEncoded
-     * @param {string} mimeType
-     */
-    _setContentWithInitialContent: function(uiSourceCode, content, userCallback, oldContent, oldContentEncoded, mimeType)
-    {
-        /**
-         * @this {WebInspector.DebuggerPresentationModelResourceBinding}
-         * @param {?string} error
-         */
-        function callback(error)
-        {
-            if (userCallback)
-                userCallback(error);
-        }
-        this._presentationModel.setScriptSource(uiSourceCode, content, callback.bind(this));
-    }
-}
-
-WebInspector.DebuggerPresentationModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
-
-/**
- * @type {?WebInspector.DebuggerPresentationModel}
- */
-WebInspector.debuggerPresentationModel = null;
diff --git a/Source/WebCore/inspector/front-end/DebuggerResourceBinding.js b/Source/WebCore/inspector/front-end/DebuggerResourceBinding.js
new file mode 100644
index 000000000..9eaf3ea26
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/DebuggerResourceBinding.js
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @implements {WebInspector.ResourceDomainModelBinding}
+ * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
+ */
+WebInspector.DebuggerResourceBinding = function(uiSourceCodeProvider)
+{
+    this._uiSourceCodeProvider = uiSourceCodeProvider;
+    WebInspector.Resource.registerDomainModelBinding(WebInspector.resourceTypes.Script, this);
+}
+
+/**
+ * @param {WebInspector.UISourceCode} uiSourceCode
+ * @param {string} newSource
+ * @param {function(?Protocol.Error)} callback
+ */
+WebInspector.DebuggerResourceBinding.setScriptSource = function(uiSourceCode, newSource, callback)
+{
+    var rawLocation = uiSourceCode.uiLocationToRawLocation(0, 0);
+    var script = WebInspector.debuggerModel.scriptForId(rawLocation.scriptId);
+
+    /**
+     * @this {WebInspector.DebuggerResourceBinding}
+     * @param {?Protocol.Error} error
+     */
+    function didEditScriptSource(error)
+    {
+        callback(error);
+        if (error)
+            return;
+
+        var resource = WebInspector.resourceForURL(script.sourceURL);
+        if (resource)
+            resource.addRevision(newSource);
+
+        uiSourceCode.contentChanged(newSource);
+    }
+    WebInspector.debuggerModel.setScriptSource(script.scriptId, newSource, didEditScriptSource.bind(this));
+}
+
+WebInspector.DebuggerResourceBinding.prototype = {
+    /**
+     * @param {WebInspector.Resource} resource
+     * @return {boolean}
+     */
+    canSetContent: function(resource)
+    {
+        var uiSourceCode = this._uiSourceCodeForResource(resource);
+        return !!uiSourceCode && uiSourceCode.isEditable();
+    },
+
+    /**
+     * @param {WebInspector.Resource} resource
+     * @param {string} content
+     * @param {boolean} majorChange
+     * @param {function(?string)} userCallback
+     */
+    setContent: function(resource, content, majorChange, userCallback)
+    {
+        if (!majorChange)
+            return;
+
+        var uiSourceCode = this._uiSourceCodeForResource(resource);
+        if (!uiSourceCode) {
+            userCallback("Resource is not editable");
+            return;
+        }
+
+        resource.requestContent(this._setContentWithInitialContent.bind(this, uiSourceCode, content, userCallback));
+    },
+
+    /**
+     * @param {WebInspector.Resource} resource
+     * @return {WebInspector.UISourceCode}
+     */
+    _uiSourceCodeForResource: function(resource)
+    {
+        var uiSourceCodes = this._uiSourceCodeProvider.uiSourceCodes();
+        for (var i = 0; i < uiSourceCodes.length; ++i) {
+            if (uiSourceCodes[i].url === resource.url)
+                return uiSourceCodes[i];
+        }
+        return null;
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {string} content
+     * @param {function(?string)} userCallback
+     * @param {?string} oldContent
+     * @param {boolean} oldContentEncoded
+     * @param {string} mimeType
+     */
+    _setContentWithInitialContent: function(uiSourceCode, content, userCallback, oldContent, oldContentEncoded, mimeType)
+    {
+        /**
+         * @this {WebInspector.DebuggerResourceBinding}
+         * @param {?string} error
+         */
+        function callback(error)
+        {
+            if (userCallback)
+                userCallback(error);
+        }
+        WebInspector.DebuggerResourceBinding.setScriptSource(uiSourceCode, content, callback.bind(this));
+    }
+}
+
+WebInspector.DebuggerResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
diff --git a/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js b/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js
new file mode 100644
index 000000000..1e5bc06ea
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ */
+WebInspector.DebuggerScriptMapping = function()
+{
+    this._mappings = [];
+  
+    this._resourceMapping = new WebInspector.ResourceScriptMapping();
+    this._mappings.push(this._resourceMapping);
+    this._compilerMapping = new WebInspector.CompilerScriptMapping();
+    this._mappings.push(this._compilerMapping);
+    this._snippetMapping = WebInspector.scriptSnippetModel.scriptMapping;
+    this._mappings.push(this._snippetMapping);
+
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._parsedScriptSource, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.GlobalObjectCleared, this._debuggerReset, this);
+}
+
+WebInspector.DebuggerScriptMapping.prototype = {
+    /**
+     * @return {Array.<WebInspector.UISourceCodeProvider>}
+     */
+    uiSourceCodeProviders: function()
+    {
+        return this._mappings;
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _parsedScriptSource: function(event)
+    {
+        var script = /** @type {WebInspector.Script} */ event.data;
+        var mapping = this._mappingForScript(script);
+        mapping.addScript(script);
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     * @return {WebInspector.SourceMapping}
+     */
+    _mappingForScript: function(script)
+    {
+        if (WebInspector.experimentsSettings.snippetsSupport.isEnabled()) {
+            if (this._snippetMapping && this._snippetMapping.snippetIdForSourceURL(script.sourceURL))
+                return this._snippetMapping;
+        }
+
+        if (WebInspector.settings.sourceMapsEnabled.get() && script.sourceMapURL) {
+            if (this._compilerMapping.loadSourceMapForScript(script))
+                return this._compilerMapping;
+        }
+
+        return this._resourceMapping;
+    },
+
+    _debuggerReset: function()
+    {
+        for (var i = 0; i < this._mappings.length; ++i)
+            this._mappings[i].reset();
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPI.js b/Source/WebCore/inspector/front-end/ExtensionAPI.js
index ce3f976cd..d2d50c179 100644
--- a/Source/WebCore/inspector/front-end/ExtensionAPI.js
+++ b/Source/WebCore/inspector/front-end/ExtensionAPI.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -414,9 +414,19 @@ ExtensionSidebarPaneImpl.prototype = {
         extensionServer.sendRequest({ command: commands.SetSidebarHeight, id: this._id, height: height });
     },
 
-    setExpression: function(expression, rootTitle, callback)
+    setExpression: function(expression, rootTitle, evaluateOptions)
     {
-        extensionServer.sendRequest({ command: commands.SetSidebarContent, id: this._id, expression: expression, rootTitle: rootTitle, evaluateOnPage: true }, callback);
+        var callback = extractCallbackArgument(arguments);
+        var request = {
+            command: commands.SetSidebarContent,
+            id: this._id,
+            expression: expression,
+            rootTitle: rootTitle,
+            evaluateOnPage: true,
+        };
+        if (typeof evaluateOptions === "object")
+            request.evaluateOptions = evaluateOptions;
+        extensionServer.sendRequest(request, callback);
     },
 
     setObject: function(jsonObject, rootTitle, callback)
@@ -498,6 +508,8 @@ function AuditResultImpl(id)
     this.createURL = this._nodeFactory.bind(null, "url");
     this.createSnippet = this._nodeFactory.bind(null, "snippet");
     this.createText = this._nodeFactory.bind(null, "text");
+    this.createObject = this._nodeFactory.bind(null, "object");
+    this.createNode = this._nodeFactory.bind(null, "node");
 }
 
 AuditResultImpl.prototype = {
@@ -600,13 +612,20 @@ InspectedWindow.prototype = {
         return extensionServer.sendRequest({ command: commands.Reload, options: options });
     },
 
-    eval: function(expression, callback)
+    eval: function(expression, evaluateOptions)
     {
+        var callback = extractCallbackArgument(arguments);
         function callbackWrapper(result)
         {
             callback(result.value, result.isException);
         }
-        return extensionServer.sendRequest({ command: commands.EvaluateOnInspectedPage, expression: expression }, callback && callbackWrapper);
+        var request = {
+            command: commands.EvaluateOnInspectedPage,
+            expression: expression
+        };
+        if (typeof evaluateOptions === "object")
+            request.evaluateOptions = evaluateOptions;
+        return extensionServer.sendRequest(request, callback && callbackWrapper);
     },
 
     getResources: function(callback)
@@ -784,6 +803,12 @@ function defineDeprecatedProperty(object, className, oldName, newName)
     object.__defineGetter__(oldName, getter);
 }
 
+function extractCallbackArgument(args)
+{
+    var lastArgument = args[args.length - 1];
+    return typeof lastArgument === "function" ? lastArgument : undefined;
+}
+
 var AuditCategory = declareInterfaceClass(AuditCategoryImpl);
 var AuditResult = declareInterfaceClass(AuditResultImpl);
 var Button = declareInterfaceClass(ButtonImpl);
diff --git a/Source/WebCore/inspector/front-end/ExtensionAuditCategory.js b/Source/WebCore/inspector/front-end/ExtensionAuditCategory.js
index af12a7ada..d529371c5 100644
--- a/Source/WebCore/inspector/front-end/ExtensionAuditCategory.js
+++ b/Source/WebCore/inspector/front-end/ExtensionAuditCategory.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -30,9 +30,14 @@
 
 /**
  * @constructor
+ * @param {string} extensionOrigin
+ * @param {string} id
+ * @param {string} displayName
+ * @param {number} ruleCount
  */
-WebInspector.ExtensionAuditCategory = function(id, displayName, ruleCount)
+WebInspector.ExtensionAuditCategory = function(extensionOrigin, id, displayName, ruleCount)
 {
+    this._extensionOrigin = extensionOrigin;
     this._id = id;
     this._displayName = displayName;
     this._ruleCount  = ruleCount;
@@ -63,6 +68,8 @@ WebInspector.ExtensionAuditCategory.prototype = {
 
 /**
  * @constructor
+ * @param {WebInspector.ExtensionAuditCategory} category
+ * @param {function(WebInspector.AuditRuleResult)} callback
  */
 WebInspector.ExtensionAuditCategoryResults = function(category, callback)
 {
@@ -98,7 +105,8 @@ WebInspector.ExtensionAuditCategoryResults.prototype = {
 
     _addNode: function(parent, node)
     {
-        var addedNode = parent.addChild(node.contents, node.expanded);
+        var contents = WebInspector.auditFormatters.partiallyApply(WebInspector.ExtensionAuditFormatters, this, node.contents);
+        var addedNode = parent.addChild(contents, node.expanded);
         if (node.children) {
             for (var i = 0; i < node.children.length; ++i)
                 this._addNode(addedNode, node.children[i]);
@@ -111,6 +119,81 @@ WebInspector.ExtensionAuditCategoryResults.prototype = {
         this._pendingRules--;
         if (!this._pendingRules)
             WebInspector.extensionServer.stopAuditRun(this);
+    },
+
+    /**
+     * @param {string} expression
+     * @param {function(WebInspector.RemoteObject)} callback
+     */
+    evaluate: function(expression, evaluateOptions, callback)
+    {
+        /**
+         * @param {?string} error
+         * @param {?RuntimeAgent.RemoteObject} result
+         * @param {boolean=} wasThrown
+         */
+        function onEvaluate(error, result, wasThrown)
+        {
+            if (wasThrown)
+                return;
+            var object = WebInspector.RemoteObject.fromPayload(result);
+            callback(object);
+        }
+        WebInspector.extensionServer.evaluate(expression, false, false, evaluateOptions, this._category._extensionOrigin, onEvaluate);
+    }
+}
+
+WebInspector.ExtensionAuditFormatters = {
+    /**
+     * @this {WebInspector.ExtensionAuditCategoryResults}
+     * @param {string} expression
+     * @param {string} title
+     * @param {Object} evaluateOptions
+     */
+    object: function(expression, title, evaluateOptions)
+    {
+        var parentElement = document.createElement("div");
+        function onEvaluate(remoteObject)
+        {
+            var section = new WebInspector.ObjectPropertiesSection(remoteObject, title);
+            section.expanded = true;
+            section.editable = false;
+            parentElement.appendChild(section.element);
+        }
+        this.evaluate(expression, evaluateOptions, onEvaluate);
+        return parentElement;
+    },
+
+    /**
+     * @this {WebInspector.ExtensionAuditCategoryResults}
+     * @param {string} expression
+     * @param {Object} evaluateOptions
+     */
+    node: function(expression, evaluateOptions)
+    {
+        var parentElement = document.createElement("div");
+        /**
+         * @param {?number} nodeId
+         */
+        function onNodeAvailable(nodeId)
+        {
+            if (!nodeId)
+                return;
+            var treeOutline = new WebInspector.ElementsTreeOutline(false, false, true);
+            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
+            treeOutline.element.addStyleClass("outline-disclosure");
+            treeOutline.setVisible(true);
+            parentElement.appendChild(treeOutline.element);
+        }
+        /**
+         * @param {WebInspector.RemoteObject} remoteObject
+         */
+        function onEvaluate(remoteObject)
+        {
+            remoteObject.pushNodeToFrontend(onNodeAvailable);
+        }
+        this.evaluate(expression, evaluateOptions, onEvaluate);
+        return parentElement;
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ExtensionPanel.js b/Source/WebCore/inspector/front-end/ExtensionPanel.js
index 945c86526..cd90486e6 100644
--- a/Source/WebCore/inspector/front-end/ExtensionPanel.js
+++ b/Source/WebCore/inspector/front-end/ExtensionPanel.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -39,6 +39,7 @@
 WebInspector.ExtensionView = function(id, parent, src, className)
 {
     WebInspector.View.call(this);
+    this.element.className = "fill";
 
     this._id = id;
     this._iframe = document.createElement("iframe");
@@ -245,10 +246,10 @@ WebInspector.ExtensionSidebarPane.prototype = {
      * @param {string} title
      * @param {function(?string=)} callback
      */
-    setExpression: function(expression, title, callback)
+    setExpression: function(expression, title, evaluateOptions, securityOrigin, callback)
     {
         this._createObjectPropertiesView();
-        RuntimeAgent.evaluate(expression, "extension-watch", true, undefined, undefined, undefined, this._onEvaluate.bind(this, title, callback));
+        return WebInspector.extensionServer.evaluate(expression, true, false, evaluateOptions, securityOrigin, this._onEvaluate.bind(this, title, callback));
     },
 
     /**
@@ -263,7 +264,9 @@ WebInspector.ExtensionSidebarPane.prototype = {
         if (this._extensionView)
             this._extensionView.detach(true);
 
-        this._extensionView = new WebInspector.ExtensionView(this._id, this.bodyElement, url, "extension");
+        this._extensionView = new WebInspector.ExtensionView(this._id, this.bodyElement, url, "extension fill");
+        if (!this.bodyElement.style.height)
+            this.setHeight("150px");
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/ExtensionServer.js b/Source/WebCore/inspector/front-end/ExtensionServer.js
index 699a5ebf9..e67f8c6f5 100644
--- a/Source/WebCore/inspector/front-end/ExtensionServer.js
+++ b/Source/WebCore/inspector/front-end/ExtensionServer.js
@@ -260,9 +260,8 @@ WebInspector.ExtensionServer.prototype = {
             this._dispatchCallback(message.requestId, port, result);
         }
         if (message.evaluateOnPage)
-            sidebar.setExpression(message.expression, message.rootTitle, callback.bind(this));
-        else
-            sidebar.setObject(message.expression, message.rootTitle, callback.bind(this));
+            return sidebar.setExpression(message.expression, message.rootTitle, message.evaluateOptions, port._extensionOrigin, callback.bind(this));
+        sidebar.setObject(message.expression, message.rootTitle, callback.bind(this));
     },
 
     _onSetSidebarPage: function(message, port)
@@ -338,7 +337,7 @@ WebInspector.ExtensionServer.prototype = {
       
             this._dispatchCallback(message.requestId, port, result);
         }
-        RuntimeAgent.evaluate(message.expression, "", true, undefined, undefined, true, callback.bind(this));
+        return this.evaluate(message.expression, true, true, message.evaluateOptions, port._extensionOrigin, callback.bind(this));
     },
 
     _onGetConsoleMessages: function()
@@ -501,9 +500,9 @@ WebInspector.ExtensionServer.prototype = {
         return this._requests[id];
     },
 
-    _onAddAuditCategory: function(message)
+    _onAddAuditCategory: function(message, port)
     {
-        var category = new WebInspector.ExtensionAuditCategory(message.id, message.displayName, message.resultCount);
+        var category = new WebInspector.ExtensionAuditCategory(port._extensionOrigin, message.id, message.displayName, message.resultCount);
         if (WebInspector.panels.audits.getCategory(category.id))
             return this._status.E_EXISTS(category.id);
         this._clientObjects[message.id] = category;
@@ -723,6 +722,29 @@ WebInspector.ExtensionServer.prototype = {
                 result.push(source[i]);
         }
         return "/" + result.join("/");
+    },
+
+    /**
+     * @param {string} expression
+     * @param {boolean} exposeCommandLineAPI
+     * @param {boolean} returnByValue
+     * @param {Object} options
+     * @param {string} securityOrigin
+     * @param {function(?string, ?RuntimeAgent.RemoteObject, boolean=)} callback
+     */
+    evaluate: function(expression, exposeCommandLineAPI, returnByValue, options, securityOrigin, callback) 
+    {
+        var contextId;
+        if (typeof options === "object" && options["useContentScriptContext"]) {
+            var mainFrame = WebInspector.resourceTreeModel.mainFrame;
+            if (!mainFrame)
+                return this._status.E_FAILED("main frame not available yet");
+            var context = WebInspector.javaScriptContextManager.contextByFrameAndSecurityOrigin(mainFrame, securityOrigin);
+            if (!context)
+                return this._status.E_NOTFOUND(securityOrigin);
+            contextId = context.id;
+        }
+        RuntimeAgent.evaluate(expression, "extension", exposeCommandLineAPI, true, contextId, returnByValue, callback);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/FilteredItemSelectionDialog.js b/Source/WebCore/inspector/front-end/FilteredItemSelectionDialog.js
index 511b05a64..bcc4e7cbc 100644
--- a/Source/WebCore/inspector/front-end/FilteredItemSelectionDialog.js
+++ b/Source/WebCore/inspector/front-end/FilteredItemSelectionDialog.js
@@ -489,11 +489,6 @@ WebInspector.JavaScriptOutlineDialog.show = function(view, contentProvider)
     WebInspector.Dialog.show(view.element, filteredItemSelectionDialog);
 }
 
-WebInspector.JavaScriptOutlineDialog.createShortcut = function()
-{
-    return WebInspector.KeyboardShortcut.makeDescriptor("o", WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta | WebInspector.KeyboardShortcut.Modifiers.Shift);
-}
-
 WebInspector.JavaScriptOutlineDialog.prototype = {
     /**
      * @param {number} itemIndex
@@ -654,23 +649,23 @@ WebInspector.OpenResourceDialog.prototype.__proto__ = WebInspector.SelectionDial
  * @constructor
  * @extends {WebInspector.OpenResourceDialog}
  * @param {WebInspector.ScriptsPanel} panel
- * @param {WebInspector.DebuggerPresentationModel} presentationModel
+ * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
  */
-WebInspector.OpenScriptDialog = function(panel, presentationModel)
+WebInspector.OpenScriptDialog = function(panel, uiSourceCodeProvider)
 {
-    WebInspector.OpenResourceDialog.call(this, presentationModel.uiSourceCodes());
+    WebInspector.OpenResourceDialog.call(this, uiSourceCodeProvider.uiSourceCodes());
     this._panel = panel;
 }
 
 /**
  * @param {WebInspector.ScriptsPanel} panel
- * @param {WebInspector.DebuggerPresentationModel} presentationModel
+ * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
  */
-WebInspector.OpenScriptDialog.install = function(panel, presentationModel, relativeToElement)
+WebInspector.OpenScriptDialog.install = function(panel, uiSourceCodeProvider, relativeToElement)
 {
     function showOpenResourceDialog()
     {
-        WebInspector.OpenScriptDialog._show(panel, presentationModel, relativeToElement);
+        WebInspector.OpenScriptDialog._show(panel, uiSourceCodeProvider, relativeToElement);
     }
 
     var openResourceShortcut = WebInspector.OpenResourceDialog.createShortcut();
@@ -679,15 +674,15 @@ WebInspector.OpenScriptDialog.install = function(panel, presentationModel, relat
 
 /**
  * @param {WebInspector.ScriptsPanel} panel
- * @param {WebInspector.DebuggerPresentationModel} presentationModel
+ * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
  * @param {Element} relativeToElement
  */
-WebInspector.OpenScriptDialog._show = function(panel, presentationModel, relativeToElement)
+WebInspector.OpenScriptDialog._show = function(panel, uiSourceCodeProvider, relativeToElement)
 {
     if (WebInspector.Dialog.currentInstance())
         return;
 
-    var filteredItemSelectionDialog = new WebInspector.FilteredItemSelectionDialog(new WebInspector.OpenScriptDialog(panel, presentationModel));
+    var filteredItemSelectionDialog = new WebInspector.FilteredItemSelectionDialog(new WebInspector.OpenScriptDialog(panel, uiSourceCodeProvider));
     WebInspector.Dialog.show(relativeToElement, filteredItemSelectionDialog);
 }
 
diff --git a/Source/WebCore/inspector/front-end/HAREntry.js b/Source/WebCore/inspector/front-end/HAREntry.js
index f541b23a5..eea5339a3 100644
--- a/Source/WebCore/inspector/front-end/HAREntry.js
+++ b/Source/WebCore/inspector/front-end/HAREntry.js
@@ -72,7 +72,7 @@ WebInspector.HAREntry.prototype = {
             method: this._request.requestMethod,
             url: this._buildRequestURL(this._request.url),
             httpVersion: this._request.requestHttpVersion,
-            headers: this._buildHeaders(this._request.requestHeaders),
+            headers: this._request.requestHeaders,
             queryString: this._buildParameters(this._request.queryParameters || []),
             cookies: this._buildCookies(this._request.requestCookies || []),
             headersSize: this._request.requestHeadersSize,
@@ -93,7 +93,7 @@ WebInspector.HAREntry.prototype = {
             status: this._request.statusCode,
             statusText: this._request.statusText,
             httpVersion: this._request.responseHttpVersion,
-            headers: this._buildHeaders(this._request.responseHeaders),
+            headers: this._request.responseHeaders,
             cookies: this._buildCookies(this._request.responseCookies || []),
             content: this._buildContent(),
             redirectURL: this._request.responseHeaderValue("Location") || "",
@@ -157,17 +157,6 @@ WebInspector.HAREntry.prototype = {
     /**
      * @return {Object}
      */
-    _buildHeaders: function(headers)
-    {
-        var result = [];
-        for (var name in headers)
-            result.push({ name: name, value: headers[name] });
-        return result;
-    },
-
-    /**
-     * @return {Object}
-     */
     _buildPostData: function()
     {
         var res = {
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshot.js b/Source/WebCore/inspector/front-end/HeapSnapshot.js
index 0b1c9c51f..301c782a1 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshot.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshot.js
@@ -426,7 +426,7 @@ WebInspector.HeapSnapshotNode.prototype = {
 
     get distanceToWindow()
     {
-        return this._snapshot._distancesToWindow[this.nodeIndex];
+        return this._snapshot._distancesToWindow[this.nodeIndex / this._snapshot._nodeFieldCount];
     },
 
     get className()
@@ -555,19 +555,19 @@ WebInspector.HeapSnapshotNode.prototype = {
 
     get _nodes()
     {
-        return this._snapshot._onlyNodes;
+        return this._snapshot._nodes;
     },
 
     _edgeIndexesStart: function()
     {
-        return this._snapshot._onlyNodes[this.nodeIndex + this._snapshot._firstEdgeIndexOffset];
+        return this._snapshot._nodes[this.nodeIndex + this._snapshot._firstEdgeIndexOffset];
     },
 
     _edgeIndexesEnd: function()
     {
         var nextNodeIndex = this._nextNodeIndex;
-        if (nextNodeIndex < this._snapshot._onlyNodes.length)
-            return this._snapshot._onlyNodes[nextNodeIndex + this._snapshot._firstEdgeIndexOffset]
+        if (nextNodeIndex < this._snapshot._nodes.length)
+            return this._snapshot._nodes[nextNodeIndex + this._snapshot._firstEdgeIndexOffset]
         return this._snapshot._containmentEdges.length;
     },
 
@@ -629,8 +629,7 @@ WebInspector.HeapSnapshot = function(profile)
 {
     this.uid = profile.snapshot.uid;
     this._nodes = profile.nodes;
-    this._onlyNodes = profile.onlyNodes;
-    this._containmentEdges = profile.containmentEdges;
+    this._containmentEdges = profile.edges;
     /** @type{HeapSnapshotMetainfo} */
     this._metaNode = profile.snapshot.meta;
     this._strings = profile.strings;
@@ -674,86 +673,45 @@ WebInspector.HeapSnapshot.prototype = {
     _init: function()
     {
         var meta = this._metaNode;
-        if (meta.separate_edges) {
-            this._rootNodeIndex = 0;
-
-            this._nodeTypeOffset = meta.node_fields.indexOf("type");
-            this._nodeNameOffset = meta.node_fields.indexOf("name");
-            this._nodeIdOffset = meta.node_fields.indexOf("id");
-            this._nodeSelfSizeOffset = meta.node_fields.indexOf("self_size");
-            this._nodeRetainedSizeOffset = meta.node_fields.indexOf("retained_size");
-            this._dominatorOffset = meta.node_fields.indexOf("dominator");
-            this._firstEdgeIndexOffset = meta.node_fields.indexOf("edges_index");
-            this._nodeFieldCount = meta.node_fields.length;
-
-            this._nodeTypes = meta.node_types[this._nodeTypeOffset];
-            this._nodeHiddenType = this._nodeTypes.indexOf("hidden");
-            this._nodeObjectType = this._nodeTypes.indexOf("object");
-            this._nodeNativeType = this._nodeTypes.indexOf("native");
-            this._nodeCodeType = this._nodeTypes.indexOf("code");
-            this._nodeSyntheticType = this._nodeTypes.indexOf("synthetic");
-
-            this._edgeFieldsCount = meta.edge_fields.length;
-            this._edgeTypeOffset = meta.edge_fields.indexOf("type");
-            this._edgeNameOffset = meta.edge_fields.indexOf("name_or_index");
-            this._edgeToNodeOffset = meta.edge_fields.indexOf("to_node");
-
-            this._edgeTypes = meta.edge_types[this._edgeTypeOffset];
-            this._edgeTypes.push("invisible");
-            this._edgeElementType = this._edgeTypes.indexOf("element");
-            this._edgeHiddenType = this._edgeTypes.indexOf("hidden");
-            this._edgeInternalType = this._edgeTypes.indexOf("internal");
-            this._edgeShortcutType = this._edgeTypes.indexOf("shortcut");
-            this._edgeWeakType = this._edgeTypes.indexOf("weak");
-            this._edgeInvisibleType = this._edgeTypes.indexOf("invisible");
-        } else {
-            this._rootNodeIndex = 1; // First cell contained metadata, now we should skip it.
-            this._nodeTypeOffset = meta.fields.indexOf("type");
-            this._nodeNameOffset = meta.fields.indexOf("name");
-            this._nodeIdOffset = meta.fields.indexOf("id");
-            this._nodeSelfSizeOffset = meta.fields.indexOf("self_size");
-            this._nodeRetainedSizeOffset = meta.fields.indexOf("retained_size");
-            this._dominatorOffset = meta.fields.indexOf("dominator");
-            this._edgesCountOffset = meta.fields.indexOf("children_count");
-            // After splitting nodes and edges we store first edge index in the field
-            // where edges count is stored in the raw snapshot. Here we create an alias
-            // for the field.
-            this._firstEdgeIndexOffset = this._edgesCountOffset;
-            this._firstEdgeOffset = meta.fields.indexOf("children");
-            this._nodeFieldCount = this._firstEdgeOffset;
-            this._nodeTypes = meta.types[this._nodeTypeOffset];
-            this._nodeHiddenType = this._nodeTypes.indexOf("hidden");
-            this._nodeObjectType = this._nodeTypes.indexOf("object");
-            this._nodeNativeType = this._nodeTypes.indexOf("native");
-            this._nodeCodeType = this._nodeTypes.indexOf("code");
-            this._nodeSyntheticType = this._nodeTypes.indexOf("synthetic");
-            var edgesMeta = meta.types[this._firstEdgeOffset];
-            this._edgeFieldsCount = edgesMeta.fields.length;
-            this._edgeTypeOffset = edgesMeta.fields.indexOf("type");
-            this._edgeNameOffset = edgesMeta.fields.indexOf("name_or_index");
-            this._edgeToNodeOffset = edgesMeta.fields.indexOf("to_node");
-            this._edgeTypes = edgesMeta.types[this._edgeTypeOffset];
-            this._edgeElementType = this._edgeTypes.indexOf("element");
-            this._edgeHiddenType = this._edgeTypes.indexOf("hidden");
-            this._edgeInternalType = this._edgeTypes.indexOf("internal");
-            this._edgeShortcutType = this._edgeTypes.indexOf("shortcut");
-            this._edgeWeakType = this._edgeTypes.indexOf("weak");
-            this._edgeInvisibleType = this._edgeTypes.length;
-            this._edgeTypes.push("invisible");
-        }
+        this._rootNodeIndex = 0;
+
+        this._nodeTypeOffset = meta.node_fields.indexOf("type");
+        this._nodeNameOffset = meta.node_fields.indexOf("name");
+        this._nodeIdOffset = meta.node_fields.indexOf("id");
+        this._nodeSelfSizeOffset = meta.node_fields.indexOf("self_size");
+        this._nodeRetainedSizeOffset = meta.node_fields.indexOf("retained_size");
+        this._dominatorOffset = meta.node_fields.indexOf("dominator");
+        this._firstEdgeIndexOffset = meta.node_fields.indexOf("edges_index");
+        this._nodeFieldCount = meta.node_fields.length;
+
+        this._nodeTypes = meta.node_types[this._nodeTypeOffset];
+        this._nodeHiddenType = this._nodeTypes.indexOf("hidden");
+        this._nodeObjectType = this._nodeTypes.indexOf("object");
+        this._nodeNativeType = this._nodeTypes.indexOf("native");
+        this._nodeCodeType = this._nodeTypes.indexOf("code");
+        this._nodeSyntheticType = this._nodeTypes.indexOf("synthetic");
+
+        this._edgeFieldsCount = meta.edge_fields.length;
+        this._edgeTypeOffset = meta.edge_fields.indexOf("type");
+        this._edgeNameOffset = meta.edge_fields.indexOf("name_or_index");
+        this._edgeToNodeOffset = meta.edge_fields.indexOf("to_node");
+
+        this._edgeTypes = meta.edge_types[this._edgeTypeOffset];
+        this._edgeTypes.push("invisible");
+        this._edgeElementType = this._edgeTypes.indexOf("element");
+        this._edgeHiddenType = this._edgeTypes.indexOf("hidden");
+        this._edgeInternalType = this._edgeTypes.indexOf("internal");
+        this._edgeShortcutType = this._edgeTypes.indexOf("shortcut");
+        this._edgeWeakType = this._edgeTypes.indexOf("weak");
+        this._edgeInvisibleType = this._edgeTypes.indexOf("invisible");
 
         this._nodeFlags = { // bit flags
             canBeQueried: 1,
             detachedDOMTreeNode: 2,
         };
 
-        if (meta.separate_edges) {
-            this.nodeCount = this._onlyNodes.length / this._nodeFieldCount;
-            this._edgeCount = this._containmentEdges.length / this._edgeFieldsCount;
-        } else {
-            this._splitNodesAndContainmentEdges();
-            this._rootNodeIndex = 0;
-        }
+        this.nodeCount = this._nodes.length / this._nodeFieldCount;
+        this._edgeCount = this._containmentEdges.length / this._edgeFieldsCount;
 
         this._markInvisibleEdges();
         this._buildRetainers();
@@ -763,86 +721,6 @@ WebInspector.HeapSnapshot.prototype = {
         this._calculateObjectToWindowDistance();
     },
 
-    _splitNodesAndContainmentEdges: function()
-    {
-        // Estimate number of nodes.
-        var totalEdgeCount = 0;
-        var totalNodeCount = 0;
-        for (var index = this._rootNodeIndex; index < this._nodes.length; ) {
-            ++totalNodeCount;
-            var edgesCount = this._nodes[index + this._edgesCountOffset];
-            totalEdgeCount += edgesCount;
-            index += this._firstEdgeOffset + edgesCount * this._edgeFieldsCount;
-        }
-        this.nodeCount = totalNodeCount;
-        this._edgeCount = totalEdgeCount;
-        this._createOnlyNodesArray();
-        this._createContainmentEdgesArray();
-        delete this._nodes;
-    },
-
-    _createOnlyNodesArray: function()
-    {
-        // Copy nodes to their own array.
-        this._onlyNodes = new Uint32Array(this.nodeCount * this._nodeFieldCount);
-        var dstIndex = 0;
-        var srcIndex = this._rootNodeIndex;
-        while (srcIndex < this._nodes.length) {
-            var srcNodeTypeIndex = srcIndex + this._nodeTypeOffset;
-            var currentDstIndex = dstIndex;
-            var edgesCount = this._nodes[srcIndex + this._edgesCountOffset];
-            for (var i = 0; i < this._nodeFieldCount; i++)
-                this._onlyNodes[dstIndex++] = this._nodes[srcIndex++];
-            // Write new node index into the type field.
-            this._nodes[srcNodeTypeIndex] = currentDstIndex;
-            srcIndex += edgesCount * this._edgeFieldsCount;
-        }
-        // Translate dominator indexes.
-        for (var dominatorSlotIndex = this._dominatorOffset; dominatorSlotIndex < this._onlyNodes.length; dominatorSlotIndex += this._nodeFieldCount) {
-            var dominatorIndex = this._onlyNodes[dominatorSlotIndex];
-            this._onlyNodes[dominatorSlotIndex] = this._nodes[dominatorIndex + this._nodeTypeOffset];
-        }
-    },
-
-    _createContainmentEdgesArray: function()
-    {
-        // Copy edges to their own array.
-        var containmentEdges = this._containmentEdges = new Uint32Array(this._edgeCount * this._edgeFieldsCount);
-
-        // Peload fields into local variables for better performance.
-        var nodes = this._nodes;
-        var onlyNodes = this._onlyNodes;
-        var firstEdgeIndexOffset = this._firstEdgeIndexOffset;
-        var edgeFieldsCount = this._edgeFieldsCount;
-        var edgeToNodeOffset = this._edgeToNodeOffset;
-        var edgesCountOffset = this._edgesCountOffset;
-        var nodeTypeOffset = this._nodeTypeOffset;
-        var firstEdgeOffset = this._firstEdgeOffset;
-
-        var edgeArrayIndex = 0;
-        var srcIndex = this._rootNodeIndex;
-        while (srcIndex < nodes.length) {
-            var srcNodeNewIndex = nodes[srcIndex + nodeTypeOffset];
-            // Set index of first outgoing egde in the _containmentEdges array.
-            onlyNodes[srcNodeNewIndex + firstEdgeIndexOffset] = edgeArrayIndex;
-
-            // Now copy all edge information.
-            var edgesCount = nodes[srcIndex + edgesCountOffset];
-            srcIndex += firstEdgeOffset;
-            var nextNodeIndex = srcIndex + edgesCount * edgeFieldsCount;
-            while (srcIndex < nextNodeIndex) {
-                containmentEdges[edgeArrayIndex] = nodes[srcIndex];
-                // Translate destination node indexes for the copied edges.
-                if (edgeArrayIndex % edgeFieldsCount === edgeToNodeOffset) {
-                    var toNodeIndex = containmentEdges[edgeArrayIndex];
-                    containmentEdges[edgeArrayIndex] = nodes[toNodeIndex + nodeTypeOffset];
-                }
-                ++edgeArrayIndex;
-                ++srcIndex;
-            }
-        }
-    },
-
     _buildRetainers: function()
     {
         var retainingNodes = this._retainingNodes = new Uint32Array(this._edgeCount);
@@ -855,7 +733,7 @@ WebInspector.HeapSnapshot.prototype = {
         var edgeFieldsCount = this._edgeFieldsCount;
         var nodeFieldCount = this._nodeFieldCount;
         var edgeToNodeOffset = this._edgeToNodeOffset;
-        var onlyNodes = this._onlyNodes;
+        var nodes = this._nodes;
         var firstEdgeIndexOffset = this._firstEdgeIndexOffset;
 
         for (var toNodeFieldIndex = edgeToNodeOffset, l = containmentEdges.length; toNodeFieldIndex < l; toNodeFieldIndex += edgeFieldsCount) {
@@ -873,13 +751,13 @@ WebInspector.HeapSnapshot.prototype = {
         firstRetainerIndex[this.nodeCount] = retainingNodes.length;
 
         var srcNodeIndex = 0;
-        var nextNodeFirstEdgeIndex = onlyNodes[firstEdgeIndexOffset];
-        var onlyNodesLength = onlyNodes.length;
-        while (srcNodeIndex < onlyNodesLength) {
+        var nextNodeFirstEdgeIndex = nodes[firstEdgeIndexOffset];
+        var nodesLength = nodes.length;
+        while (srcNodeIndex < nodesLength) {
             var firstEdgeIndex = nextNodeFirstEdgeIndex;
             var nextNodeIndex = srcNodeIndex + nodeFieldCount;
-            nextNodeFirstEdgeIndex = nextNodeIndex < onlyNodesLength
-                                   ? onlyNodes[nextNodeIndex + firstEdgeIndexOffset]
+            nextNodeFirstEdgeIndex = nextNodeIndex < nodesLength
+                                   ? nodes[nextNodeIndex + firstEdgeIndexOffset]
                                    : containmentEdges.length;
             for (var edgeIndex = firstEdgeIndex; edgeIndex < nextNodeFirstEdgeIndex; edgeIndex += edgeFieldsCount) {
                 var toNodeIndex = containmentEdges[edgeIndex + edgeToNodeOffset];
@@ -947,7 +825,7 @@ WebInspector.HeapSnapshot.prototype = {
 
     _flagsOfNode: function(node)
     {
-        return this._flags[node.nodeIndex];
+        return this._flags[node.nodeIndex / this._nodeFieldCount];
     },
 
     /**
@@ -1017,29 +895,29 @@ WebInspector.HeapSnapshot.prototype = {
 
     _calculateObjectToWindowDistance: function()
     {
-        this._distancesToWindow = new Array(this.nodeCount);
+        var nodeFieldCount = this._nodeFieldCount;
+        var distances = new Uint32Array(this.nodeCount);
 
         // bfs for Window roots
         var list = [];
         for (var iter = this.rootNode.edges; iter.hasNext(); iter.next()) {
             var node = iter.edge.node;
             if (node.isWindow) {
-                if (node.nodeIndex % this._nodeFieldCount)
-                    throw new Error("Invalid nodeIndex: " + node.nodeIndex);
                 list.push(node.nodeIndex);
-                this._distancesToWindow[node.nodeIndex] = 0;
+                distances[node.nodeIndex / nodeFieldCount] = 0;
             }
         }
-        this._bfs(list);
+        this._bfs(list, distances);
 
         // bfs for root
         list = [];
         list.push(this._rootNodeIndex);
-        this._distancesToWindow[this._rootNodeIndex] = 0;
-        this._bfs(list);
+        distances[this._rootNodeIndex / nodeFieldCount] = 0;
+        this._bfs(list, distances);
+        this._distancesToWindow = distances;
     },
 
-    _bfs: function(list)
+    _bfs: function(list, distances)
     {
         // Peload fields into local variables for better performance.
         var edgeFieldsCount = this._edgeFieldsCount;
@@ -1047,29 +925,28 @@ WebInspector.HeapSnapshot.prototype = {
         var nodeFieldCount = this._nodeFieldCount;
         var firstEdgeIndexOffset = this._firstEdgeIndexOffset;
         var edgeToNodeOffset = this._edgeToNodeOffset;
-        var distancesToWindow = this._distancesToWindow;
-        var onlyNodes = this._onlyNodes;
+        var nodes = this._nodes;
+        var nodeCount = this.nodeCount;
 
         var index = 0;
         while (index < list.length) {
             var nodeIndex = list[index++]; // shift generates too much garbage.
+            var nodeOrdinal = nodeIndex / nodeFieldCount;
             if (index > 100000) {
                 list = list.slice(index);
                 index = 0;
             }
-            var distance = distancesToWindow[nodeIndex] + 1;
-
-            var firstEdgeIndex = onlyNodes[nodeIndex + firstEdgeIndexOffset];
-            var edgesEnd = nodeIndex < onlyNodes.length
-                         ? onlyNodes[nodeIndex + nodeFieldCount + firstEdgeIndexOffset]
+            var distance = distances[nodeOrdinal] + 1;
+            var firstEdgeIndex = nodes[nodeIndex + firstEdgeIndexOffset];
+            var edgesEnd = nodeOrdinal < nodeCount - 1
+                         ? nodes[nodeIndex + firstEdgeIndexOffset + nodeFieldCount]
                          : containmentEdges.length;
             for (var edgeToNodeIndex = firstEdgeIndex + edgeToNodeOffset; edgeToNodeIndex < edgesEnd; edgeToNodeIndex += edgeFieldsCount) {
                 var childNodeIndex = containmentEdges[edgeToNodeIndex];
-                if (childNodeIndex % nodeFieldCount)
-                    throw new Error("Invalid childNodeIndex: " + childNodeIndex);
-                if (childNodeIndex in distancesToWindow)
+                var childNodeOrdinal = childNodeIndex / nodeFieldCount;
+                if (distances[childNodeOrdinal])
                     continue;
-                distancesToWindow[childNodeIndex] = distance;
+                distances[childNodeOrdinal] = distance;
                 list.push(childNodeIndex);
             }
         }
@@ -1079,8 +956,8 @@ WebInspector.HeapSnapshot.prototype = {
     {
         var aggregates = {};
         var aggregatesByClassName = {};
-        var onlyNodes = this._onlyNodes;
-        var onlyNodesLength = onlyNodes.length;
+        var nodes = this._nodes;
+        var nodesLength = nodes.length;
         var nodeNativeType = this._nodeNativeType;
         var nodeFieldsCount = this._nodeFieldCount;
         var selfSizeOffset = this._nodeSelfSizeOffset;
@@ -1088,12 +965,13 @@ WebInspector.HeapSnapshot.prototype = {
         var node = new WebInspector.HeapSnapshotNode(this, this._rootNodeIndex);
         var distancesToWindow = this._distancesToWindow;
 
-        for (var nodeIndex = this._rootNodeIndex; nodeIndex < onlyNodesLength; nodeIndex += nodeFieldsCount) {
+        for (var nodeIndex = this._rootNodeIndex; nodeIndex < nodesLength; nodeIndex += nodeFieldsCount) {
+            var nodeOrdinal = nodeIndex / nodeFieldsCount;
             node.nodeIndex = nodeIndex;
-            var selfSize = onlyNodes[nodeIndex + selfSizeOffset];
+            var selfSize = nodes[nodeIndex + selfSizeOffset];
             if (filter && !filter(node))
                 continue;
-            if (!selfSize && onlyNodes[nodeIndex + nodeTypeOffset] !== nodeNativeType)
+            if (!selfSize && nodes[nodeIndex + nodeTypeOffset] !== nodeNativeType)
                 continue;
             var classIndex = node.classIndex;
             if (!(classIndex in aggregates)) {
@@ -1101,7 +979,7 @@ WebInspector.HeapSnapshot.prototype = {
                 var nameMatters = nodeType === "object" || nodeType === "native";
                 var value = {
                     count: 1,
-                    distanceToWindow: distancesToWindow[nodeIndex],
+                    distanceToWindow: distancesToWindow[nodeOrdinal],
                     self: selfSize,
                     maxRet: 0,
                     type: nodeType,
@@ -1112,7 +990,7 @@ WebInspector.HeapSnapshot.prototype = {
                 aggregatesByClassName[node.className] = value;
             } else {
                 var clss = aggregates[classIndex];
-                clss.distanceToWindow = Math.min(clss.distanceToWindow, distancesToWindow[nodeIndex]);
+                clss.distanceToWindow = Math.min(clss.distanceToWindow, distancesToWindow[nodeOrdinal]);
                 ++clss.count;
                 clss.self += selfSize;
                 clss.idxs.push(nodeIndex);
@@ -1137,7 +1015,7 @@ WebInspector.HeapSnapshot.prototype = {
         var nodeTypeOffset = this._nodeTypeOffset;
         var nodeNativeType = this._nodeNativeType;
         var dominatedNodes = this._dominatedNodes;
-        var onlyNodes = this._onlyNodes;
+        var nodes = this._nodes;
         var firstDominatedNodeIndex = this._firstDominatedNodeIndex;
 
         while (list.length) {
@@ -1151,7 +1029,7 @@ WebInspector.HeapSnapshot.prototype = {
 
             if (!seen &&
                 (!filter || filter(node)) &&
-                (node.selfSize || onlyNodes[nodeIndex + nodeTypeOffset] === nodeNativeType)
+                (node.selfSize || nodes[nodeIndex + nodeTypeOffset] === nodeNativeType)
                ) {
                 aggregates[classIndex].maxRet += node.retainedSize;
                 if (dominatedIndexFrom !== dominatedIndexTo) {
@@ -1198,8 +1076,8 @@ WebInspector.HeapSnapshot.prototype = {
 
         // Count the number of dominated nodes for each node. Skip the root (node at
         // index 0) as it is the only node that dominates itself.
-        for (var nodeIndex = this._nodeFieldCount; nodeIndex < this._onlyNodes.length; nodeIndex += this._nodeFieldCount) {
-            var dominatorIndex = this._onlyNodes[nodeIndex + this._dominatorOffset];
+        for (var nodeIndex = this._nodeFieldCount; nodeIndex < this._nodes.length; nodeIndex += this._nodeFieldCount) {
+            var dominatorIndex = this._nodes[nodeIndex + this._dominatorOffset];
             if (dominatorIndex % this._nodeFieldCount)
                 throw new Error("Wrong dominatorIndex " + dominatorIndex + " nodeIndex = " + nodeIndex + " nodeCount = " + this.nodeCount);
             ++indexArray[dominatorIndex / this._nodeFieldCount];
@@ -1215,8 +1093,8 @@ WebInspector.HeapSnapshot.prototype = {
         indexArray[this.nodeCount] = dominatedNodes.length;
         // Fill up the dominatedNodes array with indexes of dominated nodes. Skip the root (node at
         // index 0) as it is the only node that dominates itself.
-        for (var nodeIndex = this._nodeFieldCount; nodeIndex < this._onlyNodes.length; nodeIndex += this._nodeFieldCount) {
-            var dominatorIndex = this._onlyNodes[nodeIndex + this._dominatorOffset];
+        for (var nodeIndex = this._nodeFieldCount; nodeIndex < this._nodes.length; nodeIndex += this._nodeFieldCount) {
+            var dominatorIndex = this._nodes[nodeIndex + this._dominatorOffset];
             if (dominatorIndex % this._nodeFieldCount)
                 throw new Error("Wrong dominatorIndex " + dominatorIndex);
             var dominatorPos = dominatorIndex / this._nodeFieldCount;
@@ -1277,7 +1155,7 @@ WebInspector.HeapSnapshot.prototype = {
             var node = iter.edge.node;
             if (node.isDetachedDOMTree) {
                 for (var edgesIter = node.edges; edgesIter.hasNext(); edgesIter.next())
-                    this._flags[edgesIter.edge.node.nodeIndex] |= flag;
+                    this._flags[edgesIter.edge.node.nodeIndex / this._nodeFieldCount] |= flag;
             }
         }
     },
@@ -1288,43 +1166,50 @@ WebInspector.HeapSnapshot.prototype = {
         // via regular properties, and for DOM wrappers. Trying to access random objects
         // can cause a crash due to insonsistent state of internal properties of wrappers.
         var flag = this._nodeFlags.canBeQueried;
+        var hiddenEdgeType = this._edgeHiddenType;
+        var internalEdgeType = this._edgeInternalType;
+        var invisibleEdgeType = this._edgeInvisibleType;
+        var edgeToNodeOffset = this._edgeToNodeOffset;
+        var edgeTypeOffset = this._edgeTypeOffset;
+        var edgeFieldsCount = this._edgeFieldsCount;
+        var containmentEdges = this._containmentEdges;
+        var nodes = this._nodes;
+        var nodeCount = this.nodeCount;
+        var nodeFieldCount = this._nodeFieldCount;
+        var firstEdgeIndexOffset = this._firstEdgeIndexOffset;
 
+        var flags = this._flags;
         var list = [];
         for (var iter = this.rootNode.edges; iter.hasNext(); iter.next()) {
             if (iter.edge.node.isWindow)
                 list.push(iter.edge.node.nodeIndex);
         }
 
-        var edge = new WebInspector.HeapSnapshotEdge(this, undefined);
-        var node = new WebInspector.HeapSnapshotNode(this);
         while (list.length) {
             var nodeIndex = list.pop();
-            if (this._flags[nodeIndex] & flag)
+            var nodeOrdinal = nodeIndex / nodeFieldCount;
+            if (flags[nodeOrdinal] & flag)
                 continue;
-            node.nodeIndex = nodeIndex;
-            this._flags[nodeIndex] |= flag;
-            var edgesCount = node.edgesCount;
-            edge._edges = node.rawEdges;
-            for (var j = 0; j < edgesCount; ++j) {
-                edge.edgeIndex = j * this._edgeFieldsCount;
-                nodeIndex = edge.nodeIndex;
-                if (this._flags[nodeIndex] & flag)
+            flags[nodeOrdinal] |= flag;
+            var beginEdgeIndex = nodes[nodeIndex + firstEdgeIndexOffset];
+            var endEdgeIndex = nodeOrdinal < nodeCount - 1
+                               ? nodes[nodeIndex + firstEdgeIndexOffset + nodeFieldCount]
+                               : containmentEdges.length;
+            for (var edgeIndex = beginEdgeIndex; edgeIndex < endEdgeIndex; edgeIndex += edgeFieldsCount) {
+                var childNodeIndex = containmentEdges[edgeIndex + edgeToNodeOffset];
+                if (flags[childNodeIndex / nodeFieldCount] & flag)
                     continue;
-                if (edge.isHidden || edge.isInvisible)
+                var type = containmentEdges[edgeIndex + edgeTypeOffset];
+                if (type === hiddenEdgeType || type === invisibleEdgeType || type === internalEdgeType)
                     continue;
-                if (edge.isInternal)
-                    continue;
-                var name = edge.name;
-                if (!name)
-                    continue;
-                list.push(nodeIndex);
+                list.push(childNodeIndex);
             }
         }
     },
 
     _calculateFlags: function()
     {
-        this._flags = new Array(this.nodeCount);
+        this._flags = new Uint32Array(this.nodeCount);
         this._markDetachedDOMTreeNodes();
         this._markQueriableHeapObjects();
     },
@@ -1408,6 +1293,36 @@ WebInspector.HeapSnapshot.prototype = {
         return diff;
     },
 
+    _nodeForSnapshotObjectId: function(snapshotObjectId)
+    {
+        for (var it = this._allNodes; it.hasNext(); it.next()) {
+            if (it.node.id === snapshotObjectId)
+                return it.node;
+        }
+        return null;
+    },
+
+    nodeClassName: function(snapshotObjectId)
+    {
+        var node = this._nodeForSnapshotObjectId(snapshotObjectId);
+        if (node)
+            return node.className;
+        return null;
+    },
+
+    dominatorIdsForNode: function(snapshotObjectId)
+    {
+        var node = this._nodeForSnapshotObjectId(snapshotObjectId);
+        if (!node)
+            return null;
+        var result = [];
+        while (!node.isRoot) {
+            result.push(node.id);
+            node.nodeIndex = node.dominatorIndex;
+        }
+        return result;
+    },
+
     _parseFilter: function(filter)
     {
         if (!filter)
@@ -1469,7 +1384,7 @@ WebInspector.HeapSnapshotFilteredOrderedIterator = function(iterator, filter, un
     this._iterationOrder = null;
     this._position = 0;
     this._currentComparator = null;
-    this._lastComparator = null;
+    this._sortedPrefixLength = 0;
 }
 
 WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
@@ -1557,28 +1472,50 @@ WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
         ++this._position;
     },
 
-    serializeSubsequentItems: function(count)
+    /**
+     * @param {number} begin
+     * @param {number} end
+     */
+    serializeItemsRange: function(begin, end)
     {
         this._createIterationOrder();
+        if (begin > end)
+            throw new Error("Start position > end position: " + begin + " > " + end);
+        if (end >= this._iterationOrder.length)
+            end = this._iterationOrder.length;
+        if (this._sortedPrefixLength < end) {
+            this.sort(this._currentComparator, this._sortedPrefixLength, this._iterationOrder.length - 1, end - this._sortedPrefixLength);
+            this._sortedPrefixLength = end;
+        }
+
+        this._position = begin;
+        var startPosition = this._position;
+        var count = end - begin;
         var result = new Array(count);
-        if (this._lastComparator !== this._currentComparator)
-            this.sort(this._currentComparator, this._position, this._iterationOrder.length - 1, count);
         for (var i = 0 ; i < count && this.hasNext(); ++i, this.next())
-            result[i] = this._serialize(this.item);
+            result[i] = this.serializeItem(this.item);
         result.length = i;
-        result.hasNext = this.hasNext();
         result.totalLength = this._iterationOrder.length;
+
+        result.startPosition = startPosition;
+        result.endPosition = this._position;
         return result;
     },
 
+    sortAll: function()
+    {
+        this._createIterationOrder();
+        if (this._sortedPrefixLength === this._iterationOrder.length)
+            return;
+        this.sort(this._currentComparator, this._sortedPrefixLength, this._iterationOrder.length - 1, this._iterationOrder.length);
+        this._sortedPrefixLength = this._iterationOrder.length;
+    },
+
     sortAndRewind: function(comparator)
     {
-        this._lastComparator = this._currentComparator;
         this._currentComparator = comparator;
-        var result = this._lastComparator !== this._currentComparator;
-        if (result)
-            this.first();
-        return result;
+        this._sortedPrefixLength = 0;
+        this.first();
     }
 }
 
@@ -1598,12 +1535,12 @@ WebInspector.HeapSnapshotEdgesProvider = function(snapshot, filter, edgesIter)
 }
 
 WebInspector.HeapSnapshotEdgesProvider.prototype = {
-    _serialize: function(edge)
+    serializeItem: function(edge)
     {
         return {
             name: edge.name,
             propertyAccessor: edge.toString(),
-            node: WebInspector.HeapSnapshotNodesProvider.prototype._serialize(edge.node),
+            node: WebInspector.HeapSnapshotNodesProvider.prototype.serializeItem(edge.node),
             nodeIndex: edge.nodeIndex,
             type: edge.type,
             distanceToWindow: edge.node.distanceToWindow
@@ -1693,7 +1630,23 @@ WebInspector.HeapSnapshotNodesProvider = function(snapshot, filter, nodeIndexes)
 }
 
 WebInspector.HeapSnapshotNodesProvider.prototype = {
-    _serialize: function(node)
+    nodePosition: function(snapshotObjectId)
+    {
+        this._createIterationOrder();
+        if (this.isEmpty)
+            return -1;
+        this.sortAll();
+
+        var node = new WebInspector.HeapSnapshotNode(this.snapshot);
+        for (var i = 0; i < this._iterationOrder.length; i++) {
+            node.nodeIndex = this._iterationOrder[i];
+            if (node.id === snapshotObjectId)
+                return i;
+        }
+        return -1;
+    },
+
+    serializeItem: function(node)
     {
         return {
             id: node.id,
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotDataGrids.js b/Source/WebCore/inspector/front-end/HeapSnapshotDataGrids.js
index 2f823c404..b779e6eb4 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotDataGrids.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotDataGrids.js
@@ -40,6 +40,10 @@ WebInspector.HeapSnapshotSortableDataGrid = function(columns)
      * @type {number}
      */
     this._recursiveSortingDepth = 0;
+    /**
+     * @type {WebInspector.HeapSnapshotGridNode}
+     */
+    this._highlightedNode = null;
     this.addEventListener("sorting changed", this.sortingChanged, this);
 }
 
@@ -70,6 +74,37 @@ WebInspector.HeapSnapshotSortableDataGrid.prototype = {
         return this.rootNode().children;
     },
 
+    /**
+     * @param {ProfilerAgent.HeapSnapshotObjectId} heapSnapshotObjectId
+     */
+    highlightObjectByHeapSnapshotId: function(heapSnapshotObjectId)
+    {
+    },
+
+    /**
+     * @param {WebInspector.HeapSnapshotGridNode} node
+     */
+    highlightNode: function(node)
+    {
+        this._clearCurrentHighlight();
+        this._highlightedNode = node;
+        this._highlightedNode.element.addStyleClass("highlighted-row");
+    },
+
+    nodeWasDetached: function(node)
+    {
+        if (this._highlightedNode === node)
+            this._clearCurrentHighlight();
+    },
+
+    _clearCurrentHighlight: function()
+    {
+        if (!this._highlightedNode)
+            return
+        this._highlightedNode.element.removeStyleClass("highlighted-row");
+        this._highlightedNode = null;
+    },
+
     changeNameFilter: function(filter)
     {
         filter = filter.toLowerCase();
@@ -166,6 +201,10 @@ WebInspector.HeapSnapshotViewportDataGrid = function(columns)
     this._topLevelNodes = [];
     this._topPadding = new WebInspector.HeapSnapshotPaddingNode();
     this._bottomPadding = new WebInspector.HeapSnapshotPaddingNode();
+    /**
+     * @type {WebInspector.HeapSnapshotGridNode}
+     */
+    this._nodeToHighlightAfterScroll = null;
 }
 
 WebInspector.HeapSnapshotViewportDataGrid.prototype = {
@@ -233,6 +272,16 @@ WebInspector.HeapSnapshotViewportDataGrid.prototype = {
         this._topLevelNodes = [];
     },
 
+    /**
+     * @override
+     * @param {WebInspector.HeapSnapshotGridNode} node
+     */
+    highlightNode: function(node)
+    {
+        node.element.scrollIntoViewIfNeeded(true);
+        this._nodeToHighlightAfterScroll = node;
+    },
+
     _addPaddingRows: function(top, bottom)
     {
         if (this._topPadding.element.parentNode !== this.dataTableBody)
@@ -257,6 +306,11 @@ WebInspector.HeapSnapshotViewportDataGrid.prototype = {
     _onScroll: function(event)
     {
         this.updateVisibleNodes();
+
+        if (this._nodeToHighlightAfterScroll) {
+            WebInspector.HeapSnapshotSortableDataGrid.prototype.highlightNode.call(this, this._nodeToHighlightAfterScroll);
+            this._nodeToHighlightAfterScroll = null;
+        }
     }
 }
 
@@ -371,6 +425,8 @@ WebInspector.HeapSnapshotConstructorsDataGrid = function()
     WebInspector.HeapSnapshotViewportDataGrid.call(this, columns);
     this._profileIndex = -1;
     this._topLevelNodes = [];
+
+    this._objectIdToSelect = null;
 }
 
 WebInspector.HeapSnapshotConstructorsDataGrid.prototype = {
@@ -385,12 +441,42 @@ WebInspector.HeapSnapshotConstructorsDataGrid.prototype = {
         }[sortColumn];
     },
 
+    /**
+     * @override
+     * @param {ProfilerAgent.HeapSnapshotObjectId} id
+     */
+    highlightObjectByHeapSnapshotId: function(id)
+    {
+        if (!this.snapshot) {
+            this._objectIdToSelect = id;
+            return;
+        }
+
+        function didGetClassName(className)
+        {
+            var constructorNodes = this.topLevelNodes();
+            for (var i = 0; i < constructorNodes.length; i++) {
+                var parent = constructorNodes[i];
+                if (parent._name === className) {
+                    parent.revealNodeBySnapshotObjectId(parseInt(id, 10));
+                    return;
+                }
+            }
+        }
+        this.snapshot.nodeClassName(parseInt(id, 10), didGetClassName.bind(this));
+    },
+
     setDataSource: function(snapshotView, snapshot)
     {
         this.snapshotView = snapshotView;
         this.snapshot = snapshot;
         if (this._profileIndex === -1)
             this._populateChildren();
+
+        if (this._objectIdToSelect) {
+            this.highlightObjectByHeapSnapshotId(this._objectIdToSelect);
+            this._objectIdToSelect = null;
+        }
     },
 
     _populateChildren: function()
@@ -529,6 +615,7 @@ WebInspector.HeapSnapshotDominatorsDataGrid = function()
         retainedSize: { title: WebInspector.UIString("Retained Size"), width: "120px", sort: "descending", sortable: true }
     };
     WebInspector.HeapSnapshotSortableDataGrid.call(this, columns);
+    this._objectIdToSelect = null;
 }
 
 WebInspector.HeapSnapshotDominatorsDataGrid.prototype = {
@@ -549,11 +636,55 @@ WebInspector.HeapSnapshotDominatorsDataGrid.prototype = {
         var fakeNode = { nodeIndex: this.snapshot.rootNodeIndex };
         this.setRootNode(new WebInspector.HeapSnapshotDominatorObjectNode(this, fakeNode));
         this.rootNode().sort();
+
+        if (this._objectIdToSelect) {
+            this.highlightObjectByHeapSnapshotId(this._objectIdToSelect);
+            this._objectIdToSelect = null;
+        }
     },
 
     sortingChanged: function()
     {
         this.rootNode().sort();
+    },
+
+    /**
+     * @override
+     * @param {ProfilerAgent.HeapSnapshotObjectId} id
+     */
+    highlightObjectByHeapSnapshotId: function(id)
+    {
+        if (!this.snapshot) {
+            this._objectIdToSelect = id;
+            return;
+        }
+
+        function didGetDominators(dominatorIds)
+        {
+            if (!dominatorIds) {
+                WebInspector.log(WebInspector.UIString("Cannot find corresponding heap snapshot node"));
+                return;
+            }
+            var dominatorNode = this.rootNode();
+            expandNextDominator.call(this, dominatorIds, dominatorNode);
+        }
+
+        function expandNextDominator(dominatorIds, dominatorNode)
+        {
+            if (!dominatorNode) {
+                console.error("Cannot find dominator node");
+                return;
+            }
+            if (!dominatorIds.length) {
+                this.highlightNode(dominatorNode);
+                dominatorNode.element.scrollIntoViewIfNeeded(true);
+                return;
+            }
+            var snapshotObjectId = dominatorIds.pop();
+            dominatorNode.retrieveChildBySnapshotObjectId(snapshotObjectId, expandNextDominator.bind(this, dominatorIds));
+        }
+
+        this.snapshot.dominatorIdsForNode(parseInt(id, 10), didGetDominators.bind(this));
     }
 };
 
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotGridNodes.js b/Source/WebCore/inspector/front-end/HeapSnapshotGridNodes.js
index 64d8f6828..ef260bcd9 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotGridNodes.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotGridNodes.js
@@ -44,6 +44,13 @@ WebInspector.HeapSnapshotGridNode = function(tree, hasChildren, provider)
     this._provider = provider;
     this._dataGrid = tree;
     this._instanceCount = 0;
+
+    this._savedChildren = null;
+    /**
+     * List of position ranges for all visible nodes: [startPos1, endPos1),...,[startPosN, endPosN)
+     * Position is an item position in the provider.
+     */
+    this._retrievedChildrenRanges = [];
     this.addEventListener("populate", this._populate, this);
 }
 
@@ -77,11 +84,36 @@ WebInspector.HeapSnapshotGridNode.prototype = {
     {
     },
 
+    /**
+     * @override
+     */
+    wasDetached: function()
+    {
+        this._dataGrid.nodeWasDetached(this);
+    },
+
     _toPercentString: function(num)
     {
         return num.toFixed(0) + "\u2009%"; // \u2009 is a thin space.
     },
 
+    /**
+     * @param {number} nodePosition
+     */
+    childForPosition: function(nodePosition)
+    {
+        var indexOfFirsChildInRange = 0;
+        for (var i = 0; i < this._retrievedChildrenRanges.length; i++) {
+           var range = this._retrievedChildrenRanges[i];
+           if (range.from <= nodePosition && nodePosition < range.to) {
+               var childIndex = indexOfFirsChildInRange + nodePosition - range.from;
+               return this.children[childIndex];
+           }
+           indexOfFirsChildInRange += range.to - range.from + 1;
+        }
+        return null;
+    },
+
     _createValueCell: function(columnIdentifier)
     {
         var cell = document.createElement("td");
@@ -106,92 +138,170 @@ WebInspector.HeapSnapshotGridNode.prototype = {
     _populate: function(event)
     {
         this.removeEventListener("populate", this._populate, this);
-        function sorted(ignored)
+        function sorted()
         {
             this._populateChildren();
         }
         this._provider.sortAndRewind(this.comparator(), sorted.bind(this));
     },
 
+    expandWithoutPopulate: function(callback)
+    {
+        // Make sure default _populate won't be invoked.
+        this.removeEventListener("populate", this._populate, this);
+        this.expand();
+        this._provider.sortAndRewind(this.comparator(), callback);
+    },
+
     /**
-     * @param {?number} howMany
-     * @param {?number} atIndex
+     * @param {?number} fromPosition
+     * @param {?number} toPosition
      */
-    _populateChildren: function(howMany, atIndex, afterPopulate)
-    {
-        howMany = howMany || this._dataGrid.defaultPopulateCount();
-        atIndex = atIndex || this.children.length;
-        var haveSavedChildren = !!this._savedChildren;
-        if (haveSavedChildren) {
-            haveSavedChildren = false;
-            for (var c in this._savedChildren) {
-                haveSavedChildren = true;
-                break;
+    _populateChildren: function(fromPosition, toPosition, afterPopulate)
+    {
+        fromPosition = fromPosition || 0;
+        toPosition = toPosition || fromPosition + this._dataGrid.defaultPopulateCount();
+        var firstNotSerializedPosition = fromPosition;
+        function serializeNextChunk()
+        {
+            if (firstNotSerializedPosition >= toPosition)
+                return;
+            var end = Math.min(firstNotSerializedPosition + this._dataGrid.defaultPopulateCount(), toPosition);
+            this._provider.serializeItemsRange(firstNotSerializedPosition, end, childrenRetrieved.bind(this));
+            firstNotSerializedPosition = end;
+        }
+        function insertRetrievedChild(item, insertionIndex)
+        {
+            if (this._savedChildren) {
+                var hash = this._childHashForEntity(item);
+                if (hash in this._savedChildren) {
+                    this.insertChild(this._savedChildren[hash], insertionIndex);
+                    return;
+                }
             }
+            this.insertChild(this._createChildNode(item), insertionIndex);
         }
-
-        var part = 0;
-        function callSerialize()
+        function insertShowMoreButton(from, to, insertionIndex)
         {
-            if (part >= howMany)
-                return;
-            part += this._dataGrid.defaultPopulateCount();
-            this._provider.serializeSubsequentItems(this._dataGrid.defaultPopulateCount(), childrenRetrieved.bind(this));
+            var button = new WebInspector.ShowMoreDataGridNode(this._populateChildren.bind(this), from, to, this._dataGrid.defaultPopulateCount());
+            this.insertChild(button, insertionIndex);
         }
         function childrenRetrieved(items)
         {
-            var length = items.totalLength;
-            for (var i = 0, l = items.length; i < l; ++i) {
-                var item = items[i];
-                if (haveSavedChildren) {
-                    var hash = this._childHashForEntity(item);
-                    if (hash in this._savedChildren) {
-                        this.insertChild(this._savedChildren[hash], atIndex++);
-                        continue;
+            var itemIndex = 0;
+            var itemPosition = items.startPosition;
+            var insertionIndex = 0;
+
+            if (!this._retrievedChildrenRanges.length) {
+                if (items.startPosition > 0) {
+                    this._retrievedChildrenRanges.push({from: 0, to: 0});
+                    insertShowMoreButton.call(this, 0, items.startPosition, insertionIndex++);
+                }
+                this._retrievedChildrenRanges.push({from: items.startPosition, to: items.endPosition});
+                for (var i = 0, l = items.length; i < l; ++i)
+                    insertRetrievedChild.call(this, items[i], insertionIndex++);
+                if (items.endPosition < items.totalLength)
+                    insertShowMoreButton.call(this, items.endPosition, items.totalLength, insertionIndex++);
+            } else {
+                var rangeIndex = 0;
+                var found = false;
+                var range;
+                while (rangeIndex < this._retrievedChildrenRanges.length) {
+                    range = this._retrievedChildrenRanges[rangeIndex];
+                    if (range.to >= itemPosition) {
+                        found = true;
+                        break;
+                    }
+                    insertionIndex += range.to - range.from;
+                    // Skip the button if there is one.
+                    if (range.to < items.totalLength)
+                        insertionIndex += 1;
+                    ++rangeIndex;
+                }
+
+                if (!found || items.startPosition < range.from) {
+                    // Update previous button.
+                    this.children[insertionIndex - 1].setEndPosition(items.startPosition);
+                    insertShowMoreButton.call(this, items.startPosition, found ? range.from : items.totalLength, insertionIndex);
+                    range = {from: items.startPosition, to: items.startPosition};
+                    if (!found)
+                        rangeIndex = this._retrievedChildrenRanges.length;
+                    this._retrievedChildrenRanges.splice(rangeIndex, 0, range);
+                } else {
+                    insertionIndex += itemPosition - range.from;
+                }
+                // At this point insertionIndex is always an index before button or between nodes.
+                // Also it is always true here that range.from <= itemPosition <= range.to
+
+                // Stretch the range right bound to include all new items.
+                while (range.to < items.endPosition) {
+                    // Skip already added nodes.
+                    var skipCount = range.to - itemPosition;
+                    insertionIndex += skipCount;
+                    itemIndex += skipCount;
+                    itemPosition = range.to;
+
+                    // We're at the position before button: ...<?node>x<button>
+                    var nextRange = this._retrievedChildrenRanges[rangeIndex + 1];
+                    var newEndOfRange = nextRange ? nextRange.from : items.totalLength;
+                    if (newEndOfRange > items.endPosition)
+                        newEndOfRange = items.endPosition;
+                    while (itemPosition < newEndOfRange) {
+                        insertRetrievedChild.call(this, items[itemIndex++], insertionIndex++);
+                        ++itemPosition;
+                    }
+                    // Merge with the next range.
+                    if (nextRange && newEndOfRange === nextRange.from) {
+                        range.to = nextRange.to;
+                        // Remove "show next" button if there is one.
+                        this.removeChild(this.children[insertionIndex]);
+                        this._retrievedChildrenRanges.splice(rangeIndex + 1, 1);
+                    } else {
+                        range.to = newEndOfRange;
+                        // Remove or update next button.
+                        if (newEndOfRange === items.totalLength)
+                            this.removeChild(this.children[insertionIndex]);
+                        else
+                            this.children[insertionIndex].setStartPosition(items.endPosition);
                     }
                 }
-                this.insertChild(this._createChildNode(item), atIndex++);
             }
+
+            // TODO: fix this.
             this._instanceCount += items.length;
-            if (part < howMany) {
-                setTimeout(callSerialize.bind(this), 0);
+            if (firstNotSerializedPosition < toPosition) {
+                serializeNextChunk.call(this);
                 return;
             }
 
-            if (items.hasNext)
-                this.insertChild(new WebInspector.ShowMoreDataGridNode(this._populateChildren.bind(this), this._dataGrid.defaultPopulateCount(), length), atIndex++);
             if (afterPopulate)
                 afterPopulate();
-            function notify()
-            {
-                this.dispatchEventToListeners("populate complete");
-            }
-            setTimeout(notify.bind(this), 0);
+            this.dispatchEventToListeners("populate complete");
         }
-        setTimeout(callSerialize.bind(this), 0);
+        serializeNextChunk.call(this);
     },
 
     _saveChildren: function()
     {
-        this._savedChildren = {};
+        this._savedChildren = null;
         for (var i = 0, childrenCount = this.children.length; i < childrenCount; ++i) {
             var child = this.children[i];
-            if (child.expanded)
-                this._savedChildren[this._childHashForNode(child)] = child;
+            if (!child.expanded)
+                continue;
+            if (!this._savedChildren)
+                this._savedChildren = {};
+            this._savedChildren[this._childHashForNode(child)] = child;
         }
     },
 
     sort: function()
     {
         this._dataGrid.recursiveSortingEnter();
-        function afterSort(sorted)
+        function afterSort()
         {
-            if (!sorted) {
-                this._dataGrid.recursiveSortingLeave();
-                return;
-            }
             this._saveChildren();
             this.removeChildren();
+            this._retrievedChildrenRanges = [];
 
             function afterPopulate()
             {
@@ -204,8 +314,9 @@ WebInspector.HeapSnapshotGridNode.prototype = {
             }
             var instanceCount = this._instanceCount;
             this._instanceCount = 0;
-            this._populateChildren(instanceCount, null, afterPopulate.bind(this));
+            this._populateChildren(0, instanceCount, afterPopulate.bind(this));
         }
+
         this._provider.sortAndRewind(this.comparator(), afterSort.bind(this));
     }
 };
@@ -339,7 +450,7 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
                 else
                     callback(WebInspector.RemoteObject.fromPrimitiveValue(WebInspector.UIString("Not available")));
             }
-            ProfilerAgent.getObjectByHeapObjectId(this.snapshotNodeId, objectGroupName, formatResult);
+            ProfilerAgent.getObjectByHeapObjectId(String(this.snapshotNodeId), objectGroupName, formatResult);
         }
     },
 
@@ -612,6 +723,36 @@ WebInspector.HeapSnapshotConstructorNode = function(tree, className, aggregate,
 }
 
 WebInspector.HeapSnapshotConstructorNode.prototype = {
+    /**
+     * @param {number} snapshotObjectId
+     */
+    revealNodeBySnapshotObjectId: function(snapshotObjectId)
+    {
+        function didGetNodePosition(nodePosition)
+        {
+            if (nodePosition !== -1)
+                this._populateChildren(nodePosition, null, didPopulateChildren.bind(this, nodePosition));
+        }
+
+        function didPopulateChildren(nodePosition)
+        {
+            var indexOfFirsChildInRange = 0;
+            for (var i = 0; i < this._retrievedChildrenRanges.length; i++) {
+               var range = this._retrievedChildrenRanges[i];
+               if (range.from <= nodePosition && nodePosition < range.to) {
+                   var childIndex = indexOfFirsChildInRange + nodePosition - range.from;
+                   var instanceNode = this.children[childIndex];
+                   this._dataGrid.highlightNode(instanceNode);
+                   return;
+               }
+               indexOfFirsChildInRange += range.to - range.from + 1;
+            }
+        }
+
+        this.expand();
+        this._provider.nodePosition(snapshotObjectId, didGetNodePosition.bind(this));
+    },
+
     createCell: function(columnIdentifier)
     {
         var cell = columnIdentifier !== "object" ? this._createValueCell(columnIdentifier) : WebInspector.HeapSnapshotGridNode.prototype.createCell.call(this, columnIdentifier);
@@ -693,7 +834,6 @@ WebInspector.HeapSnapshotDiffNodesProvider = function(addedNodesProvider, delete
     this._deletedNodesProvider = deletedNodesProvider;
     this._addedCount = addedCount;
     this._removedCount = removedCount;
-    this._serializedItemsCount = 0;
 }
 
 WebInspector.HeapSnapshotDiffNodesProvider.prototype = {
@@ -708,22 +848,23 @@ WebInspector.HeapSnapshotDiffNodesProvider.prototype = {
         callback(false);
     },
 
-    serializeSubsequentItems: function(count, callback)
+    serializeItemsRange: function(beginPosition, endPosition, callback)
     {
         function didReceiveAllItems(items)
         {
-            this._serializedItemsCount += items.length;
             items.totalLength = this._addedCount + this._removedCount;
             callback(items);
         }
 
         function didReceiveDeletedItems(addedItems, items)
         {
+            if (!addedItems.length)
+                addedItems.startPosition = this._addedCount + items.startPosition;
             for (var i = 0; i < items.length; i++) {
                 items[i].isAddedNotRemoved = false;
                 addedItems.push(items[i]);
             }
-            addedItems.hasNext = items.hasNext;
+            addedItems.endPosition = this._addedCount + items.endPosition;
             didReceiveAllItems.call(this, addedItems);
         }
 
@@ -731,26 +872,22 @@ WebInspector.HeapSnapshotDiffNodesProvider.prototype = {
         {
             for (var i = 0; i < items.length; i++)
                 items[i].isAddedNotRemoved = true;
-            if (items.length < count)
-                return this._deletedNodesProvider.serializeSubsequentItems(count - items.length, didReceiveDeletedItems.bind(this, items));
+            if (items.endPosition < endPosition)
+                return this._deletedNodesProvider.serializeItemsRange(0, endPosition - items.endPosition, didReceiveDeletedItems.bind(this, items));
 
             items.totalLength = this._addedCount + this._removedCount;
-            if (!items.hasNext)
-                items.hasNext = !!this._removedCount;
             didReceiveAllItems.call(this, items);
         }
 
-        if (this._serializedItemsCount < this._addedCount)
-            this._addedNodesProvider.serializeSubsequentItems(count, didReceiveAddedItems.bind(this));
+        if (beginPosition < this._addedCount)
+            this._addedNodesProvider.serializeItemsRange(beginPosition, endPosition, didReceiveAddedItems.bind(this));
         else
-            this._deletedNodesProvider.serializeSubsequentItems(count, didReceiveDeletedItems.bind(this, []));
+            this._deletedNodesProvider.serializeItemsRange(beginPosition - this._addedCount, endPosition - this._addedCount, didReceiveDeletedItems.bind(this, []));
     },
 
     sortAndRewind: function(comparator, callback)
     {
-        this._serializedItemsCount = 0;
-
-        function afterSort(ignored)
+        function afterSort()
         {
             this._deletedNodesProvider.sortAndRewind(comparator, callback);
         }
@@ -859,6 +996,35 @@ WebInspector.HeapSnapshotDominatorObjectNode = function(tree, node)
 };
 
 WebInspector.HeapSnapshotDominatorObjectNode.prototype = {
+    /**
+     * @param {number} snapshotObjectId
+     * @param {function(?WebInspector.HeapSnapshotDominatorObjectNode)} callback
+     */
+    retrieveChildBySnapshotObjectId: function(snapshotObjectId, callback)
+    {
+        function didExpand()
+        {
+            this._provider.nodePosition(snapshotObjectId, didGetNodePosition.bind(this));
+        }
+
+        function didGetNodePosition(nodePosition)
+        {
+            if (nodePosition === -1) {
+                this.collapse();
+                callback(null);
+            } else
+                this._populateChildren(nodePosition, null, didPopulateChildren.bind(this, nodePosition));
+        }
+
+        function didPopulateChildren(nodePosition)
+        {
+            var child = this.childForPosition(nodePosition);
+            callback(child);
+        }
+
+        this.expandWithoutPopulate(didExpand.bind(this));
+    },
+
     _createChildNode: function(item)
     {
         return new WebInspector.HeapSnapshotDominatorObjectNode(this._dataGrid, item);
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js b/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js
index 89ce4b258..c3ba4677c 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js
@@ -147,26 +147,9 @@ WebInspector.HeapSnapshotLoader.prototype = {
             if (bracketIndex === -1)
                 return;
             this._json = this._json.slice(bracketIndex + 1);
-            if (this._snapshot.snapshot.meta) {
-                var node_fields_count = this._snapshot.snapshot.meta.node_fields.length;
-                var nodes_length = this._snapshot.snapshot.node_count * node_fields_count;
-                this._array = new WebInspector.Uint32Array(nodes_length);
-                this._snapshot.snapshot.meta.separate_edges = true;
-                this._state = "parse-nodes";
-            } else {
-                this._state = "parse-nodes-meta-info";
-            }
-            this.pushJSONChunk("");
-            break;
-        }
-        case "parse-nodes-meta-info": {
-            var closingBracketIndex = this._findBalancedCurlyBrackets();
-            if (closingBracketIndex === -1)
-                return;
-            this._snapshot.snapshot.meta = JSON.parse(this._json.slice(0, closingBracketIndex));
-            this._json = this._json.slice(closingBracketIndex);
-            this._array = new WebInspector.Uint32Array();
-            this._array.push(0);
+            var node_fields_count = this._snapshot.snapshot.meta.node_fields.length;
+            var nodes_length = this._snapshot.snapshot.node_count * node_fields_count;
+            this._array = new WebInspector.Uint32Array(nodes_length);
             this._state = "parse-nodes";
             this.pushJSONChunk("");
             break;
@@ -174,13 +157,8 @@ WebInspector.HeapSnapshotLoader.prototype = {
         case "parse-nodes": {
             if (this._parseUintArray())
                 return;
-            if (this._snapshot.snapshot.meta.separate_edges) {
-                this._snapshot.onlyNodes = this._array.array;
-                this._state = "find-edges";
-            } else {
-                this._snapshot.nodes = this._array.array;
-                this._state = "find-strings";
-            }
+            this._snapshot.nodes = this._array.array;
+            this._state = "find-edges";
             this._array = null;
             this.pushJSONChunk("");
             break;
@@ -204,7 +182,7 @@ WebInspector.HeapSnapshotLoader.prototype = {
         case "parse-edges": {
             if (this._parseUintArray())
                 return;
-            this._snapshot.containmentEdges = this._array.array;
+            this._snapshot.edges = this._array.array;
             this._array = null;
             this._state = "find-strings";
             this.pushJSONChunk("");
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
index 2bc4e04c4..63bfbe1d9 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
@@ -78,11 +78,55 @@ WebInspector.HeapSnapshotRealWorker.prototype.__proto__ = WebInspector.HeapSnaps
 
 /**
  * @constructor
+ */
+WebInspector.AsyncTaskQueue = function()
+{
+    this._queue = [];
+    this._isTimerSheduled = false;
+}
+
+WebInspector.AsyncTaskQueue.prototype = {
+    /**
+     * @param {function()} task
+     */
+    addTask: function(task)
+    {
+        this._queue.push(task);
+        this._scheduleTimer();
+    },
+
+    _onTimeout: function()
+    {
+        this._isTimerSheduled = false;
+        var queue = this._queue;
+        this._queue = [];
+        for (var i = 0; i < queue.length; i++) {
+            try {
+                queue[i]();
+            } catch (e) {
+                console.error("Exception while running task: " + e.stack);
+            }
+        }
+        this._scheduleTimer();
+    },
+
+    _scheduleTimer: function()
+    {
+        if (this._queue.length && !this._isTimerSheduled) {
+            setTimeout(this._onTimeout.bind(this), 0);
+            this._isTimerSheduled = true;
+        }
+    }
+}
+
+/**
+ * @constructor
  * @extends {WebInspector.HeapSnapshotWorkerWrapper}
  */
 WebInspector.HeapSnapshotFakeWorker = function()
 {
     this._dispatcher = new WebInspector.HeapSnapshotWorkerDispatcher(window, this._postMessageFromWorker.bind(this));
+    this._asyncTaskQueue = new WebInspector.AsyncTaskQueue();
 }
 
 WebInspector.HeapSnapshotFakeWorker.prototype = {
@@ -93,7 +137,7 @@ WebInspector.HeapSnapshotFakeWorker.prototype = {
             if (this._dispatcher)
                 this._dispatcher.dispatchMessage({data: message});
         }
-        setTimeout(dispatch.bind(this), 0);
+        this._asyncTaskQueue.addTask(dispatch.bind(this));
     },
 
     terminate: function()
@@ -107,7 +151,7 @@ WebInspector.HeapSnapshotFakeWorker.prototype = {
         {
             this.dispatchEventToListeners("message", message);
         }
-        setTimeout(send.bind(this), 0);
+        this._asyncTaskQueue.addTask(send.bind(this));
     }
 };
 
@@ -300,57 +344,44 @@ WebInspector.HeapSnapshotProxyObject.prototype = {
 WebInspector.HeapSnapshotLoaderProxy = function(worker, objectId)
 {
     WebInspector.HeapSnapshotProxyObject.call(this, worker, objectId);
-    this._loading = false;
-    this._loaded = false;
+    this._onLoadCallbacks = [];
 }
 
 WebInspector.HeapSnapshotLoaderProxy.prototype = {
+    /**
+     * @param {function(WebInspector.HeapSnapshotProxy)} callback
+     */
     finishLoading: function(callback)
     {
-        if (!this._loading)
-            return false;
-        var loadCallbacks = this._onLoadCallbacks;
-        loadCallbacks.splice(0, 0, callback);
-        delete this._onLoadCallbacks;
-        this._loading = false;
-        this._loaded = true;
-        var self = this;
+        this._onLoadCallbacks.unshift(callback);
+
         function updateStaticData(snapshotProxy)
         {
             this.dispose();
-            snapshotProxy.updateStaticData(this._callLoadCallbacks.bind(this, loadCallbacks));
+            snapshotProxy.updateStaticData(callLoadCallbacks.bind(this));
+        }
+        function callLoadCallbacks(snapshotProxy)
+        {
+            for (var i = 0; i < this._onLoadCallbacks.length; ++i)
+                this._onLoadCallbacks[i](snapshotProxy);
+            this._onLoadCallbacks = null;
         }
         this.callFactoryMethod(updateStaticData.bind(this), "finishLoading", "WebInspector.HeapSnapshotProxy");
-        return true;
-    },
-
-    _callLoadCallbacks: function(loadCallbacks, snapshotProxy)
-    {
-        for (var i = 0; i < loadCallbacks.length; ++i)
-            loadCallbacks[i](snapshotProxy);
-    },
-
-    get loaded()
-    {
-        return this._loaded;
     },
 
+    /**
+     * @param {function(WebInspector.HeapSnapshotProxy)} callback
+     * @return {boolean}
+     */
     startLoading: function(callback)
     {
-        if (!this._loading) {
-            this._onLoadCallbacks = [callback];
-            this._loading = true;
-            return true;
-        } else {
-            this._onLoadCallbacks.push(callback);
-            return false;
-        }
+        var loadingHasJustStarted = !this._onLoadCallbacks.length;
+        this._onLoadCallbacks.push(callback);
+        return loadingHasJustStarted;
     },
 
     pushJSONChunk: function(chunk)
     {
-        if (!this._loading)
-            return;
         this.callMethod(null, "pushJSONChunk", chunk);
     }
 };
@@ -382,6 +413,16 @@ WebInspector.HeapSnapshotProxy.prototype = {
         this.callMethod(callback, "calculateSnapshotDiff", baseSnapshotId, baseSnapshotAggregates);
     },
 
+    nodeClassName: function(snapshotObjectId, callback)
+    {
+        this.callMethod(callback, "nodeClassName", snapshotObjectId);
+    },
+
+    dominatorIdsForNode: function(nodeIndex, callback)
+    {
+        this.callMethod(callback, "dominatorIdsForNode", nodeIndex);
+    },
+
     createEdgesProvider: function(nodeIndex, filter)
     {
         return this.callFactoryMethod(null, "createEdgesProvider", "WebInspector.HeapSnapshotProviderProxy", nodeIndex, filter);
@@ -422,16 +463,6 @@ WebInspector.HeapSnapshotProxy.prototype = {
         this.disposeWorker();
     },
 
-    finishLoading: function()
-    {
-        return false;
-    },
-
-    get loaded()
-    {
-        return !!this._objectId;
-    },
-
     get nodeCount()
     {
         return this._staticData.nodeCount;
@@ -457,12 +488,6 @@ WebInspector.HeapSnapshotProxy.prototype = {
         this.callMethod(dataReceived.bind(this), "updateStaticData");
     },
 
-    startLoading: function(callback)
-    {
-        setTimeout(callback.bind(null, this), 0);
-        return false;
-    },
-
     get totalSize()
     {
         return this._staticData.totalSize;
@@ -486,14 +511,19 @@ WebInspector.HeapSnapshotProviderProxy = function(worker, objectId)
 }
 
 WebInspector.HeapSnapshotProviderProxy.prototype = {
+    nodePosition: function(snapshotObjectId, callback)
+    {
+        this.callMethod(callback, "nodePosition", snapshotObjectId);
+    },
+
     isEmpty: function(callback)
     {
         this.callGetter(callback, "isEmpty");
     },
 
-    serializeSubsequentItems: function(count, callback)
+    serializeItemsRange: function(startPosition, endPosition, callback)
     {
-        this.callMethod(callback, "serializeSubsequentItems", count);
+        this.callMethod(callback, "serializeItemsRange", startPosition, endPosition);
     },
 
     sortAndRewind: function(comparator, callback)
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotView.js b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
index 9becab3ae..7d878625d 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotView.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
@@ -135,9 +135,9 @@ WebInspector.HeapSnapshotView = function(parent, profile)
 
     this._popoverHelper = new WebInspector.ObjectPopoverHelper(this.element, this._getHoverAnchor.bind(this), this._resolveObjectForPopover.bind(this), undefined, true);
 
-    this._loadProfile(this._profileUid, profileCallback.bind(this));
+    this.profile.load(profileCallback.bind(this));
 
-    function profileCallback()
+    function profileCallback(heapSnapshotProxy)
     {
         var list = this._profiles();
         var profileIndex;
@@ -152,16 +152,16 @@ WebInspector.HeapSnapshotView = function(parent, profile)
             this.baseSelectElement.selectedIndex = profileIndex - 1;
         else
             this.baseSelectElement.selectedIndex = profileIndex;
-        this.dataGrid.setDataSource(this, this.profileWrapper);
+        this.dataGrid.setDataSource(this, heapSnapshotProxy);
     }
 }
 
 WebInspector.HeapSnapshotView.prototype = {
     dispose: function()
     {
-        this.profileWrapper.dispose();
+        this.profile.dispose();
         if (this.baseProfile)
-            this.baseProfileWrapper.dispose();
+            this.baseProfile.dispose();
         this.containmentDataGrid.dispose();
         this.constructorsDataGrid.dispose();
         this.diffDataGrid.dispose();
@@ -179,31 +179,19 @@ WebInspector.HeapSnapshotView.prototype = {
         return this.parent.getProfile(WebInspector.HeapSnapshotProfileType.TypeId, this._profileUid);
     },
 
-    get profileWrapper()
-    {
-        return this.profile._proxy;
-    },
-
     get baseProfile()
     {
         return this.parent.getProfile(WebInspector.HeapSnapshotProfileType.TypeId, this._baseProfileUid);
     },
 
-    get baseProfileWrapper()
-    {
-        return this.baseProfile._proxy;
-    },
-
     wasShown: function()
     {
-        if (!this.profileWrapper.loaded)
-            this._loadProfile(this._profileUid, profileCallback1.bind(this));
-        else
-            profileCallback1.call(this);
+        // FIXME: load base and current snapshots in parallel
+        this.profile.load(profileCallback1.bind(this));
 
         function profileCallback1() {
-            if (this.baseProfile && !this.baseProfileWrapper.loaded)
-                this._loadProfile(this._baseProfileUid, profileCallback2.bind(this));
+            if (this.baseProfile)
+                this.baseProfile.load(profileCallback2.bind(this));
             else
                 profileCallback2.call(this);
         }
@@ -257,7 +245,7 @@ WebInspector.HeapSnapshotView.prototype = {
         this._searchFinishedCallback = finishedCallback;
 
         function matchesByName(gridNode) {
-            return ("name" in gridNode) && gridNode.name.hasSubstring(query, true);
+            return ("_name" in gridNode) && gridNode._name.hasSubstring(query, true);
         }
 
         function matchesById(gridNode) {
@@ -370,7 +358,9 @@ WebInspector.HeapSnapshotView.prototype = {
 
         this._baseProfileUid = this._profiles()[this.baseSelectElement.selectedIndex].uid;
         var dataGrid = /** @type {WebInspector.HeapSnapshotDiffDataGrid} */ this.dataGrid;
-        this._loadProfile(this._baseProfileUid, dataGrid.setBaseDataSource.bind(dataGrid));
+        // Change set base data source only if main data source is already set.
+        if (dataGrid.snapshot)
+            this.baseProfile.load(dataGrid.setBaseDataSource.bind(dataGrid));
 
         if (!this.currentQuery || !this._searchFinishedCallback || !this._searchResults)
             return;
@@ -420,11 +410,6 @@ WebInspector.HeapSnapshotView.prototype = {
         return WebInspector.panels.profiles.getProfiles(WebInspector.HeapSnapshotProfileType.TypeId);
     },
 
-    _loadProfile: function(profileUid, callback)
-    {
-        WebInspector.panels.profiles.loadHeapSnapshot(profileUid, callback);
-    },
-
     isDetailedSnapshot: function(snapshot)
     {
         var s = new WebInspector.HeapSnapshot(snapshot);
@@ -452,7 +437,7 @@ WebInspector.HeapSnapshotView.prototype = {
     _inspectedObjectChanged: function(event)
     {
         var selectedNode = event.target.selectedNode;
-        if (selectedNode instanceof WebInspector.HeapSnapshotGenericObjectNode)
+        if (!this.profile.fromFile() && selectedNode instanceof WebInspector.HeapSnapshotGenericObjectNode)
             ConsoleAgent.addInspectedHeapObject(selectedNode.snapshotNodeId);
     },
 
@@ -499,6 +484,33 @@ WebInspector.HeapSnapshotView.prototype = {
         this._changeView({target: {selectedIndex: viewIndex}});
     },
 
+    _updateDataSourceAndView: function()
+    {
+        var dataGrid = this.dataGrid;
+        if (dataGrid.snapshotView)
+            return;
+
+        this.profile.load(didLoadSnapshot.bind(this));
+        function didLoadSnapshot(snapshotProxy)
+        {
+            if (this.dataGrid !== dataGrid)
+                return;
+            if (dataGrid.snapshot !== snapshotProxy)
+                dataGrid.setDataSource(this, snapshotProxy);
+            if (dataGrid === this.diffDataGrid) {
+                if (!this._baseProfileUid)
+                    this._baseProfileUid = this._profiles()[this.baseSelectElement.selectedIndex].uid;
+                this.baseProfile.load(didLoadBaseSnaphot.bind(this));
+            }
+        }
+
+        function didLoadBaseSnaphot(baseSnapshotProxy)
+        {
+            if (this.diffDataGrid.baseSnapshot !== baseSnapshotProxy)
+                this.diffDataGrid.setBaseDataSource(baseSnapshotProxy);
+        }
+    },
+
     _changeView: function(event)
     {
         if (!event || !this._profileUid)
@@ -515,17 +527,12 @@ WebInspector.HeapSnapshotView.prototype = {
         this.refreshVisibleData();
         this.dataGrid.updateWidths();
 
-        if (this.currentView === this.diffView) {
+        if (this.currentView === this.diffView)
             this.baseSelectElement.removeStyleClass("hidden");
-            if (!this.dataGrid.snapshotView) {
-                this._changeBase();
-                this.dataGrid.setDataSource(this, this.profileWrapper);
-            }
-        } else {
+        else
             this.baseSelectElement.addStyleClass("hidden");
-            if (!this.dataGrid.snapshotView)
-                this.dataGrid.setDataSource(this, this.profileWrapper);
-        }
+
+        this._updateDataSourceAndView();
 
         if (this.currentView === this.constructorsView)
             this.filterSelectElement.removeStyleClass("hidden");
@@ -559,6 +566,8 @@ WebInspector.HeapSnapshotView.prototype = {
 
     _resolveObjectForPopover: function(element, showCallback, objectGroupName)
     {
+        if (this.profile.fromFile())
+            return;
         element.node.queryObjectContent(showCallback, objectGroupName);
     },
 
@@ -688,7 +697,10 @@ WebInspector.HeapSnapshotView.prototype = {
             this.filterSelectElement.appendChild(filterOption);
         }
 
+        if (this.profile.fromFile())
+            return;
         for (var i = this.filterSelectElement.length - 1, n = list.length; i < n; ++i) {
+            var profile = list[i];
             var filterOption = document.createElement("option");
             var title = list[i].title;
             if (!title.indexOf(UserInitiatedProfileName)) {
@@ -724,9 +736,14 @@ WebInspector.HeapSnapshotProfileType.prototype = {
         return WebInspector.UIString("Take heap snapshot.");
     },
 
+    /**
+     * @override
+     * @return {boolean}
+     */
     buttonClicked: function()
     {
         WebInspector.panels.profiles.takeHeapSnapshot();
+        return false;
     },
 
     get treeItemTitle()
@@ -751,11 +768,13 @@ WebInspector.HeapSnapshotProfileType.prototype = {
 
     /**
      * @override
+     * @param {string=} title
      * @return {WebInspector.ProfileHeader}
      */
-    createTemporaryProfile: function()
+    createTemporaryProfile: function(title)
     {
-        return new WebInspector.ProfileHeader(WebInspector.HeapSnapshotProfileType.TypeId, WebInspector.UIString("Snapshotting\u2026"));
+        title = title || WebInspector.UIString("Snapshotting\u2026");
+        return new WebInspector.HeapProfileHeader(title);
     },
 
     /**
@@ -765,7 +784,7 @@ WebInspector.HeapSnapshotProfileType.prototype = {
      */
     createProfile: function(profile)
     {
-        return new WebInspector.HeapProfileHeader(profile.typeId, profile.title, profile.uid, profile.maxJSObjectId || 0);
+        return new WebInspector.HeapProfileHeader(profile.title, profile.uid, profile.maxJSObjectId || 0);
     }
 }
 
@@ -774,51 +793,70 @@ WebInspector.HeapSnapshotProfileType.prototype.__proto__ = WebInspector.ProfileT
 /**
  * @constructor
  * @extends {WebInspector.ProfileHeader}
- * @param {string} profileType
  * @param {string} title
- * @param {number} uid
- * @param {number} maxJSObjectId
+ * @param {number=} uid
+ * @param {number=} maxJSObjectId
  */
-WebInspector.HeapProfileHeader = function(profileType, title, uid, maxJSObjectId)
+WebInspector.HeapProfileHeader = function(title, uid, maxJSObjectId)
 {
-    WebInspector.ProfileHeader.call(this, profileType, title, uid);
+    WebInspector.ProfileHeader.call(this, WebInspector.HeapSnapshotProfileType.TypeId, title, uid);
     this.maxJSObjectId = maxJSObjectId;
-    this._loaded = false;
+    /**
+     * @type {WebInspector.HeapSnapshotLoaderProxy}
+     */
+    this._loaderProxy = null;
+    /**
+     * @type {WebInspector.HeapSnapshotProxy}
+     */
+    this._snapshotProxy = null;
     this._totalNumberOfChunks = 0;
 }
 
 WebInspector.HeapProfileHeader.prototype = {
+    snapshotProxy: function()
+    {
+        return this._snapshotProxy;
+    },
+
     /**
      * @override
      * @param {function(WebInspector.HeapSnapshotProxy):void} callback
      */
     load: function(callback)
     {
-        if (this._loaded) {
-            callback(this._proxy);
+        if (this._snapshotProxy) {
+            callback(this._snapshotProxy);
             return;
         }
 
-        if (!this._proxy) {
-            function setProfileWait(event) {
-                this.sidebarElement.wait = event.data;
-            }
-            var worker = new WebInspector.HeapSnapshotWorker();
-            worker.addEventListener("wait", setProfileWait, this);
-            this._proxy = worker.createObject("WebInspector.HeapSnapshotLoader");
-        }
+        if (!this._loaderProxy)
+            this._setupWorker();
 
-        if (this._proxy.startLoading(callback)) {
+        if (this._loaderProxy.startLoading(callback)) {
             this.sidebarElement.subtitle = WebInspector.UIString("Loading\u2026");
             this.sidebarElement.wait = true;
-            function done()
-            {
-                this._loaded = true;
-            }
-            ProfilerAgent.getProfile(this.typeId, this.uid, done.bind(this));
+            ProfilerAgent.getProfile(this.typeId, this.uid);
         }
     },
 
+    _setupWorker: function()
+    {
+        function setProfileWait(event) {
+            this.sidebarElement.wait = event.data;
+        }
+        var worker = new WebInspector.HeapSnapshotWorker();
+        worker.addEventListener("wait", setProfileWait, this);
+        this._loaderProxy = worker.createObject("WebInspector.HeapSnapshotLoader");
+    },
+
+    dispose: function()
+    {
+        if (this._loaderProxy)
+            this._loaderProxy.dispose();
+        else if (this._snapshotProxy)
+            this._snapshotProxy.dispose();
+    },
+
     /**
      * @param {WebInspector.Event} event
      */
@@ -827,12 +865,12 @@ WebInspector.HeapProfileHeader.prototype = {
         if (event.data !== this._fileName)
             return;
         if (++this._savedChunksCount === this._totalNumberOfChunks) {
-            this.sidebarElement.subtitle = Number.bytesToString(this._proxy.totalSize);
+            this.sidebarElement.subtitle = Number.bytesToString(this._snapshotProxy.totalSize);
             this.sidebarElement.wait = false;
             this._savedChunksCount = 0;
             WebInspector.fileManager.removeEventListener(WebInspector.FileManager.EventTypes.AppendedToURL, this._saveStatusUpdate, this);
         } else
-            this.sidebarElement.subtitle = WebInspector.UIString("Saving\u2026 %d\%", Math.floor(this._savedChunksCount * 100 / this._totalNumberOfChunks));
+            this.sidebarElement.subtitle = WebInspector.UIString("Saving\u2026 %d\%", (this._savedChunksCount * 100 / this._totalNumberOfChunks).toFixed(2));
     },
 
     /**
@@ -840,12 +878,12 @@ WebInspector.HeapProfileHeader.prototype = {
      */
     pushJSONChunk: function(chunk)
     {
-        if (this._loaded) {
+        if (this._loaderProxy) {
+            ++this._totalNumberOfChunks;
+            this._loaderProxy.pushJSONChunk(chunk);
+        } else {
             this.sidebarElement.wait = true;
             WebInspector.fileManager.append(this._fileName, chunk);
-        } else {
-            ++this._totalNumberOfChunks;
-            this._proxy.pushJSONChunk(chunk);
         }
     },
 
@@ -853,13 +891,15 @@ WebInspector.HeapProfileHeader.prototype = {
     {
         function parsed(snapshotProxy)
         {
-            this._proxy = snapshotProxy;
+            this._loaderProxy = null;
+            this._snapshotProxy = snapshotProxy;
             this.sidebarElement.subtitle = Number.bytesToString(snapshotProxy.totalSize);
             this.sidebarElement.wait = false;
             var worker = /** @type {WebInspector.HeapSnapshotWorker} */ snapshotProxy.worker;
+            this.isTemporary = false;
             worker.startCheckingForLongRunningCalls();
         }
-        if (this._proxy.finishLoading(parsed.bind(this)))
+        if (this._loaderProxy.finishLoading(parsed.bind(this)))
             this.sidebarElement.subtitle = WebInspector.UIString("Parsing\u2026");
     },
 
@@ -867,34 +907,105 @@ WebInspector.HeapProfileHeader.prototype = {
      * @override
      * @return {boolean}
      */
-    canSave: function()
+    canSaveToFile: function()
     {
-        return this._loaded && !this._savedChunksCount && WebInspector.fileManager.canAppend();
+        return !this.fromFile() && this._snapshotProxy && !this._savedChunksCount && WebInspector.fileManager.canAppend();
     },
 
     /**
      * @override
      */
-    save: function()
+    saveToFile: function()
     {
         /**
          * @param {WebInspector.Event} event
          */
-        function startWritingSnapshot(event)
+        function startSavingSnapshot(event)
         {
             if (event.data !== this._fileName)
                 return;
             this.sidebarElement.wait = true;
             this.sidebarElement.subtitle = WebInspector.UIString("Saving\u2026 %d\%", 0);
             this._savedChunksCount = 0;
-            WebInspector.fileManager.removeEventListener(WebInspector.FileManager.EventTypes.SavedURL, startWritingSnapshot, this);
+            WebInspector.fileManager.removeEventListener(WebInspector.FileManager.EventTypes.SavedURL, startSavingSnapshot, this);
             WebInspector.fileManager.addEventListener(WebInspector.FileManager.EventTypes.AppendedToURL, this._saveStatusUpdate, this);
             ProfilerAgent.getProfile(this.typeId, this.uid);
         }
 
-        this._fileName = this._fileName || "Heap-" + new Date().toISO8601Compact() + ".json";
-        WebInspector.fileManager.addEventListener(WebInspector.FileManager.EventTypes.SavedURL, startWritingSnapshot, this);
+        this._fileName = this._fileName || "Heap-" + new Date().toISO8601Compact() + ".heapsnapshot";
+        WebInspector.fileManager.addEventListener(WebInspector.FileManager.EventTypes.SavedURL, startSavingSnapshot, this);
         WebInspector.fileManager.save(this._fileName, "", true);
+    },
+
+    /**
+     * @return {boolean}
+     */
+    canLoadFromFile: function()
+    {
+        return false;
+    },
+
+    /**
+     * @override
+     * @param {File} file
+     */
+    loadFromFile: function(file)
+    {
+        function onError(e)
+        {
+            switch(e.target.error.code) {
+            case e.target.error.NOT_FOUND_ERR:
+                this.sidebarElement.subtitle = WebInspector.UIString("'%s' not found.", file.name);
+            break;
+            case e.target.error.NOT_READABLE_ERR:
+                this.sidebarElement.subtitle = WebInspector.UIString("'%s' is not readable", file.name);
+            break;
+            case e.target.error.ABORT_ERR:
+                break;
+            default:
+                this.sidebarElement.subtitle = WebInspector.UIString("'%s' error %d", file.name, e.target.error.code);
+            }
+        }
+
+        this.title = file.name;
+        this.sidebarElement.subtitle = WebInspector.UIString("Loading\u2026");
+        this.sidebarElement.wait = true;
+        this._setupWorker();
+        this._loaderProxy.startLoading(function(ignoredSnapshotProxy) { });
+
+        function loadNextChunk(file, reader, loadedSize)
+        {
+            var chunkSize = 10000000;
+            var size = file.size < loadedSize + chunkSize ? file.size - loadedSize : chunkSize;
+            var nextPart = file.webkitSlice(loadedSize, loadedSize + size);
+            reader.readAsText(nextPart);
+        }
+
+        /**
+         * @param {Event} event
+         */
+        function onLoad(event)
+        {
+            if (event.target.readyState !== FileReader.DONE)
+                return;
+
+            this._loadedSize += event.target.result.length;
+            this._loaderProxy.pushJSONChunk(event.target.result);
+            this.sidebarElement.subtitle = WebInspector.UIString("Loading\u2026 %d%", (this._loadedSize * 100 / file.size).toFixed(2));
+
+            if (this._loadedSize === file.size) {
+                this.finishHeapSnapshot();
+                return;
+            }
+
+            loadNextChunk(file, reader, this._loadedSize);
+        }
+
+        var reader = new FileReader();
+        reader.onload = onLoad.bind(this);
+        reader.onerror = onError;
+        this._loadedSize = 0;
+        loadNextChunk(file, reader, this._loadedSize);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/HelpScreen.js b/Source/WebCore/inspector/front-end/HelpScreen.js
index eee3a7772..01b72e2c5 100644
--- a/Source/WebCore/inspector/front-end/HelpScreen.js
+++ b/Source/WebCore/inspector/front-end/HelpScreen.js
@@ -30,16 +30,19 @@
 
 /**
  * @constructor
+ * @extends {WebInspector.View}
  */
 WebInspector.HelpScreen = function(title)
 {
-    this._element = document.createElement("div");
-    this._element.className = "help-window-outer";
-    this._element.addEventListener("keydown", this._onKeyDown.bind(this), false);
-    this._element.tabIndex = 0;
-    this._element.addEventListener("focus", this._onBlur.bind(this), false);
+    WebInspector.View.call(this);
+    this.registerRequiredCSS("helpScreen.css");
 
-    var mainWindow = this._element.createChild("div", "help-window-main");
+    this.element.className = "help-window-outer";
+    this.element.addEventListener("keydown", this._onKeyDown.bind(this), false);
+    this.element.tabIndex = 0;
+    this.element.addEventListener("focus", this._onBlur.bind(this), false);
+
+    var mainWindow = this.element.createChild("div", "help-window-main");
     var captionWindow = mainWindow.createChild("div", "help-window-caption");
     var closeButton = captionWindow.createChild("button", "help-close-button");
     this.contentElement = mainWindow.createChild("div", "help-content");
@@ -47,50 +50,54 @@ WebInspector.HelpScreen = function(title)
 
     closeButton.textContent = "\u2716"; // Code stands for HEAVY MULTIPLICATION X.
     closeButton.addEventListener("click", this.hide.bind(this), false);
-    this._closeKeys = [
-        WebInspector.KeyboardShortcut.Keys.Enter.code,
-        WebInspector.KeyboardShortcut.Keys.Esc.code,
-        WebInspector.KeyboardShortcut.Keys.Space.code,
-    ];
 }
 
-WebInspector.HelpScreen.visibleScreen_ = null;
+/**
+ * @type {WebInspector.HelpScreen}
+ */
+WebInspector.HelpScreen._visibleScreen = null;
 
 WebInspector.HelpScreen.prototype = {
-    show: function(onHide)
+    showModal: function()
     {
-        if (this._isShown)
+        var visibleHelpScreen = WebInspector.HelpScreen._visibleScreen;
+        if (visibleHelpScreen === this)
             return;
 
-        if (WebInspector.HelpScreen.visibleScreen_)
-            WebInspector.HelpScreen.visibleScreen_.hide();
-        WebInspector.HelpScreen.visibleScreen_ = this;
-
-        document.body.appendChild(this._element);
-        this._isShown = true;
-        this._onHide = onHide;
-        this._previousFocusElement = WebInspector.currentFocusElement();
-        WebInspector.setCurrentFocusElement(this._element);
+        if (visibleHelpScreen)
+            visibleHelpScreen.hide();
+        WebInspector.HelpScreen._visibleScreen = this;
+        this.show(WebInspector.inspectorView.element);
+        this.focus();
     },
 
     hide: function()
     {
-        if (!this._isShown)
+        if (!this.isShowing())
             return;
 
-        this._isShown = false;
-        document.body.removeChild(this._element);
-        WebInspector.setCurrentFocusElement(this._previousFocusElement);
-        WebInspector.HelpScreen.visibleScreen_ = null;
-        if (this._onHide) {
-            this._onHide();
-            delete this._onHide;
-        }
+        WebInspector.HelpScreen._visibleScreen = null;
+
+        WebInspector.restoreFocusFromElement(this.element);
+        this.detach();
+    },
+
+    /**
+     * @param {number} keyCode
+     * @return {boolean}
+     */
+    isClosingKey: function(keyCode)
+    {
+        return [
+            WebInspector.KeyboardShortcut.Keys.Enter.code,
+            WebInspector.KeyboardShortcut.Keys.Esc.code,
+            WebInspector.KeyboardShortcut.Keys.Space.code,
+        ].indexOf(keyCode) >= 0;
     },
 
     _onKeyDown: function(event)
     {
-        if (this._isShown && this._closeKeys.indexOf(event.keyCode) >= 0) {
+        if (this.isShowing() && this.isClosingKey(event.keyCode)) {
             this.hide();
             event.consume();
         }
@@ -99,7 +106,9 @@ WebInspector.HelpScreen.prototype = {
     _onBlur: function(event)
     {
         // Pretend we're modal, grab focus back if we're still shown.
-        if (this._isShown && !this._element.isSelfOrAncestor(event.target))
-            WebInspector.setCurrentFocusElement(this._element);
+        if (this.isShowing() && !this.element.isSelfOrAncestor(event.target))
+            WebInspector.setCurrentFocusElement(this.element);
     }
 }
+
+WebInspector.HelpScreen.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/Source/WebCore/inspector/front-end/Images/navigatorPinButton.png b/Source/WebCore/inspector/front-end/Images/navigatorPinButton.png
deleted file mode 100644
index 577d416fc..000000000
--- a/Source/WebCore/inspector/front-end/Images/navigatorPinButton.png
+++ /dev/null
diff --git a/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png b/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png
index 499e4e018..e4f740330 100644
--- a/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png
+++ b/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
index 34855cc47..a6f98b212 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -37,6 +37,7 @@ WebInspector.InspectorFrontendHostStub = function()
 {
     this._attachedWindowHeight = 0;
     this.isStub = true;
+    WebInspector.documentCopyEventFired = this.documentCopy.bind(this);
 }
 
 WebInspector.InspectorFrontendHostStub.prototype = {
@@ -109,8 +110,22 @@ WebInspector.InspectorFrontendHostStub.prototype = {
         document.title = WebInspector.UIString(Preferences.applicationTitle, url);
     },
 
-    copyText: function()
+    documentCopy: function(event)
     {
+        if (!this._textToCopy)
+            return;
+        event.clipboardData.setData("text", this._textToCopy);
+        event.preventDefault();
+        delete this._textToCopy;
+    },
+
+    copyText: function(text)
+    {
+        this._textToCopy = text;
+        if (!document.execCommand("copy")) {
+            var screen = new WebInspector.ClipboardAccessDeniedScreen();
+            screen.showModal();
+        }
     },
 
     openInNewTab: function(url)
@@ -175,5 +190,27 @@ WebInspector.InspectorFrontendHostStub.prototype = {
 var InspectorFrontendHost = new WebInspector.InspectorFrontendHostStub();
 Preferences.localizeUI = false;
 
+// Default implementation; platforms will override.
+WebInspector.clipboardAccessDeniedMessage = function()
+{
+    return "";
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.HelpScreen}
+ */
+WebInspector.ClipboardAccessDeniedScreen = function()
+{
+    WebInspector.HelpScreen.call(this, WebInspector.UIString("Clipboard access is denied"));
+    var platformMessage = WebInspector.clipboardAccessDeniedMessage();
+    if (platformMessage) {
+        var p = this.contentElement.createChild("p");
+        p.addStyleClass("help-section");
+        p.textContent = platformMessage;
+    }
 }
 
+WebInspector.ClipboardAccessDeniedScreen.prototype.__proto__ = WebInspector.HelpScreen.prototype;
+
+}
diff --git a/Source/WebCore/inspector/front-end/JavaScriptContextManager.js b/Source/WebCore/inspector/front-end/JavaScriptContextManager.js
index c818debc8..c37190089 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptContextManager.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptContextManager.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -37,11 +37,22 @@ WebInspector.JavaScriptContextManager = function(resourceTreeModel, consoleView)
     resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameAdded, this._frameAdded, this);
     resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, this._frameNavigated, this);
     resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameDetached, this._frameDetached, this);
+    resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.CachedResourcesLoaded, this._didLoadCachedResources, this);
     this._consoleView = consoleView;
     this._frameIdToContext = {};
 }
 
 WebInspector.JavaScriptContextManager.prototype = {
+    /**
+     * @param {WebInspector.ResourceTreeFrame} frame
+     * @param {string} securityOrigin
+     */
+    contextByFrameAndSecurityOrigin: function(frame, securityOrigin)
+    {
+        var frameContext = this._frameIdToContext[frame.id];
+        return frameContext && frameContext.contextBySecurityOrigin(securityOrigin);
+    },
+
     _frameAdded: function(event)
     {
         var frame = event.data;
@@ -67,21 +78,87 @@ WebInspector.JavaScriptContextManager.prototype = {
         this._consoleView.removeContext(context);
         delete this._frameIdToContext[frame.id];
     },
+
+    _didLoadCachedResources: function()
+    {
+        InspectorBackend.registerRuntimeDispatcher(new WebInspector.RuntimeDispatcher(this));
+        RuntimeAgent.setReportExecutionContextCreation(true);
+    },
+
+    isolatedContextCreated: function(context)
+    {
+        var frameEvaluationContext = this._frameIdToContext[context.frameId];
+        // FIXME(85708): this should never happen
+        if (!frameEvaluationContext)
+            return;
+        frameEvaluationContext._addExecutionContext(new WebInspector.ExecutionContext(context.id, context.name, context.isPageContext));
+    }
 }
 
 WebInspector.JavaScriptContextManager.prototype.__proto__ = WebInspector.Object.prototype;
 
 /**
+ * @type {WebInspector.JavaScriptContextManager}
+ */
+WebInspector.javaScriptContextManager = null;
+
+/**
+ * @constructor
+ * @implements {RuntimeAgent.Dispatcher}
+ * @param {WebInspector.JavaScriptContextManager} contextManager
+ */
+WebInspector.RuntimeDispatcher = function(contextManager)
+{
+    this._contextManager = contextManager;
+}
+
+WebInspector.RuntimeDispatcher.prototype = {
+    isolatedContextCreated: function(context)
+    {
+        this._contextManager.isolatedContextCreated(context);
+    }
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.ExecutionContext = function(id, name, isPageContext)
+{
+    this.id = id;
+    this.name = (isPageContext && !name) ? "<page context>" : name;
+    this.isMainWorldContext = isPageContext;
+}
+
+/**
+ * @param {*} a
+ * @param {*} b
+ * @return {number}
+ */
+WebInspector.ExecutionContext.comparator = function(a, b)
+{
+    // Main world context should always go first.
+    if (a.isMainWorldContext)
+        return -1;
+    if (b.isMainWorldContext)
+        return +1;
+    return a.name.localeCompare(b.name);
+}
+
+/**
  * @constructor
  * @extends {WebInspector.Object}
  */
 WebInspector.FrameEvaluationContext = function(frame)
 {
     this._frame = frame;
+    this._mainWorldContext = null;
+    this._isolatedContexts = [];
 }
 
 WebInspector.FrameEvaluationContext.EventTypes = {
-    Updated: "updated"
+    Updated: "Updated",
+    AddedExecutionContext: "AddedExecutionContext"
 }
 
 WebInspector.FrameEvaluationContext.prototype =
@@ -89,9 +166,47 @@ WebInspector.FrameEvaluationContext.prototype =
     _frameNavigated: function(frame)
     {
         this._frame = frame;
+        this._mainWorldContext = null;
+        this._isolatedContexts = [];
         this.dispatchEventToListeners(WebInspector.FrameEvaluationContext.EventTypes.Updated, this);
     },
 
+    /**
+     * @param {WebInspector.ExecutionContext} context
+     */
+    _addExecutionContext: function(context)
+    {
+        if (context.isMainWorldContext)
+            this._mainWorldContext = context;
+        else {
+            var insertAt = insertionIndexForObjectInListSortedByFunction(context, this._isolatedContexts, WebInspector.ExecutionContext.comparator);
+            this._isolatedContexts.splice(insertAt, 0, context);
+        }
+        this.dispatchEventToListeners(WebInspector.FrameEvaluationContext.EventTypes.AddedExecutionContext, this);
+    },
+
+    mainWorldContext: function()
+    {
+        return this._mainWorldContext;
+    },
+
+    isolatedContexts: function()
+    {
+        return this._isolatedContexts;
+    },
+
+    /**
+     * @param {string} securityOrigin
+     */
+    contextBySecurityOrigin: function(securityOrigin)
+    {
+        for (var i = 0; i < this._isolatedContexts.length; ++i) {
+            var context = this._isolatedContexts[i];
+            if (!context.isMainWorldContext && context.name === securityOrigin)
+                return context; 
+        }
+    },
+
     get frameId()
     {
         return this._frame.id;
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSource.js b/Source/WebCore/inspector/front-end/JavaScriptSource.js
index b36653600..c0ef25203 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSource.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSource.js
@@ -31,42 +31,129 @@
 /**
  * @constructor
  * @extends {WebInspector.UISourceCode}
- * @param {string} id
  * @param {string} url
  * @param {WebInspector.ContentProvider} contentProvider
+ * @param {WebInspector.SourceMapping} sourceMapping
  */
-WebInspector.JavaScriptSource = function(id, url, contentProvider)
+WebInspector.JavaScriptSource = function(url, contentProvider, sourceMapping, isEditable)
 {
-    WebInspector.UISourceCode.call(this, id, url, contentProvider);
+    WebInspector.UISourceCode.call(this, url, contentProvider, sourceMapping);
+    this._isEditable = isEditable;
 
-    /**
-     * @type {Array.<WebInspector.PresentationConsoleMessage>}
-     */
-    this._consoleMessages = [];
+    this._formatterMapping = new WebInspector.IdentityFormatterSourceMapping();
+    // FIXME: postpone breakpoints restore to after the mapping has been established.
+    setTimeout(function() {
+        if (!this._formatted)
+            WebInspector.breakpointManager.restoreBreakpoints(this);
+    }.bind(this), 0);
 }
 
 WebInspector.JavaScriptSource.prototype = {
     /**
-     * @return {Array.<WebInspector.PresentationConsoleMessage>}
+     * @param {?string} content
+     * @param {boolean} contentEncoded
+     * @param {string} mimeType
+     */
+    fireContentAvailable: function(content, contentEncoded, mimeType)
+    {
+        WebInspector.UISourceCode.prototype.fireContentAvailable.call(this, content, contentEncoded, mimeType);
+        if (this._formatOnLoad) {
+            delete this._formatOnLoad;
+            this.setFormatted(true);
+        }
+    },
+
+    /**
+     * @param {boolean} formatted
+     * @param {function()=} callback
+     */
+    setFormatted: function(formatted, callback)
+    {
+        callback = callback || function() {};
+        if (!this.contentLoaded()) {
+            this._formatOnLoad = formatted;
+            callback();
+            return;
+        }
+
+        if (this._formatted === formatted) {
+            callback();
+            return;
+        }
+
+        this._formatted = formatted;
+
+        // Re-request content
+        this._contentLoaded = false;
+        WebInspector.UISourceCode.prototype.requestContent.call(this, didGetContent.bind(this));
+  
+        /**
+         * @this {WebInspector.UISourceCode}
+         * @param {?string} content
+         * @param {boolean} contentEncoded
+         * @param {string} mimeType
+         */
+        function didGetContent(content, contentEncoded, mimeType)
+        {
+            if (!formatted) {
+                this._togglingFormatter = true;
+                this.contentChanged(content || "");
+                delete this._togglingFormatter;
+                this._formatterMapping = new WebInspector.IdentityFormatterSourceMapping();
+                this.updateLiveLocations();
+                callback();
+                return;
+            }
+    
+            var formatter = new WebInspector.ScriptFormatter();
+            formatter.formatContent(mimeType, content || "", didFormatContent.bind(this));
+  
+            /**
+             * @this {WebInspector.UISourceCode}
+             * @param {string} formattedContent
+             * @param {WebInspector.FormatterSourceMapping} formatterMapping
+             */
+            function didFormatContent(formattedContent, formatterMapping)
+            {
+                this._togglingFormatter = true;
+                this.contentChanged(formattedContent);
+                delete this._togglingFormatter;
+                this._formatterMapping = formatterMapping;
+                this.updateLiveLocations();
+                WebInspector.breakpointManager.restoreBreakpoints(this);
+                callback();
+            }
+        }
+    },
+
+    /**
+     * @return {boolean}
      */
-    consoleMessages: function()
+    togglingFormatter: function()
     {
-        return this._consoleMessages;
+        return this._togglingFormatter;
     },
 
     /**
-     * @param {WebInspector.PresentationConsoleMessage} message
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
      */
-    consoleMessageAdded: function(message)
+    uiLocationToRawLocation: function(lineNumber, columnNumber)
     {
-        this._consoleMessages.push(message);
-        this.dispatchEventToListeners(WebInspector.UISourceCode.Events.ConsoleMessageAdded, message);
+        var location = this._formatterMapping.formattedToOriginal(lineNumber, columnNumber);
+        return WebInspector.UISourceCode.prototype.uiLocationToRawLocation.call(this, location[0], location[1]);
     },
 
-    consoleMessagesCleared: function()
+    /**
+     * @param {WebInspector.UILocation} uiLocation
+     */
+    overrideLocation: function(uiLocation)
     {
-        this._consoleMessages = [];
-        this.dispatchEventToListeners(WebInspector.UISourceCode.Events.ConsoleMessagesCleared);
+        var location = this._formatterMapping.originalToFormatted(uiLocation.lineNumber, uiLocation.columnNumber);
+        uiLocation.lineNumber = location[0];
+        uiLocation.columnNumber = location[1];
+        return uiLocation;
     },
 
     /**
@@ -74,7 +161,20 @@ WebInspector.JavaScriptSource.prototype = {
      */
     breakpointStorageId: function()
     {
-        return this.id;
+        return this._formatted ? "deobfuscated:" + this.url : this.url;
+    },
+
+    /**
+     * @return {boolean}
+     */
+    isEditable: function()
+    {
+        return this._isEditable && WebInspector.debuggerModel.canSetScriptSource();
+    },
+
+    commitWorkingCopy: function(callback)
+    {  
+        WebInspector.DebuggerResourceBinding.setScriptSource(this, this.workingCopy(), callback);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
index da390af20..9e561ab8e 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
@@ -32,21 +32,19 @@
  * @constructor
  * @extends {WebInspector.SourceFrame}
  * @param {WebInspector.ScriptsPanel} scriptsPanel
- * @param {WebInspector.DebuggerPresentationModel} model
  * @param {WebInspector.UISourceCode} uiSourceCode
  */
-WebInspector.JavaScriptSourceFrame = function(scriptsPanel, model, uiSourceCode)
+WebInspector.JavaScriptSourceFrame = function(scriptsPanel, uiSourceCode)
 {
     this._scriptsPanel = scriptsPanel;
-    this._model = model;
-    this._breakpointManager = this._model.breakpointManager;
+    this._breakpointManager = WebInspector.breakpointManager;
     this._uiSourceCode = uiSourceCode;
 
     var locations = this._breakpointManager.breakpointLocationsForUISourceCode(this._uiSourceCode);
     for (var i = 0; i < locations.length; ++i)
         this._breakpointAdded({data:locations[i]});
 
-    WebInspector.SourceFrame.call(this, uiSourceCode.url);
+    WebInspector.SourceFrame.call(this, uiSourceCode);
 
     this._popoverHelper = new WebInspector.ObjectPopoverHelper(this.textViewer.element,
             this._getPopoverAnchor.bind(this), this._resolveObjectForPopover.bind(this), this._onHidePopover.bind(this), true);
@@ -59,6 +57,7 @@ WebInspector.JavaScriptSourceFrame = function(scriptsPanel, model, uiSourceCode)
 
     this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.ContentChanged, this._onContentChanged, this);
     this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.ConsoleMessageAdded, this._consoleMessageAdded, this);
+    this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.ConsoleMessageRemoved, this._consoleMessageRemoved, this);
     this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.ConsoleMessagesCleared, this._consoleMessagesCleared, this);
 }
 
@@ -72,7 +71,6 @@ WebInspector.JavaScriptSourceFrame.prototype = {
     wasShown: function()
     {
         WebInspector.SourceFrame.prototype.wasShown.call(this);
-        this._setScriptSourceIsDirty(this._isDirty);
     },
 
     willHide: function()
@@ -82,32 +80,22 @@ WebInspector.JavaScriptSourceFrame.prototype = {
     },
 
     /**
-     * @param {function(?string, boolean, string)} callback
+     * @return {boolean}
      */
-    requestContent: function(callback)
-    {
-        /**
-         * @param {?string} content
-         * @param {boolean} contentEncoded
-         * @param {string} mimeType
-         */
-        function mycallback(content, contentEncoded, mimeType)
-        {
-            this._originalContent = content;
-            callback(content, contentEncoded, mimeType);
-        }
-        this._uiSourceCode.requestContent(mycallback.bind(this));
-    },
-
     canEditSource: function()
     {
-        return this._model.canEditScriptSource(this._uiSourceCode);
+        return this._uiSourceCode.isEditable();
     },
 
-    editContent: function(newContent, callback)
+    /**
+     * @param {string} text 
+     */
+    commitEditing: function(text)
     {
         this._editingContent = true;
-        this._model.setScriptSource(this._uiSourceCode, newContent, callback);
+        if (!this._uiSourceCode.isDirty())
+            return;
+        this._uiSourceCode.commitWorkingCopy(this._didEditContent.bind(this));
     },
 
     /**
@@ -120,11 +108,15 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         var oldContent = /** @type {string} */ event.data.oldContent;
         var content = /** @type {string} */ event.data.content;
 
-        var breakpointLocations = this._breakpointManager.breakpointLocationsForUISourceCode(this._uiSourceCode);
-        for (var i = 0; i < breakpointLocations.length; ++i)
-            breakpointLocations[i].breakpoint.remove();
-        this.setContent(content, false, "text/javascript");
-        this._updateBreakpointsAfterLiveEdit(oldContent, content, breakpointLocations);
+        if (this._uiSourceCode.togglingFormatter())
+            this.setContent(content, false, this._uiSourceCode.mimeType());
+        else {
+            var breakpointLocations = this._breakpointManager.breakpointLocationsForUISourceCode(this._uiSourceCode);
+            for (var i = 0; i < breakpointLocations.length; ++i)
+                breakpointLocations[i].breakpoint.remove();
+            this.setContent(content, false, this._uiSourceCode.mimeType());
+            this._updateBreakpointsAfterLiveEdit(oldContent, content, breakpointLocations);
+        }
     },
 
     populateLineGutterContextMenu: function(contextMenu, lineNumber)
@@ -138,7 +130,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
             contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Add conditional breakpoint…" : "Add Conditional Breakpoint…"), this._editBreakpointCondition.bind(this, lineNumber));
         } else {
             // This row has a breakpoint, we want to show edit and remove breakpoint, and either disable or enable.
-            contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Remove breakpoint" : "Remove Breakpoint"), breakpoint.remove.bind(this));
+            contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Remove breakpoint" : "Remove Breakpoint"), breakpoint.remove.bind(breakpoint));
             contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Edit breakpoint…" : "Edit Breakpoint…"), this._editBreakpointCondition.bind(this, lineNumber, breakpoint));
             if (breakpoint.enabled())
                 contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Disable breakpoint" : "Disable Breakpoint"), breakpoint.setEnabled.bind(breakpoint, false));
@@ -161,22 +153,14 @@ WebInspector.JavaScriptSourceFrame.prototype = {
 
     afterTextChanged: function(oldRange, newRange)
     {
-        var isDirty = this.textModel.text !== this._originalContent;
-        if (isDirty)
-            this._setScriptSourceIsDirty(true);
-        else
-            this.didEditContent(null, this._originalContent);
-    },
-
-    _setScriptSourceIsDirty: function(isDirty)
-    {
-        this._scriptsPanel.setScriptSourceIsDirty(this._uiSourceCode, isDirty);
-        this._isDirty = isDirty;
+        this._uiSourceCode.setWorkingCopy(this.textModel.text);
+        if (!this._uiSourceCode.isDirty())
+            this._didEditContent(null);
     },
 
     beforeTextChanged: function()
     {
-        if (!this._isDirty) {
+        if (!this._uiSourceCode.isDirty()) {
             // Disable all breakpoints in the model, store them as muted breakpoints.
             var breakpointLocations = this._breakpointManager.breakpointLocationsForUISourceCode(this._uiSourceCode);
             var lineNumbers = {};
@@ -188,20 +172,17 @@ WebInspector.JavaScriptSourceFrame.prototype = {
             }
         }
 
-        this._isDirty = true;
         WebInspector.SourceFrame.prototype.beforeTextChanged.call(this);
     },
 
-    didEditContent: function(error, content)
+    _didEditContent: function(error)
     {
         delete this._editingContent;
 
-        WebInspector.SourceFrame.prototype.didEditContent.call(this, error, content);
-        if (error)
+        if (error) {
+            WebInspector.log(error, WebInspector.ConsoleMessage.MessageLevel.Error, true);
             return;
-
-        this._originalContent = content;
-        this._isDirty = false;
+        }
 
         // Restore all muted breakpoints.
         for (var lineNumber = 0; lineNumber < this.textModel.linesCount; ++lineNumber) {
@@ -213,7 +194,6 @@ WebInspector.JavaScriptSourceFrame.prototype = {
                 this._setBreakpoint(lineNumber, breakpointDecoration.condition, breakpointDecoration.enabled);
             }
         }
-        this._setScriptSourceIsDirty(false);
     },
 
     _getPopoverAnchor: function(element, event)
@@ -372,7 +352,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
 
     _onMouseDown: function(event)
     {
-        if (this._isDirty)
+        if (this._uiSourceCode.isDirty())
             return;
 
         if (event.button != 0 || event.altKey || event.ctrlKey || event.metaKey)
@@ -510,18 +490,24 @@ WebInspector.JavaScriptSourceFrame.prototype = {
 
         var breakpoint = /** @type {WebInspector.BreakpointManager.Breakpoint} */ event.data.breakpoint;
         var remainingBreakpoint = this._breakpointManager.findBreakpoint(this._uiSourceCode, uiLocation.lineNumber);
-        if (!remainingBreakpoint && this.loaded) {
+        if (!remainingBreakpoint && this.loaded)
             this._removeBreakpointDecoration(uiLocation.lineNumber);
-        }
     },
 
     _consoleMessageAdded: function(event)
     {
-        var message = event.data;
+        var message = /** @type {WebInspector.PresentationConsoleMessage} */ event.data;
         if (this.loaded)
             this.addMessageToSource(message.lineNumber, message.originalMessage);
     },
 
+    _consoleMessageRemoved: function(event)
+    {
+        var message = /** @type {WebInspector.PresentationConsoleMessage} */ event.data;
+        if (this.loaded)
+            this.removeMessageFromSource(message.lineNumber, message.originalMessage);
+    },
+
     _consoleMessagesCleared: function(event)
     {
         this.clearMessages();
@@ -560,7 +546,8 @@ WebInspector.JavaScriptSourceFrame.prototype = {
      */
     _continueToLine: function(lineNumber)
     {
-        this._model.continueToLine(this._uiSourceCode, lineNumber);
+        var rawLocation = this._uiSourceCode.uiLocationToRawLocation(lineNumber, 0);
+        WebInspector.debuggerModel.continueToLocation(rawLocation);
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/NavigatorOverlayController.js b/Source/WebCore/inspector/front-end/NavigatorOverlayController.js
index 5625da4e6..51ce67d72 100644
--- a/Source/WebCore/inspector/front-end/NavigatorOverlayController.js
+++ b/Source/WebCore/inspector/front-end/NavigatorOverlayController.js
@@ -45,14 +45,10 @@ WebInspector.NavigatorOverlayController = function(panel, parentSplitView, navig
     this._parentSplitView.installResizer(this._navigatorSidebarResizeWidgetElement);
     this._navigatorView.element.appendChild(this._navigatorSidebarResizeWidgetElement);
 
-    this._navigatorShowHideButton = this._createNavigatorControlButton(WebInspector.UIString("Show navigator"), "scripts-navigator-show-hide-button", this._toggleNavigator.bind(this));
-    this._navigatorShowHideButton.addStyleClass("toggled-on");
-    this._navigatorShowHideButton.title = WebInspector.UIString("Hide navigator");
-    this._parentSplitView.element.appendChild(this._navigatorShowHideButton);
-
-    this._navigatorPinButton = this._createNavigatorControlButton(WebInspector.UIString("Pin navigator"), "scripts-navigator-pin-button", this._pinNavigator.bind(this));
-    this._navigatorPinButton.addStyleClass("hidden");
-    this._navigatorView.element.appendChild(this._navigatorPinButton);
+    this._navigatorShowHideButton = new WebInspector.StatusBarButton(WebInspector.UIString("Hide navigator"), "scripts-navigator-show-hide-button", 3);
+    this._navigatorShowHideButton.state = "pinned";
+    this._navigatorShowHideButton.addEventListener("click", this._toggleNavigator, this);
+    this._editorView.element.appendChild(this._navigatorShowHideButton.element);
 
     WebInspector.settings.navigatorHidden = WebInspector.settings.createSetting("navigatorHidden", true);
     if (WebInspector.settings.navigatorHidden.get())
@@ -65,17 +61,6 @@ WebInspector.NavigatorOverlayController.prototype = {
         window.setTimeout(this._maybeShowNavigatorOverlay.bind(this), 0);
     },
 
-    _createNavigatorControlButton: function(title, id, listener)
-    {
-        var button = document.createElement("button");
-        button.title = title;
-        button.id = id;
-        button.addStyleClass("scripts-navigator-control-button");
-        button.addEventListener("click", listener, false);
-        button.createChild("div", "glyph");
-        return button;
-    },
-
     _escDownWhileNavigatorOverlayOpen: function(event)
     {
         this.hideNavigatorOverlay();
@@ -89,9 +74,9 @@ WebInspector.NavigatorOverlayController.prototype = {
 
     _toggleNavigator: function()
     {
-        if (this._navigatorOverlayShown)
-            this.hideNavigatorOverlay();
-        else if (this._navigatorHidden)
+        if (this._navigatorShowHideButton.state === "overlay")
+            this._pinNavigator();
+        else if (this._navigatorShowHideButton.state === "hidden")
             this.showNavigatorOverlay();
         else
             this._hidePinnedNavigator();
@@ -99,32 +84,31 @@ WebInspector.NavigatorOverlayController.prototype = {
 
     _hidePinnedNavigator: function()
     {
-        this._navigatorHidden = true;
-        this._navigatorShowHideButton.removeStyleClass("toggled-on");
-        this._navigatorShowHideButton.title = WebInspector.UIString("Show scripts navigator");
+        this._navigatorShowHideButton.state = "hidden";
+        this._navigatorShowHideButton.title = WebInspector.UIString("Show navigator");
+        this._parentSplitView.element.appendChild(this._navigatorShowHideButton.element);
+
         this._editorView.element.addStyleClass("navigator-hidden");
         this._navigatorSidebarResizeWidgetElement.addStyleClass("hidden");
 
-        this._navigatorPinButton.removeStyleClass("hidden");
-
         this._parentSplitView.hideSidebarElement();
         this._navigatorView.detach();
         this._editorView.focus();
+
+        WebInspector.settings.navigatorWasOnceHidden.set(true);
         WebInspector.settings.navigatorHidden.set(true);
     },
 
     _pinNavigator: function()
     {
-        delete this._navigatorHidden;
-        this.hideNavigatorOverlay();
-
-        this._navigatorPinButton.addStyleClass("hidden");
-        this._navigatorShowHideButton.addStyleClass("toggled-on");
-        this._navigatorShowHideButton.title = WebInspector.UIString("Hide scripts navigator");
+        this._navigatorShowHideButton.state = "pinned";
+        this._navigatorShowHideButton.title = WebInspector.UIString("Hide navigator");
 
         this._editorView.element.removeStyleClass("navigator-hidden");
         this._navigatorSidebarResizeWidgetElement.removeStyleClass("hidden");
+        this._editorView.element.appendChild(this._navigatorShowHideButton.element);
 
+        this._innerHideNavigatorOverlay();
         this._parentSplitView.showSidebarElement();
         this._navigatorView.show(this._parentSplitView.sidebarElement);
         this._navigatorView.focus();
@@ -133,46 +117,59 @@ WebInspector.NavigatorOverlayController.prototype = {
 
     showNavigatorOverlay: function()
     {
-        if (this._navigatorOverlayShown)
+        if (this._navigatorShowHideButton.state === "overlay")
             return;
 
-        this._navigatorOverlayShown = true;
-        this._sidebarOverlay = new WebInspector.SidebarOverlay(this._navigatorView, "scriptsPanelNavigatorOverlayWidth", Preferences.minScriptsSidebarWidth);
-        this._sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WasShown, this._navigatorOverlayWasShown, this);
-        this._sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WillHide, this._navigatorOverlayWillHide, this);
+        this._navigatorShowHideButton.state = "overlay";
+        this._navigatorShowHideButton.title = WebInspector.UIString("Pin navigator");
 
+        this._sidebarOverlay = new WebInspector.SidebarOverlay(this._navigatorView, "scriptsPanelNavigatorOverlayWidth", Preferences.minScriptsSidebarWidth);
         var navigatorOverlayResizeWidgetElement = document.createElement("div");
         navigatorOverlayResizeWidgetElement.addStyleClass("scripts-navigator-resizer-widget");
         this._sidebarOverlay.resizerWidgetElement = navigatorOverlayResizeWidgetElement;
 
+        this._navigatorView.element.appendChild(this._navigatorShowHideButton.element);
+        this._boundContainingElementFocused = this._containingElementFocused.bind(this);
+        this._parentSplitView.element.addEventListener("mousedown", this._boundContainingElementFocused, false);
+        this._panel.registerShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code, this._escDownWhileNavigatorOverlayOpen.bind(this));
+
         this._sidebarOverlay.show(this._parentSplitView.element);
+        this._navigatorView.focus();
     },
 
     hideNavigatorOverlay: function()
     {
-        if (!this._navigatorOverlayShown)
+        if (this._navigatorShowHideButton.state !== "overlay")
             return;
 
-        this._sidebarOverlay.hide();
+        this._navigatorShowHideButton.state = "hidden";
+        this._navigatorShowHideButton.title = WebInspector.UIString("Show navigator");
+        this._parentSplitView.element.appendChild(this._navigatorShowHideButton.element);
+
+        this._innerHideNavigatorOverlay();
         this._editorView.focus();
     },
 
-    _navigatorOverlayWasShown: function(event)
+    _innerHideNavigatorOverlay: function()
     {
-        this._navigatorView.element.appendChild(this._navigatorShowHideButton);
-        this._navigatorShowHideButton.addStyleClass("toggled-on");
-        this._navigatorShowHideButton.title = WebInspector.UIString("Hide navigator");
-        this._navigatorView.focus();
-        this._panel.registerShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code, this._escDownWhileNavigatorOverlayOpen.bind(this));
+        this._parentSplitView.element.removeEventListener("mousedown", this._boundContainingElementFocused, false);
+        this._panel.unregisterShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code);
+        this._sidebarOverlay.hide();
     },
 
-    _navigatorOverlayWillHide: function(event)
+    _containingElementFocused: function(event)
     {
-        delete this._navigatorOverlayShown;
-        WebInspector.settings.navigatorWasOnceHidden.set(true);
-        this._parentSplitView.element.appendChild(this._navigatorShowHideButton);
-        this._navigatorShowHideButton.removeStyleClass("toggled-on");
-        this._navigatorShowHideButton.title = WebInspector.UIString("Show navigator");
-        this._panel.unregisterShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code);
+        if (!event.target.isSelfOrDescendant(this._sidebarOverlay.element))
+            this.hideNavigatorOverlay();
+    },
+    
+    isNavigatorPinned: function()
+    {
+        return this._navigatorShowHideButton.state === "pinned";
+    },
+    
+    isNavigatorHidden: function()
+    {
+        return this._navigatorShowHideButton.state === "hidden";
     }
 }
diff --git a/Source/WebCore/inspector/front-end/NavigatorView.js b/Source/WebCore/inspector/front-end/NavigatorView.js
index c0f2f1c2c..d30379adb 100644
--- a/Source/WebCore/inspector/front-end/NavigatorView.js
+++ b/Source/WebCore/inspector/front-end/NavigatorView.js
@@ -60,7 +60,8 @@ WebInspector.NavigatorView = function()
 
 
 WebInspector.NavigatorView.Events = {
-    ItemSelected: "ItemSelected"
+    ItemSelected: "ItemSelected",
+    FileRenamed: "FileRenamed"
 }
 
 WebInspector.NavigatorView.prototype = {
@@ -72,18 +73,38 @@ WebInspector.NavigatorView.prototype = {
         if (this._scriptTreeElementsByUISourceCode.get(uiSourceCode))
             return;
 
-        var scriptTreeElement = new WebInspector.NavigatorScriptTreeElement(this, uiSourceCode, "");
+        var scriptTreeElement = new WebInspector.NavigatorSourceTreeElement(this, uiSourceCode, "");
         this._scriptTreeElementsByUISourceCode.put(uiSourceCode, scriptTreeElement);
         this._updateScriptTitle(uiSourceCode);
+        this._addUISourceCodeListeners(uiSourceCode);
 
         var folderTreeElement = this.getOrCreateFolderTreeElement(uiSourceCode);
         folderTreeElement.appendChild(scriptTreeElement);
     },
 
+    _uiSourceCodeTitleChanged: function(event)
+    {
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        this._updateScriptTitle(uiSourceCode)
+    },
+
+    _uiSourceCodeWorkingCopyChanged: function(event)
+    {
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        this._updateScriptTitle(uiSourceCode)
+    },
+
+    _uiSourceCodeContentChanged: function(event)
+    {
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        this._updateScriptTitle(uiSourceCode);
+    },
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {boolean=} ignoreIsDirty
      */
-    _updateScriptTitle: function(uiSourceCode)
+    _updateScriptTitle: function(uiSourceCode, ignoreIsDirty)
     {
         var scriptTreeElement = this._scriptTreeElementsByUISourceCode.get(uiSourceCode);
         if (!scriptTreeElement)
@@ -98,6 +119,8 @@ WebInspector.NavigatorView.prototype = {
             titleText = uiSourceCode.parsedURL.url;
         if (!titleText)
             titleText = WebInspector.UIString("(program)");
+        if (!ignoreIsDirty && uiSourceCode.isDirty())
+            titleText = "*" + titleText;
         scriptTreeElement.titleText = titleText;
     },
 
@@ -126,32 +149,26 @@ WebInspector.NavigatorView.prototype = {
     },
 
     /**
-     * @param {Array.<WebInspector.UISourceCode>} oldUISourceCodeList
-     * @param {Array.<WebInspector.UISourceCode>} uiSourceCodeList
+     * @param {WebInspector.UISourceCode} oldUISourceCode
+     * @param {WebInspector.UISourceCode} uiSourceCode
      */
-    replaceUISourceCodes: function(oldUISourceCodeList, uiSourceCodeList)
+    replaceUISourceCode: function(oldUISourceCode, uiSourceCode)
     {
         var added = false;
         var selected = false;
-        for (var i = 0; i < oldUISourceCodeList.length; ++i) {
-            var uiSourceCode = oldUISourceCodeList[i];
-            if (!this._scriptTreeElementsByUISourceCode.get(uiSourceCode))
-                continue;
+        if (this._scriptTreeElementsByUISourceCode.get(oldUISourceCode)) {
             added = true;
 
-            if (this._lastSelectedUISourceCode === uiSourceCode)
+            if (this._lastSelectedUISourceCode === oldUISourceCode)
                 selected = true;
-            this._removeUISourceCode(uiSourceCode);
+            this._removeUISourceCode(oldUISourceCode);
         }
-        
+
         if (!added)
             return;
-            
-        for (var i = 0; i < uiSourceCodeList.length; ++i)
-            this.addUISourceCode(uiSourceCodeList[i]);
-
+        this.addUISourceCode(uiSourceCode);
         if (selected)
-            this.revealUISourceCode(uiSourceCodeList[0]);
+            this.revealUISourceCode(uiSourceCode);
     },
 
     /**
@@ -183,6 +200,27 @@ WebInspector.NavigatorView.prototype = {
             treeElement = parent;
         }
         this._scriptTreeElementsByUISourceCode.remove(uiSourceCode);
+        this._removeUISourceCodeListeners(uiSourceCode);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    _addUISourceCodeListeners: function(uiSourceCode)
+    {
+        uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.TitleChanged, this._uiSourceCodeTitleChanged, this);
+        uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.WorkingCopyChanged, this._uiSourceCodeWorkingCopyChanged, this);
+        uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.ContentChanged, this._uiSourceCodeContentChanged, this);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    _removeUISourceCodeListeners: function(uiSourceCode)
+    {
+        uiSourceCode.removeEventListener(WebInspector.UISourceCode.Events.TitleChanged, this._uiSourceCodeTitleChanged, this);
+        uiSourceCode.removeEventListener(WebInspector.UISourceCode.Events.WorkingCopyChanged, this._uiSourceCodeWorkingCopyChanged, this);
+        uiSourceCode.removeEventListener(WebInspector.UISourceCode.Events.ContentChanged, this._uiSourceCodeContentChanged, this);
     },
 
     _showScriptFoldersSettingChanged: function()
@@ -198,13 +236,14 @@ WebInspector.NavigatorView.prototype = {
     },
 
     _fileRenamed: function(uiSourceCode, newTitle)
-    {
-        // FIXME: To be implemented.
+    {    
+        var data = { uiSourceCode: uiSourceCode, name: newTitle };
+        this.dispatchEventToListeners(WebInspector.NavigatorView.Events.FileRenamed, data);
     },
 
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {function()=} callback
+     * @param {function(boolean)=} callback
      */
     rename: function(uiSourceCode, callback)
     {
@@ -221,28 +260,36 @@ WebInspector.NavigatorView.prototype = {
                 this._fileRenamed(uiSourceCode, newTitle);
             else
                 this._updateScriptTitle(uiSourceCode);
-            afterEditing();
+            afterEditing(true);
         }
 
         function cancelHandler()
         {
-            afterEditing();
+            afterEditing(false);
         }
 
-        function afterEditing()
+        /**
+         * @param {boolean} committed
+         */
+        function afterEditing(committed)
         {
             WebInspector.markBeingEdited(scriptTreeElement.treeOutline.element, false);
             if (callback)
-                callback();
+                callback(committed);
         }
 
         var editingConfig = new WebInspector.EditingConfig(commitHandler.bind(this), cancelHandler.bind(this));
+        this._updateScriptTitle(uiSourceCode, true);
         WebInspector.startEditing(scriptTreeElement.titleElement, editingConfig);
         window.getSelection().setBaseAndExtent(scriptTreeElement.titleElement, 0, scriptTreeElement.titleElement, 1);
     },
 
     reset: function()
     {
+        var uiSourceCodes = this._scriptsTree.scriptTreeElements;
+        for (var i = 0; i < uiSourceCodes.length; ++i)
+            this._removeUISourceCodeListeners(uiSourceCodes[i]);
+
         this._scriptsTree.stopSearch();
         this._scriptsTree.removeChildren();
         this._folderTreeElements = {};
@@ -360,7 +407,7 @@ WebInspector.NavigatorTreeOutline.prototype = {
        var result = [];
        if (this.children.length) {
            for (var treeElement = this.children[0]; treeElement; treeElement = treeElement.traverseNextTreeElement(false, this, true)) {
-               if (treeElement instanceof WebInspector.NavigatorScriptTreeElement)
+               if (treeElement instanceof WebInspector.NavigatorSourceTreeElement)
                    result.push(treeElement.uiSourceCode);
            }
        }
@@ -514,15 +561,15 @@ WebInspector.NavigatorFolderTreeElement.prototype.__proto__ = WebInspector.BaseN
  * @param {WebInspector.UISourceCode} uiSourceCode
  * @param {string} title
  */
-WebInspector.NavigatorScriptTreeElement = function(navigatorView, uiSourceCode, title)
+WebInspector.NavigatorSourceTreeElement = function(navigatorView, uiSourceCode, title)
 {
-    WebInspector.BaseNavigatorTreeElement.call(this, title, ["navigator-script-tree-item"], false);
+    WebInspector.BaseNavigatorTreeElement.call(this, title, ["navigator-" + uiSourceCode.contentType().name() + "-tree-item"], false);
     this._navigatorView = navigatorView;
     this._uiSourceCode = uiSourceCode;
     this.tooltip = uiSourceCode.url;
 }
 
-WebInspector.NavigatorScriptTreeElement.prototype = {
+WebInspector.NavigatorSourceTreeElement.prototype = {
     /**
      * @return {WebInspector.UISourceCode}
      */
@@ -535,6 +582,7 @@ WebInspector.NavigatorScriptTreeElement.prototype = {
     {
         WebInspector.BaseNavigatorTreeElement.prototype.onattach.call(this);
         this.listItemElement.addEventListener("click", this._onclick.bind(this), false);
+        this.listItemElement.addEventListener("contextmenu", this._handleContextMenuEvent.bind(this), false);
     },
 
     onspace: function()
@@ -571,4 +619,4 @@ WebInspector.NavigatorScriptTreeElement.prototype = {
     }
 }
 
-WebInspector.NavigatorScriptTreeElement.prototype.__proto__ = WebInspector.BaseNavigatorTreeElement.prototype;
+WebInspector.NavigatorSourceTreeElement.prototype.__proto__ = WebInspector.BaseNavigatorTreeElement.prototype;
diff --git a/Source/WebCore/inspector/front-end/NetworkManager.js b/Source/WebCore/inspector/front-end/NetworkManager.js
index 4c3915f12..a8f0770f4 100644
--- a/Source/WebCore/inspector/front-end/NetworkManager.js
+++ b/Source/WebCore/inspector/front-end/NetworkManager.js
@@ -152,13 +152,28 @@ WebInspector.NetworkDispatcher = function(manager)
 
 WebInspector.NetworkDispatcher.prototype = {
     /**
+     * @param {NetworkAgent.Headers} headersMap
+     * @return {Array.<Object>}
+     */
+    _headersMapToHeadersArray: function(headersMap)
+    {
+        var result = [];
+        for (var name in headersMap) {
+            var values = headersMap[name].split("\n");
+            for (var i = 0; i < values.length; ++i)
+                result.push({ name: name, value: values[i] });
+        }
+        return result;
+    },
+
+    /**
      * @param {WebInspector.NetworkRequest} networkRequest
      * @param {NetworkAgent.Request} request
      */
     _updateNetworkRequestWithRequest: function(networkRequest, request)
     {
         networkRequest.requestMethod = request.method;
-        networkRequest.requestHeaders = request.headers;
+        networkRequest.requestHeaders = this._headersMapToHeadersArray(request.headers);
         networkRequest.requestFormData = request.postData;
     },
 
@@ -176,11 +191,11 @@ WebInspector.NetworkDispatcher.prototype = {
         networkRequest.mimeType = response.mimeType;
         networkRequest.statusCode = response.status;
         networkRequest.statusText = response.statusText;
-        networkRequest.responseHeaders = response.headers;
+        networkRequest.responseHeaders = this._headersMapToHeadersArray(response.headers);
         if (response.headersText)
             networkRequest.responseHeadersText = response.headersText;
         if (response.requestHeaders)
-            networkRequest.requestHeaders = response.requestHeaders;
+            networkRequest.requestHeaders = this._headersMapToHeadersArray(response.requestHeaders);
         if (response.requestHeadersText)
             networkRequest.requestHeadersText = response.requestHeadersText;
 
@@ -426,7 +441,7 @@ WebInspector.NetworkDispatcher.prototype = {
             return;
 
         networkRequest.requestMethod = "GET";
-        networkRequest.requestHeaders = request.headers;
+        networkRequest.requestHeaders = this._headersMapToHeadersArray(request.headers);
         networkRequest.webSocketRequestKey3 = request.requestKey3;
         networkRequest.startTime = time;
 
@@ -446,7 +461,7 @@ WebInspector.NetworkDispatcher.prototype = {
 
         networkRequest.statusCode = response.status;
         networkRequest.statusText = response.statusText;
-        networkRequest.responseHeaders = response.headers;
+        networkRequest.responseHeaders = this._headersMapToHeadersArray(response.headers);
         networkRequest.webSocketChallengeResponse = response.challengeResponse;
         networkRequest.responseReceivedTime = time;
 
diff --git a/Source/WebCore/inspector/front-end/NetworkRequest.js b/Source/WebCore/inspector/front-end/NetworkRequest.js
index 577050fd8..78628507f 100644
--- a/Source/WebCore/inspector/front-end/NetworkRequest.js
+++ b/Source/WebCore/inspector/front-end/NetworkRequest.js
@@ -240,7 +240,7 @@ WebInspector.NetworkRequest.prototype = {
         // resourceSize when we don't have Content-Length. This still won't
         // work for chunks with non-trivial encodings. We need a way to
         // get actual transfer size from the network stack.
-        var bodySize = Number(this.responseHeaders["Content-Length"] || this.resourceSize);
+        var bodySize = Number(this.responseHeaderValue("Content-Length") || this.resourceSize);
         return this.responseHeadersSize + bodySize;
     },
 
@@ -399,11 +399,11 @@ WebInspector.NetworkRequest.prototype = {
     },
 
     /**
-     * @return {Object}
+     * @return {Array.<Object>}
      */
     get requestHeaders()
     {
-        return this._requestHeaders || {};
+        return this._requestHeaders || [];
     },
 
     set requestHeaders(x)
@@ -422,8 +422,8 @@ WebInspector.NetworkRequest.prototype = {
     {
         if (this._requestHeadersText === undefined) {
             this._requestHeadersText = this.requestMethod + " " + this.url + " HTTP/1.1\r\n";
-            for (var key in this.requestHeaders)
-                this._requestHeadersText += key + ": " + this.requestHeaders[key] + "\r\n";
+            for (var i = 0; i < this.requestHeaders; ++i)
+                this._requestHeadersText += this.requestHeaders[i].name + ": " + this.requestHeaders[i].value + "\r\n";
         }
         return this._requestHeadersText;
     },
@@ -452,10 +452,8 @@ WebInspector.NetworkRequest.prototype = {
             return this._sortedRequestHeaders;
 
         this._sortedRequestHeaders = [];
-        for (var key in this.requestHeaders)
-            this._sortedRequestHeaders.push({header: key, value: this.requestHeaders[key]});
-        this._sortedRequestHeaders.sort(function(a,b) { return a.header.localeCompare(b.header) });
-
+        this._sortedRequestHeaders = this.requestHeaders.slice();
+        this._sortedRequestHeaders.sort(function(a,b) { return a.name.toLowerCase().localeCompare(b.name.toLowerCase()) });
         return this._sortedRequestHeaders;
     },
 
@@ -503,11 +501,11 @@ WebInspector.NetworkRequest.prototype = {
     },
 
     /**
-     * @return {Object}
+     * @return {Array.<Object>}
      */
     get responseHeaders()
     {
-        return this._responseHeaders || {};
+        return this._responseHeaders || [];
     },
 
     set responseHeaders(x)
@@ -526,8 +524,8 @@ WebInspector.NetworkRequest.prototype = {
     {
         if (this._responseHeadersText === undefined) {
             this._responseHeadersText = "HTTP/1.1 " + this.statusCode + " " + this.statusText + "\r\n";
-            for (var key in this.responseHeaders)
-                this._responseHeadersText += key + ": " + this.responseHeaders[key] + "\r\n";
+            for (var i = 0; i < this.requestHeaders; ++i)
+                this._responseHeadersText += this.responseHeaders[i].name + ": " + this.responseHeaders[i].value + "\r\n";
         }
         return this._responseHeadersText;
     },
@@ -554,12 +552,10 @@ WebInspector.NetworkRequest.prototype = {
     {
         if (this._sortedResponseHeaders !== undefined)
             return this._sortedResponseHeaders;
-
+        
         this._sortedResponseHeaders = [];
-        for (var key in this.responseHeaders)
-            this._sortedResponseHeaders.push({header: key, value: this.responseHeaders[key]});
-        this._sortedResponseHeaders.sort(function(a,b) { return a.header.localeCompare(b.header) });
-
+        this._sortedResponseHeaders = this.responseHeaders.slice();
+        this._sortedResponseHeaders.sort(function(a,b) { return a.name.toLowerCase().localeCompare(b.name.toLowerCase()) });
         return this._sortedResponseHeaders;
     },
 
@@ -651,10 +647,16 @@ WebInspector.NetworkRequest.prototype = {
     _headerValue: function(headers, headerName)
     {
         headerName = headerName.toLowerCase();
-        for (var header in headers) {
-            if (header.toLowerCase() === headerName)
-                return headers[header];
+        
+        var values = [];
+        for (var i = 0; i < headers.length; ++i) {
+            if (headers[i].name.toLowerCase() === headerName)
+                values.push(headers[i].value);
         }
+        // Set-Cookie values should be separated by '\n', not comma, otherwise cookies could not be parsed.
+        if (headerName === "set-cookie")
+            return values.join("\n");
+        return values.join(", ");
     },
 
     /**
@@ -682,6 +684,14 @@ WebInspector.NetworkRequest.prototype = {
     },
 
     /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function()
+    {
+        return this._type;
+    },
+
+    /**
      * @param {function(?string, boolean, string)} callback
      */
     requestContent: function(callback)
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index b4656d245..b951a406e 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -50,7 +50,54 @@ WebInspector.ObjectPropertiesSection = function(object, title, subtitle, emptyPl
 
 WebInspector.ObjectPropertiesSection._arrayLoadThreshold = 100;
 
+
+/**
+ * @interface
+ */
+WebInspector.ObjectPropertiesSection.ContextMenuProvider = function()
+{
+}
+
+WebInspector.ObjectPropertiesSection.ContextMenuProvider.prototype = {
+    /**
+     * @param {WebInspector.ObjectPropertiesSection} section
+     * @param {WebInspector.ContextMenu} contextMenu
+     */
+    populateContextMenu: function(section, contextMenu)
+    {
+    }
+}
+
+
+/**
+ * @type {Array.<WebInspector.ObjectPropertiesSection.ContextMenuProvider>}
+ */
+WebInspector.ObjectPropertiesSection._contextMenuProviers = [];
+
+/**
+ * @param {WebInspector.ObjectPropertiesSection.ContextMenuProvider} provider
+ */
+WebInspector.ObjectPropertiesSection.addContextMenuProvider = function(provider)
+{
+    WebInspector.ObjectPropertiesSection._contextMenuProviers.push(provider);
+}
+
 WebInspector.ObjectPropertiesSection.prototype = {
+    enableContextMenu: function()
+    {
+        this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
+    },
+
+    _contextMenuEventFired: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        var providers = WebInspector.ObjectPropertiesSection._contextMenuProviers;
+        for (var i = 0; i < providers.length; i++)
+            providers[i].populateContextMenu(this, contextMenu);
+        if (!contextMenu.isEmpty())
+            contextMenu.show(event);
+    },
+
     onpopulate: function()
     {
         this.update();
diff --git a/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js b/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js
new file mode 100644
index 000000000..fe480e20e
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
+ */
+WebInspector.PresentationConsoleMessageHelper = function(uiSourceCodeProvider)
+{
+    this._pendingConsoleMessages = {};
+    this._presentationConsoleMessages = [];
+    this._uiSourceCodeProvider = uiSourceCodeProvider;
+
+    WebInspector.console.addEventListener(WebInspector.ConsoleModel.Events.MessageAdded, this._consoleMessageAdded, this);
+    WebInspector.console.addEventListener(WebInspector.ConsoleModel.Events.ConsoleCleared, this._consoleCleared, this);
+
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._parsedScriptSource, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.GlobalObjectCleared, this._debuggerReset, this);
+}
+
+WebInspector.PresentationConsoleMessageHelper.prototype = {
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _consoleMessageAdded: function(event)
+    {
+        var message = /** @type {WebInspector.ConsoleMessage} */ event.data;
+        if (!message.url || !message.isErrorOrWarning())
+            return;
+
+        var rawLocation = message.location();
+        if (rawLocation)
+            this._addConsoleMessageToScript(message, rawLocation);
+        else
+            this._addPendingConsoleMessage(message);
+    },
+
+    /**
+     * @param {WebInspector.ConsoleMessage} message
+     * @param {DebuggerAgent.Location} rawLocation
+     */
+    _addConsoleMessageToScript: function(message, rawLocation)
+    {
+        this._presentationConsoleMessages.push(new WebInspector.PresentationConsoleMessage(message, rawLocation));
+    },
+
+    /**
+     * @param {WebInspector.ConsoleMessage} message
+     */
+    _addPendingConsoleMessage: function(message)
+    {
+        if (!this._pendingConsoleMessages[message.url])
+            this._pendingConsoleMessages[message.url] = [];
+        this._pendingConsoleMessages[message.url].push(message);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _parsedScriptSource: function(event)
+    {
+        var script = /** @type {WebInspector.Script} */ event.data;
+
+        var messages = this._pendingConsoleMessages[script.sourceURL];
+        if (!messages)
+            return;
+
+        var pendingMessages = [];
+        for (var i = 0; i < messages.length; i++) {
+            var message = messages[i];
+            var rawLocation = message.location();
+            if (script.scriptId === rawLocation.scriptId)
+                this._addConsoleMessageToScript(messages, rawLocation);
+            else
+                pendingMessages.push(message);
+        }
+
+        if (pendingMessages.length)
+            this._pendingConsoleMessages[script.sourceURL] = pendingMessages;
+        else
+            delete this._pendingConsoleMessages[script.sourceURL];
+    },
+
+    _consoleCleared: function()
+    {
+        this._pendingConsoleMessages = {};
+        for (var i = 0; i < this._presentationConsoleMessages.length; ++i)
+            this._presentationConsoleMessages[i].dispose();
+        this._presentationConsoleMessages = [];
+        var uiSourceCodes = this._uiSourceCodeProvider.uiSourceCodes();
+        for (var i = 0; i < uiSourceCodes.length; ++i)
+            uiSourceCodes[i].consoleMessagesCleared();
+    },
+
+    _debuggerReset: function()
+    {
+        this._pendingConsoleMessages = {};
+        this._presentationConsoleMessages = [];
+    }
+}
+
+/**
+ * @constructor
+ * @param {WebInspector.ConsoleMessage} message
+ * @param {DebuggerAgent.Location} rawLocation
+ */
+WebInspector.PresentationConsoleMessage = function(message, rawLocation)
+{
+    this.originalMessage = message;
+    this._liveLocation = WebInspector.debuggerModel.createLiveLocation(rawLocation, this._updateLocation.bind(this));
+}
+
+WebInspector.PresentationConsoleMessage.prototype = {
+    /**
+     * @param {WebInspector.UILocation} uiLocation
+     */
+    _updateLocation: function(uiLocation)
+    {
+        if (this._uiLocation)
+            this._uiLocation.uiSourceCode.consoleMessageRemoved(this);
+        this._uiLocation = uiLocation;
+        this._uiLocation.uiSourceCode.consoleMessageAdded(this);
+    },
+
+    get lineNumber()
+    {
+        return this._uiLocation.lineNumber;
+    },
+
+    dispose: function()
+    {
+        this._liveLocation.dispose();
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/ProfilesPanel.js b/Source/WebCore/inspector/front-end/ProfilesPanel.js
index a821c9289..b6d096286 100644
--- a/Source/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/Source/WebCore/inspector/front-end/ProfilesPanel.js
@@ -57,8 +57,12 @@ WebInspector.ProfileType.prototype = {
         return this._name;
     },
 
+    /**
+     * @return {boolean}
+     */
     buttonClicked: function()
     {
+        return false;
     },
 
     viewForProfile: function(profile)
@@ -91,9 +95,10 @@ WebInspector.ProfileType.prototype = {
 
     // Must be implemented by subclasses.
     /**
+     * @param {string=} title
      * @return {WebInspector.ProfileHeader}
      */
-    createTemporaryProfile: function()
+    createTemporaryProfile: function(title)
     {
         throw new Error("Needs implemented.");
     },
@@ -134,6 +139,7 @@ WebInspector.ProfileHeader = function(profileType, title, uid)
         this.uid = uid;
         this.isTemporary = false;
     }
+    this._fromFile = false;
 }
 
 WebInspector.ProfileHeader.prototype = {
@@ -145,9 +151,24 @@ WebInspector.ProfileHeader.prototype = {
     /**
      * @return {boolean}
      */
-    canSave: function() { return false; },
+    canSaveToFile: function() { return false; },
+
+    saveToFile: function() { throw new Error("Needs implemented"); },
+
+    /**
+     * @return {boolean}
+     */
+    canLoadFromFile: function() { return false; },
+
+    /**
+     * @param {File} file
+     */
+    loadFromFile: function(file) { throw new Error("Needs implemented"); },
 
-    save: function() { throw new Error("Needs implemented"); }
+    /**
+     * @return {boolean}
+     */
+    fromFile: function() { return this._fromFile; }
 }
 
 /**
@@ -210,6 +231,11 @@ WebInspector.ProfilesPanel = function()
 
     if (!Capabilities.profilerCausesRecompilation || WebInspector.settings.profilerEnabled.get())
         ProfilerAgent.enable(this._profilerWasEnabled.bind(this));
+
+    this._createFileSelectorElement();
+    this.element.addEventListener("contextmenu", this._handleContextMenuEvent.bind(this), true);
+
+    WebInspector.ObjectPropertiesSection.addContextMenuProvider(new WebInspector.RevealInHeapSnapshotContextMenuProvider());
 }
 
 WebInspector.ProfilesPanel.EventTypes = {
@@ -218,6 +244,42 @@ WebInspector.ProfilesPanel.EventTypes = {
 }
 
 WebInspector.ProfilesPanel.prototype = {
+    _createFileSelectorElement: function()
+    {
+        if (this._fileSelectorElement)
+            this.element.removeChild(this._fileSelectorElement);
+
+        var fileSelectorElement = document.createElement("input");
+        fileSelectorElement.type = "file";
+        fileSelectorElement.style.zIndex = -1;
+        fileSelectorElement.style.position = "absolute";
+        fileSelectorElement.onchange = this._loadFromFile.bind(this);
+        this.element.appendChild(fileSelectorElement);
+        this._fileSelectorElement = fileSelectorElement;
+    },
+
+    _loadFromFile: function(event)
+    {
+        var file = this._fileSelectorElement.files[0];
+        if (!file.name.endsWith(".heapsnapshot")) {
+            WebInspector.log(WebInspector.UIString("Only heap snapshots from files with extension '.heapsnapshot' can be loaded."));
+            return;
+        }
+
+        if (!!this.findTemporaryProfile(WebInspector.HeapSnapshotProfileType.TypeId)) {
+            WebInspector.log(WebInspector.UIString("Can't load profile when other profile is recording."));
+            return;
+        }
+
+        var profileType = this.getProfileType(WebInspector.HeapSnapshotProfileType.TypeId);
+        var temporaryProfile = profileType.createTemporaryProfile(UserInitiatedProfileName + "." + file.name);
+        this.addProfileHeader(temporaryProfile);
+
+        temporaryProfile._fromFile = true;
+        temporaryProfile.loadFromFile(file);
+        this._createFileSelectorElement();
+    },
+
     get toolbarItemLabel()
     {
         return WebInspector.UIString("Profiles");
@@ -230,7 +292,8 @@ WebInspector.ProfilesPanel.prototype = {
 
     toggleRecordButton: function()
     {
-        this._selectedProfileType.buttonClicked();
+        var isProfiling = this._selectedProfileType.buttonClicked();
+        this.dispatchEventToListeners(isProfiling ? WebInspector.ProfilesPanel.EventTypes.ProfileStarted : WebInspector.ProfilesPanel.EventTypes.ProfileFinished);
     },
 
     wasShown: function()
@@ -342,12 +405,17 @@ WebInspector.ProfilesPanel.prototype = {
     _handleContextMenuEvent: function(event)
     {
         var element = event.srcElement;
-        while (element && !element.treeElement)
+        while (element && !element.treeElement && element !== this.element)
             element = element.parentElement;
         if (!element)
             return;
-        if (element.treeElement.handleContextMenuEvent)
+        if (element.treeElement && element.treeElement.handleContextMenuEvent) {
             element.treeElement.handleContextMenuEvent(event);
+            return;
+        }
+        var contextMenu = new WebInspector.ContextMenu();
+        contextMenu.appendItem(WebInspector.UIString("Load profile\u2026"), this._fileSelectorElement.click.bind(this._fileSelectorElement));
+        contextMenu.show(event);
     },
 
     /**
@@ -436,14 +504,7 @@ WebInspector.ProfilesPanel.prototype = {
             if (!this.visibleView)
                 this.showProfile(profile);
             this.dispatchEventToListeners("profile added");
-            this.dispatchEventToListeners(WebInspector.ProfilesPanel.EventTypes.ProfileFinished);
-            this.recordButton.toggled = false;
-        } else {
-            this.dispatchEventToListeners(WebInspector.ProfilesPanel.EventTypes.ProfileStarted);
-            this.recordButton.toggled = true;
         }
-
-        this.recordButton.title = this._selectedProfileType.buttonTooltip;
     },
 
     /**
@@ -523,6 +584,26 @@ WebInspector.ProfilesPanel.prototype = {
     },
 
     /**
+     * @param {ProfilerAgent.HeapSnapshotObjectId} snapshotObjectId
+     * @param {string} viewName
+     */
+    showObject: function(snapshotObjectId, viewName)
+    {
+        var heapProfiles = this.getProfiles(WebInspector.HeapSnapshotProfileType.TypeId);
+        for (var i = 0; i < heapProfiles.length; i++) {
+            var profile = heapProfiles[i];
+            // TODO: allow to choose snapshot if there are several options.
+            if (profile.maxJSObjectId >= snapshotObjectId) {
+                this.showProfile(profile);
+                profile._profileView.changeView(viewName, function() {
+                    profile._profileView.dataGrid.highlightObjectByHeapSnapshotId(snapshotObjectId);
+                });
+                break;
+            }
+        }
+    },
+
+    /**
      * @param {string} typeId
      * @return {WebInspector.ProfileHeader}
      */
@@ -564,18 +645,6 @@ WebInspector.ProfilesPanel.prototype = {
 
     /**
      * @param {number} uid
-     * @param {Function} callback
-     */
-    loadHeapSnapshot: function(uid, callback)
-    {
-        var profile = this._profilesIdMap[this._makeKey(uid, WebInspector.HeapSnapshotProfileType.TypeId)];
-        if (!profile)
-            return;
-        profile.load(callback);
-    },
-
-    /**
-     * @param {number} uid
      * @param {string} chunk
      */
     _addHeapSnapshotChunk: function(uid, chunk)
@@ -950,6 +1019,9 @@ WebInspector.ProfilesPanel.prototype = {
             this.addProfileHeader(temporaryProfile);
         else
             this._removeTemporaryProfile(profileType);
+        this.recordButton.toggled = isProfiling;
+        this.recordButton.title = profileTypeObject.buttonTooltip;
+        this.dispatchEventToListeners(isProfiling ? WebInspector.ProfilesPanel.EventTypes.ProfileStarted : WebInspector.ProfilesPanel.EventTypes.ProfileFinished);
     },
 
     takeHeapSnapshot: function()
@@ -959,7 +1031,11 @@ WebInspector.ProfilesPanel.prototype = {
             var profileTypeObject = this.getProfileType(WebInspector.HeapSnapshotProfileType.TypeId);
             this.addProfileHeader(profileTypeObject.createTemporaryProfile());
         }
-        ProfilerAgent.takeHeapSnapshot();
+        this.dispatchEventToListeners(WebInspector.ProfilesPanel.EventTypes.ProfileStarted);
+        function done() {
+            this.dispatchEventToListeners(WebInspector.ProfilesPanel.EventTypes.ProfileFinished);
+        }
+        ProfilerAgent.takeHeapSnapshot(done.bind(this));
         WebInspector.userMetrics.ProfilesHeapProfileTaken.record();
     },
 
@@ -981,6 +1057,53 @@ WebInspector.ProfilesPanel.prototype = {
 
 WebInspector.ProfilesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
+
+/**
+ * @implements {WebInspector.ObjectPropertiesSection.ContextMenuProvider}
+ * @constructor
+ */
+WebInspector.RevealInHeapSnapshotContextMenuProvider = function()
+{
+}
+
+WebInspector.RevealInHeapSnapshotContextMenuProvider.prototype = {
+    /**
+     * @override
+     * @param {WebInspector.ObjectPropertiesSection} section
+     * @param {WebInspector.ContextMenu} contextMenu
+     */
+    populateContextMenu: function(section, contextMenu)
+    {
+        if (WebInspector.inspectorView.currentPanel() !== WebInspector.panels.profiles)
+            return;
+
+        var objectId = section.object.objectId;
+        if (!objectId)
+            return;
+
+        var heapProfiles = WebInspector.panels.profiles.getProfiles(WebInspector.HeapSnapshotProfileType.TypeId);
+        if (!heapProfiles.length)
+            return;
+
+        function revealInView(viewName)
+        {
+            ProfilerAgent.getHeapObjectId(objectId, didReceiveHeapObjectId.bind(this, viewName));
+        }
+
+        function didReceiveHeapObjectId(viewName, error, result)
+        {
+            if (WebInspector.inspectorView.currentPanel() !== WebInspector.panels.profiles)
+                return;
+            if (!error)
+                WebInspector.panels.profiles.showObject(result, viewName);
+        }
+
+        contextMenu.appendItem(WebInspector.UIString("Reveal in Dominators View"), revealInView.bind(this, "Dominators"));
+        contextMenu.appendItem(WebInspector.UIString("Reveal in Summary View"), revealInView.bind(this, "Summary"));
+    }
+}
+
+
 /**
  * @constructor
  * @implements {ProfilerAgent.Dispatcher}
@@ -1109,10 +1232,10 @@ WebInspector.ProfileSidebarTreeElement.prototype = {
     handleContextMenuEvent: function(event)
     {
         var profile = this.profile;
-        if (!profile.canSave())
-            return;
         var contextMenu = new WebInspector.ContextMenu();
-        contextMenu.appendItem(WebInspector.UIString("Save profile"), profile.save.bind(profile));
+        if (profile.canSaveToFile())
+            contextMenu.appendItem(WebInspector.UIString("Save profile\u2026"), profile.saveToFile.bind(profile));
+        contextMenu.appendItem(WebInspector.UIString("Load profile\u2026"), WebInspector.panels.profiles._fileSelectorElement.click.bind(WebInspector.panels.profiles._fileSelectorElement));
         contextMenu.show(event);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/RawSourceCode.js b/Source/WebCore/inspector/front-end/RawSourceCode.js
index 5cca8f101..438c78161 100644
--- a/Source/WebCore/inspector/front-end/RawSourceCode.js
+++ b/Source/WebCore/inspector/front-end/RawSourceCode.js
@@ -38,26 +38,23 @@
  * @param {WebInspector.Script} script
  * @param {WebInspector.Resource} resource
  * @param {WebInspector.NetworkRequest} request
- * @param {WebInspector.ScriptFormatter} formatter
- * @param {boolean} formatted
+ * @param {WebInspector.SourceMapping} sourceMapping
  */
-WebInspector.RawSourceCode = function(id, script, resource, request, formatter, formatted)
+WebInspector.RawSourceCode = function(id, script, resource, request, sourceMapping)
 {
     this.id = id;
     this.url = script.sourceURL;
     this.isContentScript = script.isContentScript;
     this._scripts = [script];
-    this._formatter = formatter;
-    this._formatted = formatted;
     this._resource = resource;
     this._pendingRequest = request;
+    this._sourceMapping = sourceMapping;
 
-    this._hasNewScripts = true;
-
+    this._uiSourceCode = null;
     if (this._pendingRequest)
         this._pendingRequest.addEventListener(WebInspector.NetworkRequest.Events.FinishedLoading, this._finishedLoading, this);
     else
-        this._updateSourceMapping();
+        this._uiSourceCode = this._createUISourceCode();
 }
 
 WebInspector.RawSourceCode.Events = {
@@ -71,7 +68,6 @@ WebInspector.RawSourceCode.prototype = {
     addScript: function(script)
     {
         this._scripts.push(script);
-        this._hasNewScripts = true;
     },
 
     /**
@@ -80,201 +76,36 @@ WebInspector.RawSourceCode.prototype = {
      */
     rawLocationToUILocation: function(rawLocation)
     {
-        if (this._sourceMapping)
-            return this._sourceMapping.rawLocationToUILocation(rawLocation);
-        return null;
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {number} lineNumber
-     * @param {number} columnNumber
-     * @return {DebuggerAgent.Location}
-     */
-    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
-    {
-        if (this._sourceMapping)
-            return this._sourceMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
-        return null;
-    },
-
-    /**
-     * @return {WebInspector.UISourceCode|null}
-     */
-    uiSourceCode: function()
-    {
-        if (this._sourceMapping)
-            return this._sourceMapping.uiSourceCode();
-        return null;
-    },
-
-    /**
-     * @param {boolean} formatted
-     */
-    setFormatted: function(formatted)
-    {
-        if (this._formatted === formatted)
-            return;
-        this._formatted = formatted;
-        this._updateSourceMapping();
-    },
-
-    _finishedLoading: function(event)
-    {
-        this._resource = WebInspector.resourceForURL(this._pendingRequest.url);
-        delete this._pendingRequest;
-        this._updateSourceMapping();
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     */
-    forceUpdateSourceMapping: function(script)
-    {
-        if (!this._pendingRequest || !this._hasNewScripts)
-            return;
-        this._hasNewScripts = false;
-        this._updateSourceMapping();
-    },
-
-    _updateSourceMapping: function()
-    {
-        if (this._updatingSourceMapping) {
-            this._updateNeeded = true;
-            return;
+        var uiSourceCode = this._uiSourceCode || this._temporaryUISourceCode;
+        if (!uiSourceCode) {
+            this._temporaryUISourceCode = this._createUISourceCode();
+            uiSourceCode = this._temporaryUISourceCode;
+            this.dispatchEventToListeners(WebInspector.RawSourceCode.Events.UISourceCodeChanged, { uiSourceCode: uiSourceCode });
         }
-        this._updatingSourceMapping = true;
-        this._updateNeeded = false;
-
-        this._createSourceMapping(didCreateSourceMapping.bind(this));
-
-        /**
-         * @this {WebInspector.RawSourceCode}
-         * @param {WebInspector.RawSourceCode.SourceMapping} sourceMapping
-         */
-        function didCreateSourceMapping(sourceMapping)
-        {
-            this._updatingSourceMapping = false;
-            if (sourceMapping && !this._updateNeeded)
-                this._saveSourceMapping(sourceMapping);
-            else
-                this._updateSourceMapping();
-        }
-    },
-
-    _createContentProvider: function()
-    {
-        if (this._resource)
-            return this._resource;
-        if (this._scripts.length === 1 && !this._scripts[0].lineOffset && !this._scripts[0].columnOffset)
-            return this._scripts[0];
-        return new WebInspector.ConcatenatedScriptsContentProvider(this._scripts);
+        return new WebInspector.UILocation(uiSourceCode, rawLocation.lineNumber, rawLocation.columnNumber || 0);
     },
 
     /**
-     * @param {function(WebInspector.RawSourceCode.SourceMapping)} callback
+     * @return {WebInspector.UISourceCode}
      */
-    _createSourceMapping: function(callback)
+    _createUISourceCode: function()
     {
-        var originalContentProvider = this._createContentProvider();
-        if (!this._formatted) {
-            var uiSourceCode = this._createUISourceCode(this.url, this.url, originalContentProvider);
-            var sourceMapping = new WebInspector.RawSourceCode.PlainSourceMapping(this, uiSourceCode);
-            callback(sourceMapping);
-            return;
-        }
+        var isStandaloneScript = this._scripts.length === 1 && !this._scripts[0].isInlineScript();
 
-        /**
-         * @this {WebInspector.RawSourceCode}
-         * @param {?string} content
-         * @param {boolean} contentEncoded
-         * @param {string} mimeType
-         */
-        function didRequestContent(content, contentEncoded, mimeType)
-        {
-            /**
-             * @this {WebInspector.RawSourceCode}
-             * @param {string} formattedContent
-             * @param {WebInspector.FormattedSourceMapping} mapping
-             */
-            function didFormatContent(formattedContent, mapping)
-            {
-                var contentProvider = new WebInspector.StaticContentProvider(mimeType, formattedContent)
-                var uiSourceCode = this._createUISourceCode("deobfuscated:" + this.url, this.url, contentProvider);
-                var sourceMapping = new WebInspector.RawSourceCode.FormattedSourceMapping(this, uiSourceCode, mapping);
-                callback(sourceMapping);
-            }
-            this._formatter.formatContent(mimeType, content || "", didFormatContent.bind(this));
-        }
-        originalContentProvider.requestContent(didRequestContent.bind(this));
-    },
+        var contentProvider;
+        if (this._resource)
+            contentProvider = this._resource;
+        else if (isStandaloneScript)
+            contentProvider = this._scripts[0];
+        else
+            contentProvider = new WebInspector.ConcatenatedScriptsContentProvider(this._scripts);
 
-    /**
-     * @param {string} id
-     * @param {string} url
-     * @param {WebInspector.ContentProvider} contentProvider
-     */
-    _createUISourceCode: function(id, url, contentProvider)
-    {
-        var uiSourceCode = new WebInspector.JavaScriptSource(id, url, contentProvider);
+        var uiSourceCode = new WebInspector.JavaScriptSource(this.url, contentProvider, this._sourceMapping, isStandaloneScript);
         uiSourceCode.isContentScript = this.isContentScript;
-        uiSourceCode.isEditable = this._scripts.length === 1 && !this._scripts[0].lineOffset && !this._scripts[0].columnOffset && !this._formatted;
         return uiSourceCode;
     },
 
     /**
-     * @param {WebInspector.RawSourceCode.SourceMapping} sourceMapping
-     */
-    _saveSourceMapping: function(sourceMapping)
-    {
-        var oldUISourceCode;
-        if (this._sourceMapping)
-            oldUISourceCode = this._sourceMapping.uiSourceCode();
-        this._sourceMapping = sourceMapping;
-        this.dispatchEventToListeners(WebInspector.RawSourceCode.Events.UISourceCodeChanged, { oldUISourceCode: oldUISourceCode });
-    }
-}
-
-WebInspector.RawSourceCode.prototype.__proto__ = WebInspector.Object.prototype;
-
-/**
- * @interface
- * @extends {WebInspector.SourceMapping}
- */
-WebInspector.RawSourceCode.SourceMapping = function()
-{
-}
-
-WebInspector.RawSourceCode.SourceMapping.prototype = {
-    /**
-     * @return {WebInspector.UISourceCode}
-     */
-    uiSourceCode: function() { }
-}
-
-/**
- * @constructor
- * @implements {WebInspector.RawSourceCode.SourceMapping}
- * @param {WebInspector.RawSourceCode} rawSourceCode
- * @param {WebInspector.UISourceCode} uiSourceCode
- */
-WebInspector.RawSourceCode.PlainSourceMapping = function(rawSourceCode, uiSourceCode)
-{
-    this._rawSourceCode = rawSourceCode;
-    this._uiSourceCode = uiSourceCode;
-}
-
-WebInspector.RawSourceCode.PlainSourceMapping.prototype = {
-    /**
-     * @param {DebuggerAgent.Location} rawLocation
-     * @return {WebInspector.UILocation}
-     */
-    rawLocationToUILocation: function(rawLocation)
-    {
-        return new WebInspector.UILocation(this._uiSourceCode, rawLocation.lineNumber, rawLocation.columnNumber || 0);
-    },
-
-    /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      * @param {number} lineNumber
      * @param {number} columnNumber
@@ -282,61 +113,27 @@ WebInspector.RawSourceCode.PlainSourceMapping.prototype = {
      */
     uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
     {
-        console.assert(uiSourceCode === this._uiSourceCode);
-        return WebInspector.debuggerModel.createRawLocation(this._rawSourceCode._scripts[0], lineNumber, columnNumber);
+        if (this.url)
+            return WebInspector.debuggerModel.createRawLocationByURL(this.url, lineNumber, columnNumber);
+        return WebInspector.debuggerModel.createRawLocation(this._scripts[0], lineNumber, columnNumber);
     },
 
     /**
-     * @return {WebInspector.UISourceCode}
+     * @return {WebInspector.UISourceCode|null}
      */
     uiSourceCode: function()
     {
-        return this._uiSourceCode;
-    }
-}
-
-/**
- * @constructor
- * @implements {WebInspector.RawSourceCode.SourceMapping}
- * @param {WebInspector.RawSourceCode} rawSourceCode
- * @param {WebInspector.UISourceCode} uiSourceCode
- * @param {WebInspector.FormattedSourceMapping} mapping
- */
-WebInspector.RawSourceCode.FormattedSourceMapping = function(rawSourceCode, uiSourceCode, mapping)
-{
-    this._rawSourceCode = rawSourceCode;
-    this._uiSourceCode = uiSourceCode;
-    this._mapping = mapping;
-}
-
-WebInspector.RawSourceCode.FormattedSourceMapping.prototype = {
-    /**
-     * @param {DebuggerAgent.Location} rawLocation
-     */
-    rawLocationToUILocation: function(rawLocation)
-    {
-        var location = this._mapping.originalToFormatted(rawLocation.lineNumber, rawLocation.columnNumber || 0);
-        return new WebInspector.UILocation(this._uiSourceCode, location[0], location[1]);
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {number} lineNumber
-     * @param {number} columnNumber
-     * @return {DebuggerAgent.Location}
-     */
-    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
-    {
-        console.assert(uiSourceCode === this._uiSourceCode);
-        var location = this._mapping.formattedToOriginal(lineNumber, columnNumber);
-        return WebInspector.debuggerModel.createRawLocation(this._rawSourceCode._scripts[0], location[0], location[1]);
+        return this._uiSourceCode || this._temporaryUISourceCode;
     },
 
-    /**
-     * @return {WebInspector.UISourceCode}
-     */
-    uiSourceCode: function()
+    _finishedLoading: function(event)
     {
-        return this._uiSourceCode;
+        this._resource = WebInspector.resourceForURL(this._pendingRequest.url);
+        delete this._pendingRequest;
+        var oldUISourceCode = this._uiSourceCode || this._temporaryUISourceCode;
+        this._uiSourceCode = this._createUISourceCode();
+        this.dispatchEventToListeners(WebInspector.RawSourceCode.Events.UISourceCodeChanged, { uiSourceCode: this._uiSourceCode, oldUISourceCode: oldUISourceCode });
     }
 }
+
+WebInspector.RawSourceCode.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/RequestHeadersView.js b/Source/WebCore/inspector/front-end/RequestHeadersView.js
index 3118b3761..75cb0245f 100644
--- a/Source/WebCore/inspector/front-end/RequestHeadersView.js
+++ b/Source/WebCore/inspector/front-end/RequestHeadersView.js
@@ -269,7 +269,7 @@ WebInspector.RequestHeadersView.prototype = {
     {
         var additionalRow = null;
         if (typeof this._request.webSocketRequestKey3 !== "undefined")
-            additionalRow = {header: "(Key3)", value: this._request.webSocketRequestKey3};
+            additionalRow = {name: "(Key3)", value: this._request.webSocketRequestKey3};
         if (this._showRequestHeadersText)
             this._refreshHeadersText(WebInspector.UIString("Request Headers"), this._request.sortedRequestHeaders, this._request.requestHeadersText, this._requestHeadersTreeElement);
         else
@@ -288,7 +288,7 @@ WebInspector.RequestHeadersView.prototype = {
     {
         var additionalRow = null;
         if (typeof this._request.webSocketChallengeResponse !== "undefined")
-            additionalRow = {header: "(Challenge Response)", value: this._request.webSocketChallengeResponse};
+            additionalRow = {name: "(Challenge Response)", value: this._request.webSocketChallengeResponse};
         if (this._showResponseHeadersText)
             this._refreshHeadersText(WebInspector.UIString("Response Headers"), this._request.sortedResponseHeaders, this._request.responseHeadersText, this._responseHeadersTreeElement);
         else
@@ -354,14 +354,14 @@ WebInspector.RequestHeadersView.prototype = {
         headersTreeElement.hidden = !length;
         for (var i = 0; i < length; ++i) {
             var headerTreeElement = new TreeElement(null, null, false);
-            headerTreeElement.title = this._formatHeader(headers[i].header, headers[i].value);
+            headerTreeElement.title = this._formatHeader(headers[i].name, headers[i].value);
             headerTreeElement.selectable = false;
             headersTreeElement.appendChild(headerTreeElement);
         }
 
         if (additionalRow) {
             var headerTreeElement = new TreeElement(null, null, false);
-            headerTreeElement.title = this._formatHeader(additionalRow.header, additionalRow.value);
+            headerTreeElement.title = this._formatHeader(additionalRow.name, additionalRow.value);
             headerTreeElement.selectable = false;
             headersTreeElement.appendChild(headerTreeElement);
         }
diff --git a/Source/WebCore/inspector/front-end/Resource.js b/Source/WebCore/inspector/front-end/Resource.js
index 2a9d9caaa..286645da5 100644
--- a/Source/WebCore/inspector/front-end/Resource.js
+++ b/Source/WebCore/inspector/front-end/Resource.js
@@ -368,6 +368,14 @@ WebInspector.Resource.prototype = {
     },
 
     /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function()
+    {
+        return this.type;
+    },
+
+    /**
      * @param {function(?string, boolean, string)} callback
      */
     requestContent: function(callback)
@@ -383,13 +391,7 @@ WebInspector.Resource.prototype = {
 
     canonicalMimeType: function()
     {
-        if (this.type === WebInspector.resourceTypes.Document)
-            return "text/html";
-        if (this.type === WebInspector.resourceTypes.Script)
-            return "text/javascript";
-        if (this.type === WebInspector.resourceTypes.Stylesheet)
-            return "text/css";
-        return this.mimeType;
+        return this.type.canonicalMimeType() || this.mimeType;
     },
 
     /**
@@ -526,6 +528,14 @@ WebInspector.ResourceRevision.prototype = {
     },
 
     /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function()
+    {
+        return this._resource.contentType();
+    },
+
+    /**
      * @param {function(?string, boolean, string)} callback
      */
     requestContent: function(callback)
diff --git a/Source/WebCore/inspector/front-end/ResourceScriptMapping.js b/Source/WebCore/inspector/front-end/ResourceScriptMapping.js
index 20b91fe08..8e1ff5944 100644
--- a/Source/WebCore/inspector/front-end/ResourceScriptMapping.js
+++ b/Source/WebCore/inspector/front-end/ResourceScriptMapping.js
@@ -30,7 +30,9 @@
 
 /**
  * @constructor
- * @extends {WebInspector.ScriptMapping}
+ * @extends {WebInspector.Object}
+ * @implements {WebInspector.SourceMapping}
+ * @implements {WebInspector.UISourceCodeProvider}
  */
 WebInspector.ResourceScriptMapping = function()
 {
@@ -39,8 +41,6 @@ WebInspector.ResourceScriptMapping = function()
     this._rawSourceCodeForURL = {};
     this._rawSourceCodeForDocumentURL = {};
     this._rawSourceCodeForUISourceCode = new Map();
-    this._formatter = new WebInspector.ScriptFormatter();
-    this._formatSource = false;
 }
 
 WebInspector.ResourceScriptMapping.prototype = {
@@ -69,7 +69,7 @@ WebInspector.ResourceScriptMapping.prototype = {
     /**
      * @return {Array.<WebInspector.UISourceCode>}
      */
-    uiSourceCodeList: function()
+    uiSourceCodes: function()
     {
         var result = [];
         for (var i = 0; i < this._rawSourceCodes.length; ++i) {
@@ -114,14 +114,14 @@ WebInspector.ResourceScriptMapping.prototype = {
             }
         }
 
-        var rawSourceCode = new WebInspector.RawSourceCode(script.scriptId, script, resource, request, this._formatter, this._formatSource);
+        var rawSourceCode = new WebInspector.RawSourceCode(script.scriptId, script, resource, request, this);
         this._rawSourceCodes.push(rawSourceCode);
         this._bindScriptToRawSourceCode(script, rawSourceCode);
         if (isInlineScript)
             this._rawSourceCodeForDocumentURL[script.sourceURL] = rawSourceCode;
 
         if (rawSourceCode.uiSourceCode())
-            this._uiSourceCodeChanged(rawSourceCode, null, rawSourceCode.uiSourceCode());
+            this._uiSourceCodeAdded(rawSourceCode, rawSourceCode.uiSourceCode());
         rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.UISourceCodeChanged, this._handleUISourceCodeChanged, this);
     },
 
@@ -131,72 +131,67 @@ WebInspector.ResourceScriptMapping.prototype = {
     _handleUISourceCodeChanged: function(event)
     {
         var rawSourceCode = /** @type {WebInspector.RawSourceCode} */ event.target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data.uiSourceCode;
         var oldUISourceCode = /** @type {WebInspector.UISourceCode} */ event.data.oldUISourceCode;
-        this._uiSourceCodeChanged(rawSourceCode, oldUISourceCode, rawSourceCode.uiSourceCode());
+        if (!oldUISourceCode)
+            this._uiSourceCodeAdded(rawSourceCode, uiSourceCode);
+        else
+            this._uiSourceCodeReplaced(rawSourceCode, oldUISourceCode, uiSourceCode);
     },
 
     /**
      * @param {WebInspector.RawSourceCode} rawSourceCode
-     * @param {WebInspector.UISourceCode} removedItem
-     * @param {WebInspector.UISourceCode} addedItem
+     * @paran {WebInspector.UISourceCode} uiSourceCode
      */
-    _uiSourceCodeChanged: function(rawSourceCode, removedItem, addedItem)
+    _uiSourceCodeAdded: function(rawSourceCode, uiSourceCode)
     {
-        if (removedItem)
-            this._rawSourceCodeForUISourceCode.remove(removedItem);
-        if (addedItem)
-            this._rawSourceCodeForUISourceCode.put(addedItem, rawSourceCode);
-
-        var scriptIds = [];
-        for (var i = 0; i < rawSourceCode._scripts.length; ++i) {
-            scriptIds.push(rawSourceCode._scripts[i].scriptId);
-            rawSourceCode._scripts[i].setSourceMapping(this);
-        }
-        var removedItems = removedItem ? [removedItem] : [];
-        var addedItems = addedItem ? [addedItem] : [];
-
-        var data = { removedItems: removedItems, addedItems: addedItems };
-        this.dispatchEventToListeners(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, data);
+        this._rawSourceCodeForUISourceCode.put(uiSourceCode, rawSourceCode);
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, uiSourceCode);
     },
 
     /**
-     * @param {WebInspector.Script} script
      * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @param {WebInspector.UISourceCode} oldUISourceCode
+     * @param {WebInspector.UISourceCode} uiSourceCode
      */
-    _bindScriptToRawSourceCode: function(script, rawSourceCode)
+    _uiSourceCodeReplaced: function(rawSourceCode, oldUISourceCode, uiSourceCode)
     {
-        this._rawSourceCodeForScriptId[script.scriptId] = rawSourceCode;
-        this._rawSourceCodeForURL[script.sourceURL] = rawSourceCode;
-        script.setSourceMapping(this);
+        this._rawSourceCodeForUISourceCode.remove(oldUISourceCode);
+        this._rawSourceCodeForUISourceCode.put(uiSourceCode, rawSourceCode);
+
+        for (var i = 0; i < rawSourceCode._scripts.length; ++i)
+            rawSourceCode._scripts[i].setSourceMapping(this);
+
+        var data = { oldUISourceCode: oldUISourceCode, uiSourceCode: uiSourceCode };
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, data);
     },
 
     /**
-     * @param {boolean} formatSource
+     * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @paran {WebInspector.UISourceCode} uiSourceCode
      */
-    setFormatSource: function(formatSource)
+    _uiSourceCodeRemoved: function(rawSourceCode, uiSourceCode)
     {
-        if (this._formatSource === formatSource)
-            return;
-
-        this._formatSource = formatSource;
-        for (var i = 0; i < this._rawSourceCodes.length; ++i)
-            this._rawSourceCodes[i].setFormatted(this._formatSource);
+        this._rawSourceCodeForUISourceCode.remove(uiSourceCode);
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, uiSourceCode);
     },
 
     /**
-     * @param {DebuggerAgent.Location} rawLocation
+     * @param {WebInspector.Script} script
+     * @param {WebInspector.RawSourceCode} rawSourceCode
      */
-    forceUpdateSourceMapping: function(rawLocation)
+    _bindScriptToRawSourceCode: function(script, rawSourceCode)
     {
-        var rawSourceCode = this._rawSourceCodeForScriptId[rawLocation.scriptId];
-        rawSourceCode.forceUpdateSourceMapping();
+        this._rawSourceCodeForScriptId[script.scriptId] = rawSourceCode;
+        this._rawSourceCodeForURL[script.sourceURL] = rawSourceCode;
+        script.setSourceMapping(this);
     },
 
     reset: function()
     {
         for (var i = 0; i < this._rawSourceCodes.length; ++i) {
             var rawSourceCode = this._rawSourceCodes[i];
-            this._uiSourceCodeChanged(rawSourceCode, rawSourceCode.uiSourceCode(), null);
+            this._uiSourceCodeRemoved(rawSourceCode, rawSourceCode.uiSourceCode());
             rawSourceCode.removeAllListeners();
         }
         this._rawSourceCodes = [];
@@ -207,4 +202,4 @@ WebInspector.ResourceScriptMapping.prototype = {
     }
 }
 
-WebInspector.ResourceScriptMapping.prototype.__proto__ = WebInspector.ScriptMapping.prototype;
+WebInspector.ResourceScriptMapping.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourceType.js b/Source/WebCore/inspector/front-end/ResourceType.js
index 1329fdc26..2f88a6bbb 100644
--- a/Source/WebCore/inspector/front-end/ResourceType.js
+++ b/Source/WebCore/inspector/front-end/ResourceType.js
@@ -91,6 +91,20 @@ WebInspector.ResourceType.prototype = {
     toString: function()
     {
         return this._name;
+    },
+
+    /**
+     * @return {string}
+     */
+    canonicalMimeType: function()
+    {
+        if (this === WebInspector.resourceTypes.Document)
+            return "text/html";
+        if (this === WebInspector.resourceTypes.Script)
+            return "text/javascript";
+        if (this === WebInspector.resourceTypes.Stylesheet)
+            return "text/css";
+        return "";
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ResourceView.js b/Source/WebCore/inspector/front-end/ResourceView.js
index 07ecc5413..94a2411f9 100644
--- a/Source/WebCore/inspector/front-end/ResourceView.js
+++ b/Source/WebCore/inspector/front-end/ResourceView.js
@@ -83,7 +83,7 @@ WebInspector.ResourceView.nonSourceViewForResource = function(resource)
 WebInspector.ResourceSourceFrame = function(resource)
 {
     this._resource = resource;
-    WebInspector.SourceFrame.call(this, resource.url);
+    WebInspector.SourceFrame.call(this, resource);
     this._resource.addEventListener(WebInspector.Resource.Events.RevisionAdded, this._contentChanged, this);
 }
 
@@ -93,23 +93,6 @@ WebInspector.ResourceSourceFrame.prototype = {
         return this._resource;
     },
 
-    /**
-     * @param {function(?string,boolean,string)} callback
-     */
-    requestContent: function(callback)
-    {
-        /**
-         * @param {?string} content
-         * @param {boolean} contentEncoded
-         * @param {string} mimeType
-         */
-        function callbackWrapper(content, contentEncoded, mimeType)
-        {
-            callback(content, contentEncoded, mimeType);
-        }
-        this.resource.requestContent(callbackWrapper.bind(this));
-    },
-
     _contentChanged: function(event)
     {
         this.setContent(this._resource.content, false, this._resource.canonicalMimeType());
@@ -132,25 +115,31 @@ WebInspector.EditableResourceSourceFrame.Events = {
 }
 
 WebInspector.EditableResourceSourceFrame.prototype = {
+    /**
+     * @return {boolean}
+     */
     canEditSource: function()
     {
         //FIXME: make live edit stop using resource content binding.
         return this._resource.isEditable() && this._resource.type === WebInspector.resourceTypes.Stylesheet;
     },
 
-    editContent: function(newText, callback)
+    /**
+     * @param {string} text
+     */
+    commitEditing: function(text)
     {
         this._clearIncrementalUpdateTimer();
         var majorChange = true;
         this._settingContent = true;
         function callbackWrapper(text)
         {
-            callback(text);
             delete this._settingContent;
+            this.dispatchEventToListeners(WebInspector.EditableResourceSourceFrame.Events.TextEdited, this);
         }
-        this.resource.setContent(newText, majorChange, callbackWrapper.bind(this));
+        this.resource.setContent(text, majorChange, callbackWrapper.bind(this));
     },
-
+    
     afterTextChanged: function(oldRange, newRange)
     {
         function commitIncrementalEdit()
@@ -176,12 +165,6 @@ WebInspector.EditableResourceSourceFrame.prototype = {
             WebInspector.ResourceSourceFrame.prototype._contentChanged.call(this, event);
     },
 
-    didEditContent: function(error, content)
-    {
-        WebInspector.SourceFrame.prototype.didEditContent.call(this, error, content);
-        this.dispatchEventToListeners(WebInspector.EditableResourceSourceFrame.Events.TextEdited, this);
-    },
-
     isDirty: function()
     {
         return this._resource.content !== this.textModel.text;
diff --git a/Source/WebCore/inspector/front-end/Script.js b/Source/WebCore/inspector/front-end/Script.js
index 285a10479..225e83407 100644
--- a/Source/WebCore/inspector/front-end/Script.js
+++ b/Source/WebCore/inspector/front-end/Script.js
@@ -58,6 +58,14 @@ WebInspector.Script.prototype = {
     },
 
     /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function()
+    {
+        return WebInspector.resourceTypes.Script;
+    },
+
+    /**
      * @param {function(?string,boolean,string)} callback
      */
     requestContent: function(callback)
@@ -146,7 +154,8 @@ WebInspector.Script.prototype = {
      */
     isInlineScript: function()
     {
-        return !!this.sourceURL && this.lineOffset !== 0 && this.columnOffset !== 0;
+        var startsAtZero = !this.lineOffset && !this.columnOffset;
+        return !!this.sourceURL && !startsAtZero;
     },
 
     /**
@@ -157,8 +166,7 @@ WebInspector.Script.prototype = {
     {
         console.assert(rawLocation.scriptId === this.scriptId);
         var uiLocation = this._sourceMapping.rawLocationToUILocation(rawLocation);
-        // FIXME: uiLocation will never be null after the next refactoring step.
-        return uiLocation ? uiLocation.uiSourceCode.overrideLocation(uiLocation) : null;
+        return uiLocation.uiSourceCode.overrideLocation(uiLocation);
     },
 
     /**
@@ -188,7 +196,6 @@ WebInspector.Script.prototype = {
 
 /**
  * @constructor
- * @implements {WebInspector.LiveLocation}
  * @param {WebInspector.Script} script
  * @param {DebuggerAgent.Location} rawLocation
  * @param {function(WebInspector.UILocation):(boolean|undefined)} updateDelegate
diff --git a/Source/WebCore/inspector/front-end/ScriptFormatter.js b/Source/WebCore/inspector/front-end/ScriptFormatter.js
index ff2fd908b..f98bed8b4 100644
--- a/Source/WebCore/inspector/front-end/ScriptFormatter.js
+++ b/Source/WebCore/inspector/front-end/ScriptFormatter.js
@@ -67,7 +67,7 @@ WebInspector.ScriptFormatter.prototype = {
     /**
      * @param {string} mimeType
      * @param {?string} content
-     * @param {function(string, WebInspector.FormattedSourceMapping)} callback
+     * @param {function(string, WebInspector.FormatterSourceMapping)} callback
      */
     formatContent: function(mimeType, content, callback)
     {
@@ -84,7 +84,7 @@ WebInspector.ScriptFormatter.prototype = {
         var originalContent = task.data.content;
         var formattedContent = event.data.content;
         var mapping = event.data["mapping"];
-        var sourceMapping = new WebInspector.FormattedSourceMapping(originalContent.lineEndings(), formattedContent.lineEndings(), mapping);
+        var sourceMapping = new WebInspector.FormatterSourceMappingImpl(originalContent.lineEndings(), formattedContent.lineEndings(), mapping);
         task.callback(formattedContent, sourceMapping);
     },
 
@@ -111,41 +111,95 @@ WebInspector.FormatterMappingPayload = function()
 }
 
 /**
+ * @interface
+ */
+WebInspector.FormatterSourceMapping = function()
+{
+}
+
+WebInspector.FormatterSourceMapping.prototype = {
+    /**
+     * @param {number} lineNumber
+     * @param {number=} columnNumber
+     * @return {Array.<number>}
+     */
+    originalToFormatted: function(lineNumber, columnNumber) { },
+
+    /**
+     * @param {number} lineNumber
+     * @param {number=} columnNumber
+     * @return {Array.<number>}
+     */
+    formattedToOriginal: function(lineNumber, columnNumber) { }
+}
+
+/**
+ * @constructor
+ * @implements {WebInspector.FormatterSourceMapping}
+ */
+WebInspector.IdentityFormatterSourceMapping = function()
+{
+}
+
+WebInspector.IdentityFormatterSourceMapping.prototype = {
+    /**
+     * @param {number} lineNumber
+     * @param {number=} columnNumber
+     * @return {Array.<number>}
+     */
+    originalToFormatted: function(lineNumber, columnNumber)
+    {
+        return [lineNumber, columnNumber || 0]; 
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {number=} columnNumber
+     * @return {Array.<number>}
+     */
+    formattedToOriginal: function(lineNumber, columnNumber)
+    {
+        return [lineNumber, columnNumber || 0];
+    }
+}
+
+/**
  * @constructor
+ * @implements {WebInspector.FormatterSourceMapping}
  * @param {Array.<number>} originalLineEndings
  * @param {Array.<number>} formattedLineEndings
  * @param {WebInspector.FormatterMappingPayload} mapping
  */
-WebInspector.FormattedSourceMapping = function(originalLineEndings, formattedLineEndings, mapping)
+WebInspector.FormatterSourceMappingImpl = function(originalLineEndings, formattedLineEndings, mapping)
 {
     this._originalLineEndings = originalLineEndings;
     this._formattedLineEndings = formattedLineEndings;
     this._mapping = mapping;
 }
 
-WebInspector.FormattedSourceMapping.prototype = {
+WebInspector.FormatterSourceMappingImpl.prototype = {
     /**
      * @param {number} lineNumber
-     * @param {number} columnNumber
+     * @param {number=} columnNumber
      * @return {Array.<number>}
      */
     originalToFormatted: function(lineNumber, columnNumber)
     {
-        var originalPosition = WebInspector.ScriptFormatter.locationToPosition(this._originalLineEndings, lineNumber, columnNumber);
-        var formattedPosition = this._convertPosition(this._mapping.original, this._mapping.formatted, originalPosition);
+        var originalPosition = WebInspector.ScriptFormatter.locationToPosition(this._originalLineEndings, lineNumber, columnNumber || 0);
+        var formattedPosition = this._convertPosition(this._mapping.original, this._mapping.formatted, originalPosition || 0);
         return WebInspector.ScriptFormatter.positionToLocation(this._formattedLineEndings, formattedPosition);
     },
 
     /**
      * @param {number} lineNumber
-     * @param {number} columnNumber
+     * @param {number=} columnNumber
      * @return {Array.<number>}
      */
     formattedToOriginal: function(lineNumber, columnNumber)
     {
-        var formattedPosition = WebInspector.ScriptFormatter.locationToPosition(this._formattedLineEndings, lineNumber, columnNumber);
+        var formattedPosition = WebInspector.ScriptFormatter.locationToPosition(this._formattedLineEndings, lineNumber, columnNumber || 0);
         var originalPosition = this._convertPosition(this._mapping.formatted, this._mapping.original, formattedPosition);
-        return WebInspector.ScriptFormatter.positionToLocation(this._originalLineEndings, originalPosition);
+        return WebInspector.ScriptFormatter.positionToLocation(this._originalLineEndings, originalPosition || 0);
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/ScriptMapping.js b/Source/WebCore/inspector/front-end/ScriptMapping.js
deleted file mode 100644
index 82f5f069a..000000000
--- a/Source/WebCore/inspector/front-end/ScriptMapping.js
+++ /dev/null
@@ -1,248 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * @constructor
- * @param {WebInspector.UISourceCode} uiSourceCode
- * @param {number} lineNumber
- * @param {number} columnNumber
- */
-WebInspector.UILocation = function(uiSourceCode, lineNumber, columnNumber)
-{
-    this.uiSourceCode = uiSourceCode;
-    this.lineNumber = lineNumber;
-    this.columnNumber = columnNumber;
-}
-
-/**
- * @interface
- */
-WebInspector.LiveLocation = function()
-{
-}
-
-WebInspector.LiveLocation.prototype = {
-    update: function(rawLocation) { },
-
-    dispose: function() { }
-}
-
-/**
- * @interface
- */
-WebInspector.SourceMapping = function()
-{
-}
-
-WebInspector.SourceMapping.prototype = {
-    /**
-     * @param {DebuggerAgent.Location} rawLocation
-     * @return {WebInspector.UILocation}
-     */
-    rawLocationToUILocation: function(rawLocation) { },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {number} lineNumber
-     * @param {number} columnNumber
-     * @return {DebuggerAgent.Location}
-     */
-    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber) { }
-}
-
-/**
- * @constructor
- * @extends {WebInspector.Object}
- * @implements {WebInspector.SourceMapping}
- */
-WebInspector.ScriptMapping = function()
-{
-}
-
-WebInspector.ScriptMapping.Events = {
-    UISourceCodeListChanged: "ui-source-code-list-changed"
-}
-
-WebInspector.ScriptMapping.prototype = {
-    /**
-     * @param {DebuggerAgent.Location} rawLocation
-     * @return {WebInspector.UILocation}
-     */
-    rawLocationToUILocation: function(rawLocation) {},
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {number} lineNumber
-     * @param {number} columnNumber
-     * @return {DebuggerAgent.Location}
-     */
-    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber) {},
-
-    /**
-     * @return {Array.<WebInspector.UISourceCode>}
-     */
-    uiSourceCodeList: function() {}
-}
-
-WebInspector.ScriptMapping.prototype.__proto__ = WebInspector.Object.prototype;
-
-/**
- * @constructor
- * @extends {WebInspector.Object}
- */
-WebInspector.MainScriptMapping = function()
-{
-    this._mappings = [];
-
-    this._resourceMapping = new WebInspector.ResourceScriptMapping();
-    this._mappings.push(this._resourceMapping);
-    this._compilerMapping = new WebInspector.CompilerScriptMapping();
-    this._mappings.push(this._compilerMapping);
-    this._snippetsMapping = new WebInspector.SnippetsScriptMapping();
-    this._mappings.push(this._snippetsMapping);
-
-    for (var i = 0; i < this._mappings.length; ++i)
-        this._mappings[i].addEventListener(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, this._handleUISourceCodeListChanged, this);
-
-    this._mappingForScriptId = {};
-    this._mappingForUISourceCode = new Map();
-}
-
-WebInspector.MainScriptMapping.Events = {
-    UISourceCodeListChanged: "ui-source-code-list-changed"
-}
-
-WebInspector.MainScriptMapping.prototype = {
-    /**
-     * @param {DebuggerAgent.Location} rawLocation
-     * @return {WebInspector.UILocation}
-     */
-    rawLocationToUILocation: function(rawLocation)
-    {
-        return this._mappingForScriptId[rawLocation.scriptId].rawLocationToUILocation(rawLocation);
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {number} lineNumber
-     * @param {number} columnNumber
-     * @return {DebuggerAgent.Location}
-     */
-    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
-    {
-        return this._mappingForUISourceCode.get(uiSourceCode).uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
-    },
-
-    /**
-     * @return {Array.<WebInspector.UISourceCode>}
-     */
-    uiSourceCodeList: function()
-    {
-        var result = [];
-        for (var i = 0; i < this._mappings.length; ++i) {
-            var uiSourceCodeList = this._mappings[i].uiSourceCodeList();
-            for (var j = 0; j < uiSourceCodeList.length; ++j)
-                result.push(uiSourceCodeList[j]);
-        }
-        return result;
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     */
-    addScript: function(script)
-    {
-        var mapping = this._mappingForScript(script);
-        this._mappingForScriptId[script.scriptId] = mapping;
-        mapping.addScript(script);
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     * @return {WebInspector.ScriptMapping}
-     */
-    _mappingForScript: function(script)
-    {
-        if (WebInspector.experimentsSettings.snippetsSupport.isEnabled()) {
-            if (WebInspector.snippetsModel.snippetIdForSourceURL(script.sourceURL))
-                return this._snippetsMapping;
-        }
-
-        if (WebInspector.settings.sourceMapsEnabled.get() && script.sourceMapURL) {
-            if (this._compilerMapping.loadSourceMapForScript(script))
-                return this._compilerMapping;
-        }
-
-        return this._resourceMapping;
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _handleUISourceCodeListChanged: function(event)
-    {
-        var scriptMapping = /** @type {WebInspector.ScriptMapping} */ event.target;
-        var removedItems = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["removedItems"];
-        var addedItems = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["addedItems"];
-
-        for (var i = 0; i < removedItems.length; ++i)
-            this._mappingForUISourceCode.remove(removedItems[i]);
-        for (var i = 0; i < addedItems.length; ++i)
-            this._mappingForUISourceCode.put(addedItems[i], scriptMapping);
-        this.dispatchEventToListeners(WebInspector.MainScriptMapping.Events.UISourceCodeListChanged, event.data);
-    },
-
-    /**
-     * @param {boolean} formatSource
-     */
-    setFormatSource: function(formatSource)
-    {
-        this._resourceMapping.setFormatSource(formatSource);
-    },
-
-    /**
-     * @param {DebuggerAgent.Location} rawLocation
-     */
-    forceUpdateSourceMapping: function(rawLocation)
-    {
-        if (this._mappingForScriptId[rawLocation.scriptId] === this._resourceMapping)
-            this._resourceMapping.forceUpdateSourceMapping(rawLocation);
-    },
-
-    reset: function()
-    {
-        for (var i = 0; i < this._mappings.length; ++i)
-            this._mappings[i].reset();
-        this._mappingForScriptId = {};
-        this._mappingForUISourceCode = new Map();
-    }
-}
-
-WebInspector.MainScriptMapping.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/ScriptSnippetModel.js b/Source/WebCore/inspector/front-end/ScriptSnippetModel.js
new file mode 100644
index 000000000..9b2371723
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/ScriptSnippetModel.js
@@ -0,0 +1,433 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.ScriptSnippetModel = function()
+{
+    this._uiSourceCodeForScriptId = {};
+    this._scriptForUISourceCode = new Map();
+    this._snippetJavaScriptSourceForSnippetId = {};
+    
+    this._snippetStorage = new WebInspector.SnippetStorage("script", "Script snippet #");
+    this._lastSnippetEvaluationIndexSetting = WebInspector.settings.createSetting("lastSnippetEvaluationIndex", 0);
+    this._snippetScriptMapping = new WebInspector.SnippetScriptMapping(this);
+    
+    var snippets = this._snippetStorage.snippets;
+    for (var i = 0; i < snippets.length; ++i)
+        this._addScriptSnippet(snippets[i]);
+}
+
+WebInspector.ScriptSnippetModel.evaluatedSnippetExtraLinesCount = 2;
+WebInspector.ScriptSnippetModel.snippetSourceURLPrefix = "snippets://";
+
+WebInspector.ScriptSnippetModel.prototype = {
+    /**
+     * @return {WebInspector.SnippetScriptMapping}
+     */
+    get scriptMapping()
+    {
+        return this._snippetScriptMapping;
+    },
+
+    /**
+     * @return {WebInspector.SnippetJavaScriptSource}
+     */
+    createScriptSnippet: function()
+    {
+        var snippet = this._snippetStorage.createSnippet();
+        return this._addScriptSnippet(snippet);
+    },
+
+    /**
+     * @param {WebInspector.Snippet} snippet
+     * @return {WebInspector.SnippetJavaScriptSource}
+     */
+    _addScriptSnippet: function(snippet)
+    {
+        var snippetJavaScriptSource = new WebInspector.SnippetJavaScriptSource(snippet.id, snippet.name, new WebInspector.SnippetContentProvider(snippet), this);
+        this._snippetJavaScriptSourceForSnippetId[snippet.id] = snippetJavaScriptSource;
+        this._snippetScriptMapping._fireUISourceCodeAdded(snippetJavaScriptSource);
+        return snippetJavaScriptSource;
+    },
+
+    /**
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
+     */
+    deleteScriptSnippet: function(snippetJavaScriptSource)
+    {
+        var snippet = this._snippetStorage.snippetForId(snippetJavaScriptSource.snippetId);
+        this._snippetStorage.deleteSnippet(snippet);
+        this._releaseSnippetScript(snippetJavaScriptSource);
+        delete this._snippetJavaScriptSourceForSnippetId[snippet.id];
+        this._snippetScriptMapping._fireUISourceCodeRemoved(snippetJavaScriptSource);
+    },
+
+    /**
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
+     * @param {string} newName
+     */
+    renameScriptSnippet: function(snippetJavaScriptSource, newName)
+    {
+        var snippet = this._snippetStorage.snippetForId(snippetJavaScriptSource.snippetId);
+        if (!snippet || !newName || snippet.name === newName)
+            return;
+        snippet.name = newName;
+        snippetJavaScriptSource.urlChanged(snippet.name);
+    },
+
+    /**
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
+     * @param {string} newContent
+     */
+    setScriptSnippetContent: function(snippetJavaScriptSource, newContent)
+    {
+        var snippet = this._snippetStorage.snippetForId(snippetJavaScriptSource.snippetId);
+        snippet.content = newContent;
+        snippetJavaScriptSource.contentChanged(newContent);
+    },
+
+    /**
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
+     */
+    evaluateScriptSnippet: function(snippetJavaScriptSource)
+    {
+        this._releaseSnippetScript(snippetJavaScriptSource);
+        var evaluationIndex = this._lastSnippetEvaluationIndexSetting.get() + 1;
+        this._lastSnippetEvaluationIndexSetting.set(evaluationIndex);
+
+        var snippet = this._snippetStorage.snippetForId(snippetJavaScriptSource.snippetId);
+        var sourceURL = this._sourceURLForSnippet(snippet, evaluationIndex);
+        snippet._lastEvaluationSourceURL = sourceURL;
+        var expression = "\n//@ sourceURL=" + sourceURL + "\n" + snippet.content;
+        WebInspector.evaluateInConsole(expression, true);
+    },
+
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.UILocation}
+     */
+    _rawLocationToUILocation: function(rawLocation)
+    {
+        var uiSourceCode = this._uiSourceCodeForScriptId[rawLocation.scriptId];
+        if (uiSourceCode.isSnippet) {
+            var uiLineNumber = rawLocation.lineNumber - WebInspector.ScriptSnippetModel.evaluatedSnippetExtraLinesCount;
+            return new WebInspector.UILocation(uiSourceCode, uiLineNumber, rawLocation.columnNumber || 0);
+        }
+
+        return new WebInspector.UILocation(uiSourceCode, rawLocation.lineNumber, rawLocation.columnNumber || 0);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    _uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
+    {
+        var script = this._scriptForUISourceCode.get(uiSourceCode);
+        if (!script)
+            return null;
+
+        if (uiSourceCode.isSnippet) {
+            var rawLineNumber = lineNumber + WebInspector.ScriptSnippetModel.evaluatedSnippetExtraLinesCount;
+            return WebInspector.debuggerModel.createRawLocation(script, rawLineNumber, columnNumber);
+        }
+
+        return WebInspector.debuggerModel.createRawLocation(script, lineNumber, columnNumber);
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    _uiSourceCodes: function()
+    {
+        var result = this._releasedUISourceCodes();
+        for (var snippetId in this._snippetJavaScriptSourceForSnippetId)
+            result.push(this._snippetJavaScriptSourceForSnippetId[snippetId]);
+        return result;
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    _releasedUISourceCodes: function()
+    {
+        var result = [];
+        for (var scriptId in this._uiSourceCodeForScriptId) {
+            var uiSourceCode = this._uiSourceCodeForScriptId[scriptId];
+            if (!uiSourceCode.isSnippet)
+                result.push(uiSourceCode);
+        }
+        return result;
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     */
+    _addScript: function(script)
+    {
+        var snippetId = this._snippetIdForSourceURL(script.sourceURL);
+        var snippetJavaScriptSource = this._snippetJavaScriptSourceForSnippetId[snippetId];
+        if (!snippetJavaScriptSource) {
+            this._createUISourceCodeForScript(script);
+            return;
+        }
+        
+        console.assert(!this._scriptForUISourceCode.get(snippetJavaScriptSource));
+        this._uiSourceCodeForScriptId[script.scriptId] = snippetJavaScriptSource;
+        this._scriptForUISourceCode.put(snippetJavaScriptSource, script);
+        script.setSourceMapping(this._snippetScriptMapping);
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     */
+    _createUISourceCodeForScript: function(script)
+    {
+        var uiSourceCode = new WebInspector.JavaScriptSource(script.sourceURL, script, this._snippetScriptMapping, false);
+        uiSourceCode.isSnippetEvaluation = true;
+        this._uiSourceCodeForScriptId[script.scriptId] = uiSourceCode;
+        this._scriptForUISourceCode.put(uiSourceCode, script);
+        this._snippetScriptMapping._fireUISourceCodeAdded(uiSourceCode);
+        script.setSourceMapping(this._snippetScriptMapping);
+    },
+
+    /**
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
+     */
+    _releaseSnippetScript: function(snippetJavaScriptSource)
+    {
+        var script = this._scriptForUISourceCode.get(snippetJavaScriptSource);
+        if (!script)
+            return;
+
+        delete this._uiSourceCodeForScriptId[script.scriptId];
+        this._scriptForUISourceCode.remove(snippetJavaScriptSource);
+
+        this._createUISourceCodeForScript(script);
+    },
+
+    /**
+     * @param {WebInspector.Snippet} snippet
+     * @param {string} evaluationIndex
+     * @return {string}
+     */
+    _sourceURLForSnippet: function(snippet, evaluationIndex)
+    {
+        var snippetPrefix = WebInspector.ScriptSnippetModel.snippetSourceURLPrefix;
+        var evaluationSuffix = evaluationIndex ? "_" + evaluationIndex : "";
+        return snippetPrefix + snippet.id + evaluationSuffix;
+    },
+
+    /**
+     * @param {string} sourceURL
+     * @return {string|null}
+     */
+    _snippetIdForSourceURL: function(sourceURL)
+    {
+        var snippetPrefix = WebInspector.ScriptSnippetModel.snippetSourceURLPrefix;
+        if (!sourceURL.startsWith(snippetPrefix))
+            return null;
+        var splittedURL = sourceURL.substring(snippetPrefix.length).split("_");
+        var snippetId = splittedURL[0];
+        return snippetId;
+    },
+
+    /**
+     * @param {string} sourceURL
+     * @return {WebInspector.Snippet|null}
+     */
+    _snippetForSourceURL: function(sourceURL)
+    {
+        var snippetId = this._snippetIdForSourceURL(sourceURL);
+        if (!snippetId)
+            return null;
+        var snippet = this._snippetStorage.snippetForId(snippetId);
+        if (!snippet || snippet._lastEvaluationSourceURL !== sourceURL)
+            return null;
+        return snippet;
+    },
+
+    _reset: function()
+    {
+        var removedUISourceCodes = this._releasedUISourceCodes();
+        this._uiSourceCodeForScriptId = {};
+        this._scriptForUISourceCode = new Map();
+        for (var i = 0; i < removedUISourceCodes.length; ++i)
+            this._snippetScriptMapping._fireUISourceCodeRemoved(removedUISourceCodes[i]);
+    }
+}
+
+WebInspector.ScriptSnippetModel.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.JavaScriptSource}
+ * @param {string} snippetId
+ * @param {string} snippetName
+ * @param {WebInspector.ContentProvider} contentProvider
+ * @param {WebInspector.ScriptSnippetModel} scriptSnippetModel
+ */
+WebInspector.SnippetJavaScriptSource = function(snippetId, snippetName, contentProvider, scriptSnippetModel)
+{
+    WebInspector.JavaScriptSource.call(this, snippetName, contentProvider, scriptSnippetModel.scriptMapping, true);
+    this._snippetId = snippetId;
+    this._scriptSnippetModel = scriptSnippetModel;
+    this.isSnippet = true;
+}
+
+WebInspector.SnippetJavaScriptSource.prototype = {
+    /**
+     * @return {boolean}
+     */
+    isEditable: function()
+    {
+        return true;
+    },
+
+    commitWorkingCopy: function(callback)
+    {
+        this._scriptSnippetModel.setScriptSnippetContent(this, this.workingCopy());
+        callback();
+    },
+
+    /**
+     * @return {string}
+     */
+    get snippetId()
+    {
+        return this._snippetId;
+    }
+}
+
+WebInspector.SnippetJavaScriptSource.prototype.__proto__ = WebInspector.JavaScriptSource.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ * @implements {WebInspector.SourceMapping}
+ * @implements {WebInspector.UISourceCodeProvider}
+ * @param {WebInspector.ScriptSnippetModel} scriptSnippetModel
+ */
+WebInspector.SnippetScriptMapping = function(scriptSnippetModel)
+{
+    this._scriptSnippetModel = scriptSnippetModel;
+}
+
+WebInspector.SnippetScriptMapping.prototype = {
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.UILocation}
+     */
+    rawLocationToUILocation: function(rawLocation)
+    {
+        return this._scriptSnippetModel._rawLocationToUILocation(rawLocation);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
+    {
+        return this._scriptSnippetModel._uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodes: function()
+    {
+        return this._scriptSnippetModel._uiSourceCodes();
+    },
+
+    /**
+     * @param {string} sourceURL
+     * @return {string|null}
+     */
+    snippetIdForSourceURL: function(sourceURL)
+    {
+        return this._scriptSnippetModel._snippetIdForSourceURL(sourceURL);
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     */
+    addScript: function(script)
+    {
+        this._scriptSnippetModel._addScript(script);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    _fireUISourceCodeAdded: function(uiSourceCode)
+    {
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, uiSourceCode);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    _fireUISourceCodeRemoved: function(uiSourceCode)
+    {
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, uiSourceCode);
+    },
+
+    reset: function()
+    {
+        this._scriptSnippetModel._reset();
+    }
+}
+
+WebInspector.SnippetScriptMapping.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.StaticContentProvider}
+ * @param {WebInspector.Snippet} snippet
+ */
+WebInspector.SnippetContentProvider = function(snippet)
+{
+    WebInspector.StaticContentProvider.call(this, WebInspector.resourceTypes.Script, snippet.content);
+}
+
+WebInspector.SnippetContentProvider.prototype.__proto__ = WebInspector.StaticContentProvider.prototype;
+
+/**
+ * @type {?WebInspector.ScriptSnippetModel}
+ */
+WebInspector.scriptSnippetModel = null;
diff --git a/Source/WebCore/inspector/front-end/ScriptsNavigator.js b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
index 5089e1f2a..2363f2d14 100644
--- a/Source/WebCore/inspector/front-end/ScriptsNavigator.js
+++ b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
@@ -46,8 +46,11 @@ WebInspector.ScriptsNavigator = function()
 
     this._snippetsView = new WebInspector.SnippetsNavigatorView();
     this._snippetsView.addEventListener(WebInspector.NavigatorView.Events.ItemSelected, this._scriptSelected, this);
+    this._snippetsView.addEventListener(WebInspector.NavigatorView.Events.FileRenamed, this._fileRenamed, this);
+    this._snippetsView.addEventListener(WebInspector.SnippetsNavigatorView.Events.SnippetCreationRequested, this._snippetCreationRequested, this);
 
-    this._tabbedPane.appendTab(WebInspector.ScriptsNavigator.ScriptsTab, WebInspector.UIString("Scripts"), this._scriptsView);
+    var sourcesTitle = WebInspector.experimentsSettings.sourceCodePanel.isEnabled() ? WebInspector.UIString("Sources") : WebInspector.UIString("Scripts");
+    this._tabbedPane.appendTab(WebInspector.ScriptsNavigator.ScriptsTab, sourcesTitle, this._scriptsView);
     this._tabbedPane.selectTab(WebInspector.ScriptsNavigator.ScriptsTab);
     this._tabbedPane.appendTab(WebInspector.ScriptsNavigator.ContentScriptsTab, WebInspector.UIString("Content scripts"), this._contentScriptsView);
     if (WebInspector.experimentsSettings.snippetsSupport.isEnabled())
@@ -55,7 +58,9 @@ WebInspector.ScriptsNavigator = function()
 }
 
 WebInspector.ScriptsNavigator.Events = {
-    ScriptSelected: "ScriptSelected"
+    ScriptSelected: "ScriptSelected",
+    SnippetCreationRequested: "SnippetCreationRequested",
+    FileRenamed: "FileRenamed"
 }
 
 WebInspector.ScriptsNavigator.ScriptsTab = "scripts";
@@ -74,14 +79,22 @@ WebInspector.ScriptsNavigator.prototype = {
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
-    addUISourceCode: function(uiSourceCode)
+    _snippetsNavigatorViewForUISourceCode: function(uiSourceCode)
     {
         if (uiSourceCode.isContentScript)
-            this._contentScriptsView.addUISourceCode(uiSourceCode);
+            return this._contentScriptsView;
         else if (uiSourceCode.isSnippet || uiSourceCode.isSnippetEvaluation)
-            this._snippetsView.addUISourceCode(uiSourceCode);
+            return this._snippetsView;
         else
-            this._scriptsView.addUISourceCode(uiSourceCode);
+            return this._scriptsView;
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    addUISourceCode: function(uiSourceCode)
+    {
+        this._snippetsNavigatorViewForUISourceCode(uiSourceCode).addUISourceCode(uiSourceCode);
     },
 
     /**
@@ -90,11 +103,7 @@ WebInspector.ScriptsNavigator.prototype = {
      */
     isScriptSourceAdded: function(uiSourceCode)
     {
-        if (uiSourceCode.isContentScript)
-            return this._contentScriptsView.isScriptSourceAdded(uiSourceCode);
-        if (uiSourceCode.isSnippet || uiSourceCode.isSnippetEvaluation)
-            return this._snippetsView.isScriptSourceAdded(uiSourceCode);
-        return this._scriptsView.isScriptSourceAdded(uiSourceCode);
+        return this._snippetsNavigatorViewForUISourceCode(uiSourceCode).isScriptSourceAdded(uiSourceCode);
     },
 
     /**
@@ -102,36 +111,33 @@ WebInspector.ScriptsNavigator.prototype = {
      */
     revealUISourceCode: function(uiSourceCode)
     {
-        if (uiSourceCode.isContentScript) {
-            this._contentScriptsView.revealUISourceCode(uiSourceCode);
+        this._snippetsNavigatorViewForUISourceCode(uiSourceCode).revealUISourceCode(uiSourceCode);
+        if (uiSourceCode.isContentScript)
             this._tabbedPane.selectTab(WebInspector.ScriptsNavigator.ContentScriptsTab);
-        } else if (uiSourceCode.isSnippet || uiSourceCode.isSnippetEvaluation) {
-            this._snippetsView.revealUISourceCode(uiSourceCode);
+        else if (uiSourceCode.isSnippet || uiSourceCode.isSnippetEvaluation)
             this._tabbedPane.selectTab(WebInspector.ScriptsNavigator.SnippetsTab);
-        } else {
-            this._scriptsView.revealUISourceCode(uiSourceCode);
+        else
             this._tabbedPane.selectTab(WebInspector.ScriptsNavigator.ScriptsTab);
-        }
     },
 
     /**
+     * @param {WebInspector.UISourceCode} oldUISourceCode
      * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {boolean} isDirty
      */
-    setScriptSourceIsDirty: function(uiSourceCode, isDirty)
+    replaceUISourceCode: function(oldUISourceCode, uiSourceCode)
     {
-        // Do nothing.
+        this._scriptsView.replaceUISourceCode(oldUISourceCode, uiSourceCode);
+        this._contentScriptsView.replaceUISourceCode(oldUISourceCode, uiSourceCode);
+        this._snippetsView.replaceUISourceCode(oldUISourceCode, uiSourceCode);
     },
 
     /**
-     * @param {Array.<WebInspector.UISourceCode>} oldUISourceCodeList
-     * @param {Array.<WebInspector.UISourceCode>} uiSourceCodeList
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {function(boolean)=} callback
      */
-    replaceUISourceCodes: function(oldUISourceCodeList, uiSourceCodeList)
+    rename: function(uiSourceCode, callback)
     {
-        this._scriptsView.replaceUISourceCodes(oldUISourceCodeList, uiSourceCodeList);
-        this._contentScriptsView.replaceUISourceCodes(oldUISourceCodeList, uiSourceCodeList);
-        this._snippetsView.replaceUISourceCodes(oldUISourceCodeList, uiSourceCodeList);
+        this._snippetsNavigatorViewForUISourceCode(uiSourceCode).rename(uiSourceCode, callback);
     },
 
     /**
@@ -142,6 +148,22 @@ WebInspector.ScriptsNavigator.prototype = {
         this.dispatchEventToListeners(WebInspector.ScriptsNavigator.Events.ScriptSelected, event.data);
     },
 
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _fileRenamed: function(event)
+    {    
+        this.dispatchEventToListeners(WebInspector.ScriptsNavigator.Events.FileRenamed, event.data);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _snippetCreationRequested: function(event)
+    {    
+        this.dispatchEventToListeners(WebInspector.ScriptsNavigator.Events.SnippetCreationRequested, event.data);
+    },
+
     reset: function()
     {
         this._scriptsView.reset();
@@ -162,6 +184,10 @@ WebInspector.SnippetsNavigatorView = function()
     this.element.addEventListener("contextmenu", this.handleContextMenu.bind(this), false);
 }
 
+WebInspector.SnippetsNavigatorView.Events = {
+    SnippetCreationRequested: "SnippetCreationRequested"
+}
+
 WebInspector.SnippetsNavigatorView.prototype = {
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
@@ -233,7 +259,12 @@ WebInspector.SnippetsNavigatorView.prototype = {
      */
     _handleCreateSnippet: function(event)
     {
-        // FIXME: To be implemented.
+        this._snippetCreationRequested();
+    },
+
+    _snippetCreationRequested: function()
+    {
+        this.dispatchEventToListeners(WebInspector.SnippetsNavigatorView.Events.SnippetCreationRequested, null);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index a22e47aec..d2fcf38ac 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -28,16 +28,25 @@
  * @constructor
  * @implements {WebInspector.TabbedEditorContainerDelegate}
  * @extends {WebInspector.Panel}
+ * @param {WebInspector.CompositeUISourceCodeProvider=} uiSourceCodeProviderForTest
  */
-WebInspector.ScriptsPanel = function(presentationModel)
+WebInspector.ScriptsPanel = function(uiSourceCodeProviderForTest)
 {
     WebInspector.Panel.call(this, "scripts");
     this.registerRequiredCSS("scriptsPanel.css");
 
     WebInspector.settings.pauseOnExceptionStateString = WebInspector.settings.createSetting("pauseOnExceptionStateString", WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions);
     WebInspector.settings.navigatorWasOnceHidden = WebInspector.settings.createSetting("navigatorWasOnceHidden", false);
+    WebInspector.settings.debuggerSidebarHidden = WebInspector.settings.createSetting("debuggerSidebarHidden", false);
 
-    this._presentationModel = presentationModel;
+    var scriptMapping = new WebInspector.DebuggerScriptMapping();
+    var providers = scriptMapping.uiSourceCodeProviders();
+    if (WebInspector.experimentsSettings.sourceCodePanel.isEnabled())
+        providers = providers.concat(new WebInspector.StylesUISourceCodeProvider());
+    this._uiSourceCodeProvider = uiSourceCodeProviderForTest || new WebInspector.CompositeUISourceCodeProvider(providers);
+
+    new WebInspector.PresentationConsoleMessageHelper(this._uiSourceCodeProvider);
+    new WebInspector.DebuggerResourceBinding(this._uiSourceCodeProvider);
 
     function viewGetter()
     {
@@ -45,7 +54,8 @@ WebInspector.ScriptsPanel = function(presentationModel)
     }
     WebInspector.GoToLineDialog.install(this, viewGetter.bind(this));
 
-    this.debugToolbar = this._createDebugToolbar();
+    var helpSection = WebInspector.shortcutsScreen.section(WebInspector.UIString(WebInspector.experimentsSettings.sourceCodePanel.isEnabled() ? "Source Code Panel" : "Scripts Panel"));
+    this.debugToolbar = this._createDebugToolbar(helpSection);
 
     const initialDebugSidebarWidth = 225;
     const maximalDebugSidebarWidthPercent = 50;
@@ -75,11 +85,14 @@ WebInspector.ScriptsPanel = function(presentationModel)
 
     this._editorContainer = new WebInspector.TabbedEditorContainer(this, "previouslyViewedFiles");
     this._editorContainer.show(this.editorView.mainElement);
-    WebInspector.OpenScriptDialog.install(this, this._presentationModel, this.editorView.mainElement);
+    WebInspector.OpenScriptDialog.install(this, this._uiSourceCodeProvider, this.editorView.mainElement);
 
     this._navigatorController = new WebInspector.NavigatorOverlayController(this, this.editorView, this._navigator.view, this._editorContainer.view);
 
     this._navigator.addEventListener(WebInspector.ScriptsNavigator.Events.ScriptSelected, this._scriptSelected, this);
+    this._navigator.addEventListener(WebInspector.ScriptsNavigator.Events.SnippetCreationRequested, this._snippetCreationRequested, this);
+    this._navigator.addEventListener(WebInspector.ScriptsNavigator.Events.FileRenamed, this._fileRenamed, this);
+
     this._editorContainer.addEventListener(WebInspector.TabbedEditorContainer.Events.EditorSelected, this._editorSelected, this);
     this._editorContainer.addEventListener(WebInspector.TabbedEditorContainer.Events.EditorClosed, this._editorClosed, this);
 
@@ -89,7 +102,7 @@ WebInspector.ScriptsPanel = function(presentationModel)
     this.sidebarPanes.watchExpressions = new WebInspector.WatchExpressionsSidebarPane();
     this.sidebarPanes.callstack = new WebInspector.CallStackSidebarPane();
     this.sidebarPanes.scopechain = new WebInspector.ScopeChainSidebarPane();
-    this.sidebarPanes.jsBreakpoints = new WebInspector.JavaScriptBreakpointsSidebarPane(this._presentationModel.breakpointManager, this._showSourceLine.bind(this));
+    this.sidebarPanes.jsBreakpoints = new WebInspector.JavaScriptBreakpointsSidebarPane(WebInspector.breakpointManager, this._showSourceLine.bind(this));
     if (Capabilities.nativeInstrumentationEnabled) {
         this.sidebarPanes.domBreakpoints = WebInspector.domBreakpointsSidebarPane;
         this.sidebarPanes.xhrBreakpoints = new WebInspector.XHRBreakpointsSidebarPane();
@@ -114,18 +127,17 @@ WebInspector.ScriptsPanel = function(presentationModel)
     this.sidebarPanes.scopechain.expanded = true;
     this.sidebarPanes.jsBreakpoints.expanded = true;
 
-    var helpSection = WebInspector.shortcutsScreen.section(WebInspector.UIString("Scripts Panel"));
     this.sidebarPanes.callstack.registerShortcuts(helpSection, this.registerShortcut.bind(this));
     var evaluateInConsoleShortcut = WebInspector.KeyboardShortcut.makeDescriptor("e", WebInspector.KeyboardShortcut.Modifiers.Shift | WebInspector.KeyboardShortcut.Modifiers.Ctrl);
     helpSection.addKey(evaluateInConsoleShortcut.name, WebInspector.UIString("Evaluate selection in console"));
     this.registerShortcut(evaluateInConsoleShortcut.key, this._evaluateSelectionInConsole.bind(this));
 
     var openResourceShortcut = WebInspector.OpenResourceDialog.createShortcut();
-    helpSection.addKey(openResourceShortcut.name, WebInspector.UIString("Open script"));
+    helpSection.addKey(openResourceShortcut.name, WebInspector.UIString("Open file"));
 
-    var scriptOutlineShortcut = WebInspector.JavaScriptOutlineDialog.createShortcut();
-    helpSection.addKey(scriptOutlineShortcut.name, WebInspector.UIString("Go to function"));
-    this.registerShortcut(scriptOutlineShortcut.key, this._showJavaScriptOutlineDialog.bind(this));
+    var outlineShortcut = WebInspector.KeyboardShortcut.makeDescriptor("o", WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta | WebInspector.KeyboardShortcut.Modifiers.Shift);
+    helpSection.addKey(outlineShortcut.name, WebInspector.UIString("Go to member"));
+    this.registerShortcut(outlineShortcut.key, this._showOutlineDialog.bind(this));
 
     var panelEnablerHeading = WebInspector.UIString("You need to enable debugging before you can use the Scripts panel.");
     var panelEnablerDisclaimer = WebInspector.UIString("Enabling debugging will make scripts run slower.");
@@ -150,6 +162,7 @@ WebInspector.ScriptsPanel = function(presentationModel)
     this._scriptViewStatusBarItemsContainer.style.display = "inline-block";
 
     this._debuggerEnabled = !Capabilities.debuggerCausesRecompilation;
+    this._installDebuggerSidebarController();
 
     this._sourceFramesByUISourceCode = new Map();
     this._reset(false);
@@ -164,15 +177,15 @@ WebInspector.ScriptsPanel = function(presentationModel)
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.GlobalObjectCleared, this._reset.bind(this, false));
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointsActiveStateChanged, this._breakpointsActiveStateChanged, this);
 
-    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.UISourceCodeAdded, this._handleUISourceCodeAdded, this)
-    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.UISourceCodeReplaced, this._uiSourceCodeReplaced, this);
-    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.UISourceCodeRemoved, this._uiSourceCodeRemoved, this);
+    this._uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, this._handleUISourceCodeAdded, this);
+    this._uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, this._uiSourceCodeReplaced, this);
+    this._uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, this._uiSourceCodeRemoved, this);
 
     var enableDebugger = !Capabilities.debuggerCausesRecompilation || WebInspector.settings.debuggerEnabled.get();
     if (enableDebugger)
         WebInspector.debuggerModel.enableDebugger();
 
-    WebInspector.advancedSearchController.registerSearchScope(new WebInspector.ScriptsSearchScope());
+    WebInspector.advancedSearchController.registerSearchScope(new WebInspector.ScriptsSearchScope(this._uiSourceCodeProvider));
 }
 
 // Keep these in sync with WebCore::ScriptDebugServer
@@ -185,6 +198,8 @@ WebInspector.ScriptsPanel.PauseOnExceptionsState = {
 WebInspector.ScriptsPanel.prototype = {
     get toolbarItemLabel()
     {
+        if (WebInspector.experimentsSettings.sourceCodePanel.isEnabled())
+            return WebInspector.UIString("Source Code");
         return WebInspector.UIString("Scripts");
     },
 
@@ -219,12 +234,14 @@ WebInspector.ScriptsPanel.prototype = {
     _handleUISourceCodeAdded: function(event)
     {
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        if (this._toggleFormatSourceButton.toggled)
+            uiSourceCode.setFormatted(true);
         this._uiSourceCodeAdded(uiSourceCode);
     },
 
     _loadUISourceCodes: function()
     {
-        var uiSourceCodes = this._presentationModel.uiSourceCodes();
+        var uiSourceCodes = this._uiSourceCodeProvider.uiSourceCodes();
         for (var i = 0; i < uiSourceCodes.length; ++i)
             this._uiSourceCodeAdded(uiSourceCodes[i]);
     },
@@ -257,16 +274,6 @@ WebInspector.ScriptsPanel.prototype = {
         this._removeSourceFrame(uiSourceCode);
     },
 
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {boolean} isDirty
-     */
-    setScriptSourceIsDirty: function(uiSourceCode, isDirty)
-    {
-        this._navigator.setScriptSourceIsDirty(uiSourceCode, isDirty);
-        this._editorContainer.setFileIsDirty(uiSourceCode, isDirty);
-    },
-
     _consoleCommandEvaluatedInSelectedCallFrame: function(event)
     {
         this.sidebarPanes.scopechain.update(WebInspector.debuggerModel.selectedCallFrame());
@@ -305,7 +312,7 @@ WebInspector.ScriptsPanel.prototype = {
         } else {
             function didGetUILocation(uiLocation)
             {
-                var breakpoint = this._presentationModel.breakpointManager.findBreakpoint(uiLocation.uiSourceCode, uiLocation.lineNumber);
+                var breakpoint = WebInspector.breakpointManager.findBreakpoint(uiLocation.uiSourceCode, uiLocation.lineNumber);
                 if (!breakpoint)
                     return;
                 this.sidebarPanes.jsBreakpoints.highlightBreakpoint(breakpoint);
@@ -314,6 +321,8 @@ WebInspector.ScriptsPanel.prototype = {
             details.callFrames[0].createLiveLocation(didGetUILocation.bind(this));
         }
 
+        this._showDebuggerSidebar();
+        this._toggleDebuggerSidebarButton.disabled = true;
         window.focus();
         InspectorFrontendHost.bringToFront();
     },
@@ -325,6 +334,7 @@ WebInspector.ScriptsPanel.prototype = {
         this._stepping = false;
 
         this._clearInterface();
+        this._toggleDebuggerSidebarButton.disabled = false;
     },
 
     _debuggerWasEnabled: function()
@@ -385,7 +395,16 @@ WebInspector.ScriptsPanel.prototype = {
 
     canShowAnchorLocation: function(anchor)
     {
-        return this._debuggerEnabled && anchor.uiSourceCode;
+        if (this._debuggerEnabled && anchor.uiSourceCode)
+            return true;
+        var uiSourceCodes = this._uiSourceCodeProvider.uiSourceCodes();
+        for (var i = 0; i < uiSourceCodes.length; ++i) {
+            if (uiSourceCodes[i].url === anchor.href) {
+                anchor.uiSourceCode = uiSourceCodes[i];
+                return true;
+            }
+        }
+        return false;
     },
 
     showAnchorLocation: function(anchor)
@@ -396,7 +415,7 @@ WebInspector.ScriptsPanel.prototype = {
     showFunctionDefinition: function(functionLocation)
     {
         WebInspector.showPanelForAnchorNavigation(this);
-        var uiLocation = this._presentationModel.rawLocationToUILocation(functionLocation);
+        var uiLocation = WebInspector.debuggerModel.rawLocationToUILocation(functionLocation);
         this._showSourceLine(uiLocation.uiSourceCode, uiLocation.lineNumber);
     },
 
@@ -423,15 +442,13 @@ WebInspector.ScriptsPanel.prototype = {
      */
     _showFile: function(uiSourceCode)
     {
-        if (!this._navigator.isScriptSourceAdded(uiSourceCode))
-            return null;
-
         var sourceFrame = this._getOrCreateSourceFrame(uiSourceCode);
         if (this._currentUISourceCode === uiSourceCode)
             return sourceFrame;
         this._currentUISourceCode = uiSourceCode;
 
-        this._navigator.revealUISourceCode(uiSourceCode);
+        if (this._navigator.isScriptSourceAdded(uiSourceCode))
+            this._navigator.revealUISourceCode(uiSourceCode);
         this._editorContainer.showFile(uiSourceCode);
         this._updateScriptViewStatusBarItems();
 
@@ -444,9 +461,16 @@ WebInspector.ScriptsPanel.prototype = {
      */
     _createSourceFrame: function(uiSourceCode)
     {
-        var sourceFrame = new WebInspector.JavaScriptSourceFrame(this, this._presentationModel, uiSourceCode);
-
-        sourceFrame._uiSourceCode = uiSourceCode;
+        var sourceFrame;
+        if (uiSourceCode instanceof WebInspector.JavaScriptSource)
+            sourceFrame = new WebInspector.JavaScriptSourceFrame(this, uiSourceCode);
+        else if (uiSourceCode instanceof WebInspector.StyleSource)
+            sourceFrame = new WebInspector.StyleSourceFrame(uiSourceCode);
+        else {
+            console.assert(false, "Unknown UISourceCode type");
+            sourceFrame = new WebInspector.SourceFrame(uiSourceCode);
+        }
+         
         this._sourceFramesByUISourceCode.put(uiSourceCode, sourceFrame);
         return sourceFrame;
     },
@@ -482,17 +506,16 @@ WebInspector.ScriptsPanel.prototype = {
     },
 
     /**
-     * @param {Event} event
+     * @param {WebInspector.Event} event
      */
     _uiSourceCodeReplaced: function(event)
     {
-        var oldUISourceCodeList = /** @type {Array.<WebInspector.UISourceCode>} */ event.data.oldUISourceCodeList;
-        var uiSourceCodeList = /** @type {Array.<WebInspector.UISourceCode>} */ event.data.uiSourceCodeList;
+        var oldUISourceCode = /** @type {WebInspector.UISourceCode} */ event.data.oldUISourceCode;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data.uiSourceCode;
 
-        this._navigator.replaceUISourceCodes(oldUISourceCodeList, uiSourceCodeList);
-        this._editorContainer.replaceFiles(oldUISourceCodeList, uiSourceCodeList);
-        for (var i = 0; i < oldUISourceCodeList.length; ++i)
-            this._removeSourceFrame(oldUISourceCodeList[i]);
+        this._navigator.replaceUISourceCode(oldUISourceCode, uiSourceCode);
+        this._editorContainer.replaceFile(oldUISourceCode, uiSourceCode);
+        this._removeSourceFrame(oldUISourceCode);
     },
 
     _clearCurrentExecutionLine: function()
@@ -517,7 +540,7 @@ WebInspector.ScriptsPanel.prototype = {
     _revealExecutionLine: function(uiLocation)
     {
         // Some scripts (anonymous and snippets evaluations) are not added to files select by default.
-        this._addUISourceCode(uiLocation.uiSourceCode);
+        this._editorContainer.uiSourceCodeAdded(uiLocation.uiSourceCode);
         var sourceFrame = this._showFile(uiLocation.uiSourceCode);
         sourceFrame.revealLine(uiLocation.lineNumber);
     },
@@ -761,7 +784,7 @@ WebInspector.ScriptsPanel.prototype = {
             WebInspector.evaluateInConsole(selection.toString());
     },
 
-    _createDebugToolbar: function()
+    _createDebugToolbar: function(section)
     {
         var debugToolbar = document.createElement("div");
         debugToolbar.className = "status-bar";
@@ -776,7 +799,7 @@ WebInspector.ScriptsPanel.prototype = {
         shortcuts = [];
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.F8));
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.Slash, platformSpecificModifier));
-        this.pauseButton = this._createButtonAndRegisterShortcuts("scripts-pause", title, handler, shortcuts, WebInspector.UIString("Pause/Continue"));
+        this.pauseButton = this._createButtonAndRegisterShortcuts(section, "scripts-pause", title, handler, shortcuts, WebInspector.UIString("Pause/Continue"));
         debugToolbar.appendChild(this.pauseButton);
 
         // Step over.
@@ -785,7 +808,7 @@ WebInspector.ScriptsPanel.prototype = {
         shortcuts = [];
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.F10));
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.SingleQuote, platformSpecificModifier));
-        this.stepOverButton = this._createButtonAndRegisterShortcuts("scripts-step-over", title, handler, shortcuts, WebInspector.UIString("Step over"));
+        this.stepOverButton = this._createButtonAndRegisterShortcuts(section, "scripts-step-over", title, handler, shortcuts, WebInspector.UIString("Step over"));
         debugToolbar.appendChild(this.stepOverButton);
 
         // Step into.
@@ -794,7 +817,7 @@ WebInspector.ScriptsPanel.prototype = {
         shortcuts = [];
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.F11));
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.Semicolon, platformSpecificModifier));
-        this.stepIntoButton = this._createButtonAndRegisterShortcuts("scripts-step-into", title, handler, shortcuts, WebInspector.UIString("Step into"));
+        this.stepIntoButton = this._createButtonAndRegisterShortcuts(section, "scripts-step-into", title, handler, shortcuts, WebInspector.UIString("Step into"));
         debugToolbar.appendChild(this.stepIntoButton);
 
         // Step out.
@@ -803,7 +826,7 @@ WebInspector.ScriptsPanel.prototype = {
         shortcuts = [];
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.F11, WebInspector.KeyboardShortcut.Modifiers.Shift));
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.Semicolon, WebInspector.KeyboardShortcut.Modifiers.Shift | platformSpecificModifier));
-        this.stepOutButton = this._createButtonAndRegisterShortcuts("scripts-step-out", title, handler, shortcuts, WebInspector.UIString("Step out"));
+        this.stepOutButton = this._createButtonAndRegisterShortcuts(section, "scripts-step-out", title, handler, shortcuts, WebInspector.UIString("Step out"));
         debugToolbar.appendChild(this.stepOutButton);
 
         this._toggleBreakpointsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Deactivate all breakpoints."), "toggle-breakpoints");
@@ -818,7 +841,7 @@ WebInspector.ScriptsPanel.prototype = {
         return debugToolbar;
     },
 
-    _createButtonAndRegisterShortcuts: function(buttonId, buttonTitle, handler, shortcuts, shortcutDescription)
+    _createButtonAndRegisterShortcuts: function(section, buttonId, buttonTitle, handler, shortcuts, shortcutDescription)
     {
         var button = document.createElement("button");
         button.className = "status-bar-item";
@@ -833,7 +856,6 @@ WebInspector.ScriptsPanel.prototype = {
             this.registerShortcut(shortcuts[i].key, handler);
             shortcutNames.push(shortcuts[i].name);
         }
-        var section = WebInspector.shortcutsScreen.section(WebInspector.UIString("Scripts Panel"));
         section.addAlternateKeys(shortcutNames, shortcutDescription);
 
         return button;
@@ -913,7 +935,9 @@ WebInspector.ScriptsPanel.prototype = {
     _toggleFormatSource: function()
     {
         this._toggleFormatSourceButton.toggled = !this._toggleFormatSourceButton.toggled;
-        this._presentationModel.setFormatSource(this._toggleFormatSourceButton.toggled);
+        var uiSourceCodes = this._uiSourceCodeProvider.uiSourceCodes();
+        for (var i = 0; i < uiSourceCodes.length; ++i)
+            uiSourceCodes[i].setFormatted(this._toggleFormatSourceButton.toggled);
     },
 
     addToWatch: function(expression)
@@ -921,10 +945,166 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.watchExpressions.addExpression(expression);
     },
 
-    _showJavaScriptOutlineDialog: function()
+    _showOutlineDialog: function()
+    {
+         var uiSourceCode = this._editorContainer.currentFile();
+         if (!uiSourceCode)
+             return;
+
+         if (uiSourceCode instanceof WebInspector.JavaScriptSource)
+             WebInspector.JavaScriptOutlineDialog.show(this.visibleView, uiSourceCode);
+         else if (uiSourceCode instanceof WebInspector.StyleSource)
+             WebInspector.StyleSheetOutlineDialog.show(this.visibleView, /** @type {WebInspector.StyleSource} */ uiSourceCode);
+    },
+
+    _installDebuggerSidebarController: function()
+    {
+        this._toggleDebuggerSidebarButton = new WebInspector.StatusBarButton(WebInspector.UIString("Hide debugger"), "scripts-debugger-show-hide-button", 3);
+        this._toggleDebuggerSidebarButton.state = "shown";
+        this._toggleDebuggerSidebarButton.addEventListener("click", clickHandler, this);
+
+        function clickHandler()
+        {
+            if (this._toggleDebuggerSidebarButton.state === "shown")
+                this._hideDebuggerSidebar();
+            else
+                this._showDebuggerSidebar();
+        }
+        this.editorView.element.appendChild(this._toggleDebuggerSidebarButton.element);
+
+        if (WebInspector.settings.debuggerSidebarHidden.get())
+            this._hideDebuggerSidebar();
+
+    },
+
+    _showDebuggerSidebar: function()
+    {
+        if (this._toggleDebuggerSidebarButton.state === "shown")
+            return;
+        this._toggleDebuggerSidebarButton.state = "shown";
+        this._toggleDebuggerSidebarButton.title = WebInspector.UIString("Hide debugger");
+        this.splitView.showSidebarElement();
+        WebInspector.settings.debuggerSidebarHidden.set(false);
+    },
+
+    _hideDebuggerSidebar: function()
+    {
+        if (this._toggleDebuggerSidebarButton.state === "hidden")
+            return;
+        this._toggleDebuggerSidebarButton.state = "hidden";
+        this._toggleDebuggerSidebarButton.title = WebInspector.UIString("Show debugger");
+        this.splitView.hideSidebarElement();
+        WebInspector.settings.debuggerSidebarHidden.set(true);
+    },
+
+    _fileRenamed: function(event)
+    {
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data.uiSourceCode;
+        var name = /** @type {string} */ event.data.name;
+        if (!uiSourceCode.isSnippet)
+            return;
+        var snippetJavaScriptSource = /** @type {WebInspector.SnippetJavaScriptSource} */ uiSourceCode;
+        WebInspector.scriptSnippetModel.renameScriptSnippet(snippetJavaScriptSource, name);
+    },
+        
+    _snippetCreationRequested: function()
+    {
+        var snippetJavaScriptSource = WebInspector.scriptSnippetModel.createScriptSnippet();
+        this._showSourceLine(snippetJavaScriptSource);
+        
+        var shouldHideNavigator = !this._navigatorController.isNavigatorPinned();
+        if (this._navigatorController.isNavigatorHidden())
+            this._navigatorController.showNavigatorOverlay();
+        this._navigator.rename(snippetJavaScriptSource, callback.bind(this));
+    
+        /**
+         * @param {boolean} committed
+         */
+        function callback(committed)
+        {
+            if (shouldHideNavigator)
+                this._navigatorController.hideNavigatorOverlay();
+
+            if (!committed) {
+                WebInspector.scriptSnippetModel.deleteScriptSnippet(snippetJavaScriptSource);
+                return;
+            }
+
+            this._showSourceLine(snippetJavaScriptSource);
+        }
+    },
+
+    /**
+     * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
+     */
+    registerUISourceCodeProvider: function(uiSourceCodeProvider)
     {
-         WebInspector.JavaScriptOutlineDialog.show(this.visibleView, this.visibleView);
+        this._uiSourceCodeProvider._registerUISourceCodeProvider(uiSourceCodeProvider);
     }
 }
 
 WebInspector.ScriptsPanel.prototype.__proto__ = WebInspector.Panel.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ * @implements {WebInspector.UISourceCodeProvider}
+ * @param {Array.<WebInspector.UISourceCodeProvider>} uiSourceCodeProviders
+ */
+WebInspector.CompositeUISourceCodeProvider = function(uiSourceCodeProviders)
+{
+    WebInspector.Object.call(this);
+    this._uiSourceCodeProviders = [];
+    for (var i = 0; i < uiSourceCodeProviders.length; ++i)
+        this._registerUISourceCodeProvider(uiSourceCodeProviders[i]);
+}
+
+WebInspector.CompositeUISourceCodeProvider.prototype = {
+    /**
+     * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
+     */
+    _registerUISourceCodeProvider: function(uiSourceCodeProvider)
+    {
+        this._uiSourceCodeProviders.push(uiSourceCodeProvider);
+        uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, this._handleUISourceCodeAdded, this);
+        uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, this._handleUISourceCodeReplaced, this);
+        uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, this._handleUISourceCodeRemoved, this);
+    },
+
+    _handleUISourceCodeAdded: function(event)
+    {
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, event.data);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _handleUISourceCodeReplaced: function(event)
+    {
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, event.data);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _handleUISourceCodeRemoved: function(event)
+    {
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, event.data);
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodes: function()
+    {
+        var result = [];
+        for (var i = 0; i < this._uiSourceCodeProviders.length; ++i) {
+            var uiSourceCodes = this._uiSourceCodeProviders[i].uiSourceCodes();
+            for (var j = 0; j < uiSourceCodes.length; ++j)
+                result.push(uiSourceCodes[j]);
+        }
+        return result;
+    }
+}
+
+WebInspector.CompositeUISourceCodeProvider.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/ScriptsSearchScope.js b/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
index a09d77585..ce1664c51 100644
--- a/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
+++ b/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
@@ -29,18 +29,20 @@
 /**
  * @constructor
  * @implements {WebInspector.SearchScope}
+ * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
  */
-WebInspector.ScriptsSearchScope = function()
+WebInspector.ScriptsSearchScope = function(uiSourceCodeProvider)
 {
     // FIXME: Add title once it is used by search controller.
     WebInspector.SearchScope.call(this)
     this._searchId = 0;
+    this._uiSourceCodeProvider = uiSourceCodeProvider;
 }
 
 WebInspector.ScriptsSearchScope.prototype = {
     /**
      * @param {WebInspector.SearchConfig} searchConfig
-     * @param {function(Object)} searchResultCallback
+     * @param {function(WebInspector.FileBasedSearchResultsPane.SearchResult)} searchResultCallback
      * @param {function(boolean)} searchFinishedCallback
      */
     performSearch: function(searchConfig, searchResultCallback, searchFinishedCallback)
@@ -95,7 +97,7 @@ WebInspector.ScriptsSearchScope.prototype = {
      */
     createSearchResultsPane: function(searchConfig)
     {
-        return new WebInspector.ScriptsSearchResultsPane(searchConfig);
+        return new WebInspector.FileBasedSearchResultsPane(searchConfig);
     },
 
     /**
@@ -113,7 +115,7 @@ WebInspector.ScriptsSearchScope.prototype = {
             return a.url.localeCompare(b.url);   
         }
         
-        var uiSourceCodes = WebInspector.debuggerPresentationModel.uiSourceCodes();
+        var uiSourceCodes = this._uiSourceCodeProvider.uiSourceCodes();
         
         uiSourceCodes = uiSourceCodes.filter(filterOutAnonymous);
         uiSourceCodes.sort(comparator);
@@ -124,65 +126,4 @@ WebInspector.ScriptsSearchScope.prototype = {
 
 WebInspector.ScriptsSearchScope.prototype.__proto__ = WebInspector.SearchScope.prototype;
 
-/**
- * @constructor
- * @extends {WebInspector.FileBasedSearchResultsPane}
- * @param {WebInspector.SearchConfig} searchConfig
- */
-WebInspector.ScriptsSearchResultsPane = function(searchConfig)
-{
-    WebInspector.FileBasedSearchResultsPane.call(this, searchConfig)
-
-    this._linkifier = new WebInspector.Linkifier(new WebInspector.ScriptsSearchResultsPane.LinkifierFormatter());
-}
-
-WebInspector.ScriptsSearchResultsPane.prototype = {
-    /**
-     * @param {Object} file
-     * @param {number} lineNumber
-     * @param {number} columnNumber
-     */
-    createAnchor: function(file, lineNumber, columnNumber)
-    {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ file;
-        var rawLocation = WebInspector.debuggerPresentationModel.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
-        var anchor = this._linkifier.linkifyRawLocation(rawLocation);
-        anchor.removeChildren();
-        return anchor;
-    },
-    
-    /**
-     * @param {Object} file
-     * @return {string}
-     */
-    fileName: function(file)
-    {
-        var uiSourceCode = file;
-        return uiSourceCode.url;
-    },
-}
-
-WebInspector.ScriptsSearchResultsPane.prototype.__proto__ = WebInspector.FileBasedSearchResultsPane.prototype;
-
-/**
- * @constructor
- * @implements {WebInspector.LinkifierFormatter}
- */
-WebInspector.ScriptsSearchResultsPane.LinkifierFormatter = function()
-{
-}
-
-WebInspector.ScriptsSearchResultsPane.LinkifierFormatter.prototype = {
-    /**
-     * @param {Element} anchor
-     * @param {WebInspector.UILocation} uiLocation
-     */
-    formatLiveAnchor: function(anchor, uiLocation)
-    {
-        // Empty because we don't want to ever update anchor contents after creation.
-    }
-}
-
-WebInspector.ScriptsSearchResultsPane.LinkifierFormatter.prototype.__proto__ = WebInspector.LinkifierFormatter.prototype;
-
 WebInspector.settings.searchInContentScripts = WebInspector.settings.createSetting("searchInContentScripts", false);
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index 3db259377..836fba0bb 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -182,7 +182,7 @@ WebInspector.ExperimentsSettings = function()
     // Add currently running experiments here.
     this.showShadowDOM = this._createExperiment("showShadowDOM", "Show shadow DOM");
     this.snippetsSupport = this._createExperiment("snippetsSupport", "Snippets support");
-    this.showStylesPanel = this._createExperiment("stylesPanel", "Show styles panel");
+    this.sourceCodePanel = this._createExperiment("sourceCodePanel", "Source Code panel");
 
     this._cleanUpSetting();
 }
diff --git a/Source/WebCore/inspector/front-end/SettingsScreen.js b/Source/WebCore/inspector/front-end/SettingsScreen.js
index 56fe2600f..b29d27bc6 100644
--- a/Source/WebCore/inspector/front-end/SettingsScreen.js
+++ b/Source/WebCore/inspector/front-end/SettingsScreen.js
@@ -30,15 +30,31 @@
 
 /**
  * @constructor
+ * @param {!function()} onHide
  * @extends {WebInspector.HelpScreen}
  */
-WebInspector.SettingsScreen = function()
+WebInspector.SettingsScreen = function(onHide)
 {
     WebInspector.HelpScreen.call(this, WebInspector.UIString("Settings"));
+    this.contentElement.id = "settings";
 
-    this._leftColumnElement = document.createElement("td");
-    this._rightColumnElement = document.createElement("td");
-    var p = this._appendSection(WebInspector.UIString("General"));
+    /** @type {!function()} */
+    this._onHide = onHide;
+
+    var container = document.createElement("div");
+    container.className = "help-container";
+
+    /**
+     *  @param {string} name
+     *  @return {!Element}
+     */
+    function appendSection(name) {
+        var block = container.createChild("div", "help-block");
+        block.createChild("div", "help-section-title").textContent = name;
+        return block;
+    }
+
+    var p = appendSection(WebInspector.UIString("General"));
     if (Preferences.showDockToRight)
         p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Dock to right"), WebInspector.settings.dockToRight));
     if (Preferences.exposeDisableCache)
@@ -49,14 +65,14 @@ WebInspector.SettingsScreen = function()
     this._disableJSCheckbox = disableJSElement.getElementsByTagName("input")[0];
     this._updateScriptDisabledCheckbox();
     
-    p = this._appendSection(WebInspector.UIString("Rendering"));
+    p = appendSection(WebInspector.UIString("Rendering"));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show paint rectangles"), WebInspector.settings.showPaintRects));
     WebInspector.settings.showPaintRects.addChangeListener(this._showPaintRectsChanged, this);
 
-    p = this._appendSection(WebInspector.UIString("Elements"));
+    p = appendSection(WebInspector.UIString("Elements"));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Word wrap"), WebInspector.settings.domWordWrap));
 
-    p = this._appendSection(WebInspector.UIString("Styles"));
+    p = appendSection(WebInspector.UIString("Styles"));
     p.appendChild(this._createRadioSetting(WebInspector.UIString("Color format"), [
         [ WebInspector.StylesSidebarPane.ColorFormat.Original, WebInspector.UIString("As authored") ],
         [ WebInspector.StylesSidebarPane.ColorFormat.HEX, "HEX: #DAC0DE" ],
@@ -64,7 +80,7 @@ WebInspector.SettingsScreen = function()
         [ WebInspector.StylesSidebarPane.ColorFormat.HSL, "HSL: hsl(300, 80%, 90%)" ] ], WebInspector.settings.colorFormat));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show user agent styles"), WebInspector.settings.showUserAgentStyles));
 
-    p = this._appendSection(WebInspector.UIString("Text editor"));
+    p = appendSection(WebInspector.UIString("Text editor"));
     p.appendChild(this._createSelectSetting(WebInspector.UIString("Indent"), [
             [ WebInspector.UIString("2 spaces"), WebInspector.TextEditorModel.Indent.TwoSpaces ],
             [ WebInspector.UIString("4 spaces"), WebInspector.TextEditorModel.Indent.FourSpaces ],
@@ -72,62 +88,61 @@ WebInspector.SettingsScreen = function()
             [ WebInspector.UIString("Tab character"), WebInspector.TextEditorModel.Indent.TabCharacter ]
         ], WebInspector.settings.textEditorIndent));
 
-    p = this._appendSection(WebInspector.UIString("User Agent"), true);
+    p = appendSection(WebInspector.UIString("User Agent"));
     p.appendChild(this._createUserAgentControl());
     if (Capabilities.canOverrideDeviceMetrics)
         p.appendChild(this._createDeviceMetricsControl());
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Emulate touch events"), WebInspector.settings.emulateTouchEvents));
 
-    p = this._appendSection(WebInspector.UIString("Scripts"), true);
+    p = appendSection(WebInspector.UIString("Scripts"));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show script folders"), WebInspector.settings.showScriptFolders));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Search in content scripts"), WebInspector.settings.searchInContentScripts));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Enable source maps"), WebInspector.settings.sourceMapsEnabled));
 
-    p = this._appendSection(WebInspector.UIString("Profiler"), true);
+    p = appendSection(WebInspector.UIString("Profiler"));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show objects' hidden properties"), WebInspector.settings.showHeapSnapshotObjectsHiddenProperties));
 
-    p = this._appendSection(WebInspector.UIString("Console"), true);
+    p = appendSection(WebInspector.UIString("Console"));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Log XMLHttpRequests"), WebInspector.settings.monitoringXHREnabled));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Preserve log upon navigation"), WebInspector.settings.preserveConsoleLog));
 
     if (WebInspector.extensionServer.hasExtensions()) {
         var handlerSelector = new WebInspector.HandlerSelector(WebInspector.openAnchorLocationRegistry);
-        p = this._appendSection(WebInspector.UIString("Extensions"), true);
+        p = appendSection(WebInspector.UIString("Extensions"));
         p.appendChild(this._createCustomSetting(WebInspector.UIString("Open links in"), handlerSelector.element));
     }
 
     var experiments = WebInspector.experimentsSettings.experiments;
     if (WebInspector.experimentsSettings.experimentsEnabled && experiments.length) {
-        var experimentsSection = this._appendSection(WebInspector.UIString("Experiments"), true);
+        var experimentsSection = appendSection(WebInspector.UIString("Experiments"));
         experimentsSection.appendChild(this._createExperimentsWarningSubsection());
         for (var i = 0; i < experiments.length; ++i)
             experimentsSection.appendChild(this._createExperimentCheckbox(experiments[i]));
     }
 
-    var table = document.createElement("table");
-    table.className = "help-table";
-    var tr = document.createElement("tr");
-    tr.appendChild(this._leftColumnElement);
-    tr.appendChild(this._rightColumnElement);
-    table.appendChild(tr);
-    this.contentElement.appendChild(table);
+    this.contentElement.appendChild(container);
 }
 
 WebInspector.SettingsScreen.prototype = {
+
     /**
-     * @param {string} name
-     * @param {boolean=} right
+     * @override
      */
-    _appendSection: function(name, right)
+    isClosingKey: function(keyCode)
     {
-        var p = document.createElement("p");
-        p.className = "help-section";
-        var title = document.createElement("div");
-        title.className = "help-section-title";
-        title.textContent = name;
-        p.appendChild(title);
-        this._columnElement(right).appendChild(p);
-        return p;
+        return [
+            WebInspector.KeyboardShortcut.Keys.Enter.code,
+            WebInspector.KeyboardShortcut.Keys.Esc.code,
+        ].indexOf(keyCode) >= 0;
+    },
+
+    /**
+     * @override
+     */
+    willHide: function()
+    {
+        this._onHide();
+        WebInspector.HelpScreen.prototype.willHide.call(this);
     },
 
     /**
@@ -144,11 +159,6 @@ WebInspector.SettingsScreen.prototype = {
         return subsection;
     },
 
-    _columnElement: function(right)
-    {
-        return right ? this._rightColumnElement : this._leftColumnElement;
-    },
-
     /**
      * @param {boolean=} omitParagraphElement
      */
@@ -581,3 +591,52 @@ WebInspector.SettingsScreen.prototype = {
 }
 
 WebInspector.SettingsScreen.prototype.__proto__ = WebInspector.HelpScreen.prototype;
+
+/**
+ * @constructor
+ */
+WebInspector.SettingsController = function()
+{
+    this._statusBarButton = new WebInspector.StatusBarButton(WebInspector.UIString("Settings"), "settings-status-bar-item");;
+    this._statusBarButton.addEventListener("click", this._buttonClicked, this);
+
+    /** @type {?WebInspector.SettingsScreen} */
+    this._settingsScreen;
+}
+
+WebInspector.SettingsController.prototype =
+{
+    get statusBarItem()
+    {
+        return this._statusBarButton.element;
+    },
+
+    _buttonClicked: function()
+    {
+        if (this._statusBarButton.toggled)
+            this._hideSettingsScreen();
+        else
+            this._showSettingsScreen();
+    },
+
+    _onHideSettingsScreen: function()
+    {
+        this._statusBarButton.toggled = false;
+        delete this._settingsScreen;
+    },
+
+    _showSettingsScreen: function()
+    {
+        if (!this._settingsScreen)
+            this._settingsScreen = new WebInspector.SettingsScreen(this._onHideSettingsScreen.bind(this));
+
+        this._settingsScreen.showModal();
+        this._statusBarButton.toggled = true;
+    },
+
+    _hideSettingsScreen: function()
+    {
+        if (this._settingsScreen)
+            this._settingsScreen.hide();
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/ShortcutsScreen.js b/Source/WebCore/inspector/front-end/ShortcutsScreen.js
index 88c8f9fef..65a2a0ba7 100644
--- a/Source/WebCore/inspector/front-end/ShortcutsScreen.js
+++ b/Source/WebCore/inspector/front-end/ShortcutsScreen.js
@@ -48,10 +48,13 @@ WebInspector.ShortcutsScreen.prototype = {
         return section;
     },
 
-    show: function(onHide)
+    /**
+     * @override
+     */
+    wasShown: function()
     {
         this._buildTable(this.contentElement);
-        WebInspector.HelpScreen.prototype.show.call(this, onHide);
+        WebInspector.HelpScreen.prototype.wasShown.call(this);
     },
 
     /**
@@ -63,46 +66,20 @@ WebInspector.ShortcutsScreen.prototype = {
             return;
         this._tableReady = true;
 
-        var totalHeight = 0;
         var orderedSections = [];
-        for (var section in this._sections) {
-            totalHeight += this._sections[section]._height;
-            orderedSections.push(this._sections[section])
-        }
+        for (var section in this._sections)
+            orderedSections.push(this._sections[section]);
         function compareSections(a, b)
         {
             return a.order - b.order;
         }
         orderedSections.sort(compareSections);
 
-        // We're minimizing the height of the tallest column.
-        var minMax = totalHeight;
-        var minMaxIndex = -1;
-        var sum = 0;
-        for (var sectionIndex = 0; sectionIndex < orderedSections.length; ++sectionIndex) {
-            sum += orderedSections[sectionIndex]._height;
-            var max = Math.max(sum, totalHeight - sum);
-            if (minMax > max) {
-                minMax = max;
-                minMaxIndex = sectionIndex;
-            }
-        }
-
-        var table = document.createElement("table");
-        table.className = "help-table";
-        var row = table.createChild("tr");
-
-        var stopIndices = [0, minMaxIndex + 1, orderedSections.length];
-
-        for (var columnIndex = 1; columnIndex < stopIndices.length; ++columnIndex) {
-            var td = row.createChild("td");
-            td.style.width = "50%";
-            var column = td.createChild("table");
-            column.className = "help-column-table";
-            for (var i = stopIndices[columnIndex - 1]; i < stopIndices[columnIndex]; ++i)
-                orderedSections[i].renderSection(column);
-        }
-        parent.appendChild(table);
+        var container = document.createElement("div");
+        container.className = "help-container";
+        for (var i = 0; i < orderedSections.length; ++i)
+            orderedSections[i].renderSection(container);
+        parent.appendChild(container);
     }
 }
 
@@ -147,29 +124,28 @@ WebInspector.ShortcutsSection.prototype = {
         this._lines.push({ key: keyElement, text: description })
     },
 
-    renderSection: function(parent)
+    /**
+     * @param {!Element} container
+     */
+    renderSection: function(container)
     {
+        var parent = container.createChild("div", "help-block");
         this._renderHeader(parent);
 
-        for (var line = 0; line < this._lines.length; ++line) {
-            var tr = parent.createChild("tr");
-            var td = tr.createChild("td", "help-key-cell");
-            td.appendChild(this._lines[line].key);
-            td.appendChild(this._createSpan("help-key-delimiter", ":"));
-            tr.createChild("td").textContent = this._lines[line].text;
+        for (var i = 0; i < this._lines.length; ++i) {
+            var line = parent.createChild("div", "help-line");
+            var keyCell = line.createChild("div", "help-key-cell");
+            keyCell.appendChild(this._lines[i].key);
+            keyCell.appendChild(this._createSpan("help-key-delimiter", ":"));
+            line.createChild("div", "help-cell").textContent = this._lines[i].text;
         }
     },
 
     _renderHeader: function(parent)
     {
-        var trHead = parent.createChild("tr");
-        var thTitle;
-
-        trHead.createChild("th");
-
-        thTitle = trHead.createChild("th");
-        thTitle.className = "help-section-title";
-        thTitle.textContent = this.name;
+        var line = parent.createChild("div", "help-line");
+        line.createChild("div", "help-key-cell");
+        line.createChild("div", "help-section-title help-cell").textContent = this.name;
     },
 
     _renderSequence: function(sequence, delimiter)
@@ -184,11 +160,6 @@ WebInspector.ShortcutsSection.prototype = {
         return this._joinNodes(key.split(" + ").map(this._createSpan.bind(this, "help-key monospace")), plus);
     },
 
-    get _height()
-    {
-        return this._lines.length + 2; // add some space for header
-    },
-
     _createSpan: function(className, textContent)
     {
         var node = document.createElement("span");
diff --git a/Source/WebCore/inspector/front-end/ShowMoreDataGridNode.js b/Source/WebCore/inspector/front-end/ShowMoreDataGridNode.js
index e9ac6c514..0ba7f1b82 100644
--- a/Source/WebCore/inspector/front-end/ShowMoreDataGridNode.js
+++ b/Source/WebCore/inspector/front-end/ShowMoreDataGridNode.js
@@ -31,41 +31,74 @@
 /**
  * @constructor
  * @extends {WebInspector.DataGridNode}
+ * @param {function(number, number)} callback
+ * @param {number} startPosition
+ * @param {number} endPosition
+ * @param {number} chunkSize
  */
-WebInspector.ShowMoreDataGridNode = function(callback, nextCount, allCount)
+WebInspector.ShowMoreDataGridNode = function(callback, startPosition, endPosition, chunkSize)
 {
-    function populate(count)
-    {
-        var index = this.parent.children.indexOf(this);
-        this.parent.removeChild(this);
-        callback(count, index);
-    }
+    WebInspector.DataGridNode.call(this, {summaryRow:true}, false);
+    this._callback = callback;
+    this._startPosition = startPosition;
+    this._endPosition = endPosition;
+    this._chunkSize = chunkSize;
 
     this.showNext = document.createElement("button");
     this.showNext.setAttribute("type", "button");
-    this.showNext.textContent = WebInspector.UIString("Show next %d", nextCount);
-    this.showNext.addEventListener("click", populate.bind(this, nextCount), false);
+    this.showNext.addEventListener("click", this._showNextChunk.bind(this), false);
+    this.showNext.textContent = WebInspector.UIString("Show %d before", this._chunkSize);
 
-    if (allCount) {
-        this.showAll = document.createElement("button");
-        this.showAll.setAttribute("type", "button");
-        this.showAll.textContent = WebInspector.UIString("Show all %d", allCount);
-        this.showAll.addEventListener("click", populate.bind(this, allCount), false);
-    }
+    this.showAll = document.createElement("button");
+    this.showAll.setAttribute("type", "button");
+    this.showAll.addEventListener("click", this._showAll.bind(this), false);
 
-    WebInspector.DataGridNode.call(this, {summaryRow:true}, false);
+    this.showLast = document.createElement("button");
+    this.showLast.setAttribute("type", "button");
+    this.showLast.addEventListener("click", this._showLastChunk.bind(this), false);
+    this.showLast.textContent = WebInspector.UIString("Show %d after", this._chunkSize);
+
+    this._updateLabels();
     this.selectable = false;
 }
 
 WebInspector.ShowMoreDataGridNode.prototype = {
+    _showNextChunk: function()
+    {
+        this._callback(this._startPosition, this._startPosition + this._chunkSize);
+    },
+
+    _showAll: function()
+    {
+        this._callback(this._startPosition, this._endPosition);
+    },
+
+    _showLastChunk: function()
+    {
+        this._callback(this._endPosition - this._chunkSize, this._endPosition);
+    },
+
+    _updateLabels: function()
+    {
+        var totalSize = this._endPosition - this._startPosition;
+        if (totalSize > this._chunkSize) {
+            this.showNext.removeStyleClass("hidden");
+            this.showLast.removeStyleClass("hidden");
+        } else {
+            this.showNext.addStyleClass("hidden");
+            this.showLast.addStyleClass("hidden");
+        }
+        this.showAll.textContent = WebInspector.UIString("Show all %d", totalSize);
+    },
+
     createCells: function()
     {
         var cell = document.createElement("td");
         if (this.depth)
             cell.style.setProperty("padding-left", (this.depth * this.dataGrid.indentWidth) + "px");
         cell.appendChild(this.showNext);
-        if (this.showAll)
-            cell.appendChild(this.showAll);
+        cell.appendChild(this.showAll);
+        cell.appendChild(this.showLast);
         this._element.appendChild(cell);
 
         var columns = this.dataGrid.columns;
@@ -79,6 +112,24 @@ WebInspector.ShowMoreDataGridNode.prototype = {
     },
 
     /**
+     * @param {number} from
+     */
+    setStartPosition: function(from)
+    {
+        this._startPosition = from;
+        this._updateLabels();
+    },
+
+    /**
+     * @param {number} to
+     */
+    setEndPosition: function(to)
+    {
+        this._endPosition = to;
+        this._updateLabels();
+    },
+
+    /**
      * @override
      * @return {number}
      */
diff --git a/Source/WebCore/inspector/front-end/SidebarOverlay.js b/Source/WebCore/inspector/front-end/SidebarOverlay.js
index 3cd58a3ac..5dbee94a9 100644
--- a/Source/WebCore/inspector/front-end/SidebarOverlay.js
+++ b/Source/WebCore/inspector/front-end/SidebarOverlay.js
@@ -30,15 +30,12 @@
 
 /**
  * @constructor
- * @extends {WebInspector.Object}
  * @param {WebInspector.View} view
  * @param {string} widthSettingName
  * @param {number} minimalWidth
  */
 WebInspector.SidebarOverlay = function(view, widthSettingName, minimalWidth)
 {
-    WebInspector.Object.call(this);
-    
     this.element = document.createElement("div");
     this.element.className = "sidebar-overlay";
 
@@ -55,11 +52,6 @@ WebInspector.SidebarOverlay = function(view, widthSettingName, minimalWidth)
     this._installResizer(this._resizerElement);
 }
 
-WebInspector.SidebarOverlay.EventTypes = {
-    WasShown: "WasShown",
-    WillHide: "WillHide"
-}
-
 WebInspector.SidebarOverlay.prototype = {
     /**
      * @param {Element} relativeToElement
@@ -73,16 +65,6 @@ WebInspector.SidebarOverlay.prototype = {
         if (this._resizerWidgetElement)
             this.element.appendChild(this._resizerWidgetElement);
         this.position(relativeToElement);
-        this._boundContainingElementFocused = this._containingElementFocused.bind(this);
-        relativeToElement.addEventListener("mousedown", this._boundContainingElementFocused, false);
-
-        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WasShown, null);
-    },
-
-    _containingElementFocused: function(event)
-    {
-        if (!event.target.isSelfOrDescendant(this.element))
-            this.hide();
     },
 
     /**
@@ -105,15 +87,12 @@ WebInspector.SidebarOverlay.prototype = {
         if (!element)
             return;
 
-        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WillHide, null);
-        
         this._view.detach();
         element.removeChild(this.element);
         element.removeStyleClass("sidebar-overlay-shown");
         this.element.removeChild(this._resizerElement);
         if (this._resizerWidgetElement)
             this.element.removeChild(this._resizerWidgetElement);
-        element.removeEventListener("mousedown", this._boundContainingElementFocused, false);
     },
     
     /**
@@ -199,5 +178,3 @@ WebInspector.SidebarOverlay.prototype = {
         this._installResizer(resizerWidgetElement);
     }
 }
-
-WebInspector.SidebarOverlay.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/SnippetStorage.js b/Source/WebCore/inspector/front-end/SnippetStorage.js
new file mode 100644
index 000000000..114a503e3
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/SnippetStorage.js
@@ -0,0 +1,209 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.SnippetStorage = function(settingPrefix, namePrefix)
+{
+    this._snippets = {};
+
+    this._lastSnippetIdentifierSetting = WebInspector.settings.createSetting(settingPrefix + "Snippets_lastIdentifier", 0);
+    this._snippetsSetting = WebInspector.settings.createSetting(settingPrefix + "Snippets", []);
+    this._namePrefix = namePrefix;
+
+    this._loadSettings();
+}
+
+WebInspector.SnippetStorage.prototype = {
+    get namePrefix()
+    {
+        return this._namePrefix;
+    },
+
+    _saveSettings: function()
+    {
+        var savedSnippets = [];
+        for (var id in this._snippets)
+            savedSnippets.push(this._snippets[id].serializeToObject());
+        this._snippetsSetting.set(savedSnippets);
+    },
+
+    /**
+     * @return {Array.<WebInspector.Snippet>}
+     */
+    snippets: function()
+    {
+        var result = [];
+        for (var id in this._snippets)
+            result.push(this._snippets[id]);
+        return result;
+    },
+
+    /**
+     * @param {string} id
+     * @return {WebInspector.Snippet}
+     */
+    snippetForId: function(id)
+    {
+        return this._snippets[id];
+    },
+
+    _loadSettings: function()
+    {
+        var savedSnippets = this._snippetsSetting.get();
+        for (var i = 0; i < savedSnippets.length; ++i)
+            this._snippetAdded(WebInspector.Snippet.fromObject(savedSnippets[i]));
+    },
+
+    /**
+     * @param {WebInspector.Snippet} snippet
+     */
+    deleteSnippet: function(snippet)
+    {
+        delete this._snippets[snippet.id];
+        this._saveSettings();
+    },
+
+    /**
+     * @return {WebInspector.Snippet}
+     */
+    createSnippet: function()
+    {
+        var nextId = this._lastSnippetIdentifierSetting.get() + 1;
+        var snippetId = String(nextId);
+        this._lastSnippetIdentifierSetting.set(nextId);
+        var snippet = new WebInspector.Snippet(this, snippetId);
+        this._snippetAdded(snippet);
+        this._saveSettings();
+        return snippet;
+    },
+
+    /**
+     * @param {WebInspector.Snippet} snippet
+     */
+    _snippetAdded: function(snippet)
+    {
+        this._snippets[snippet.id] = snippet;
+    },
+    
+    reset: function()
+    {
+        this._lastSnippetIdentifierSetting.set(0);
+        this._snippetsSetting.set([]);
+        this._snippets = {};
+    }
+}
+
+WebInspector.SnippetStorage.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ * @param {WebInspector.SnippetStorage} storage
+ * @param {string} id
+ * @param {string=} name
+ * @param {string=} content
+ */
+WebInspector.Snippet = function(storage, id, name, content)
+{
+    this._storage = storage;
+    this._id = id;
+    this._name = name || storage.namePrefix + id;
+    this._content = content || "";
+}
+
+/**
+ * @param {Object} serializedSnippet
+ * @return {WebInspector.Snippet}
+ */
+WebInspector.Snippet.fromObject = function(serializedSnippet)
+{
+    return new WebInspector.Snippet(this, serializedSnippet.id, serializedSnippet.name, serializedSnippet.content);
+}
+
+WebInspector.Snippet.prototype = {
+    /**
+     * @return {string}
+     */
+    get id()
+    {
+        return this._id;
+    },
+
+    /**
+     * @return {string}
+     */
+    get name()
+    {
+        return this._name;
+    },
+
+    set name(name)
+    {
+        if (this._name === name)
+            return;
+
+        this._name = name;
+        this._storage._saveSettings();
+    },
+
+    /**
+     * @return {string}
+     */
+    get content()
+    {
+        return this._content;
+    },
+
+    set content(content)
+    {
+        if (this._content === content)
+            return;
+
+        this._content = content;
+        this._storage._saveSettings();
+    },
+
+    /**
+     * @return {Object}
+     */
+    serializeToObject: function()
+    {
+        var serializedSnippet = {};
+        serializedSnippet.id = this.id;
+        serializedSnippet.name = this.name;
+        serializedSnippet.content = this.content;
+        return serializedSnippet;
+    }
+}
+
+WebInspector.Snippet.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/SnippetsModel.js b/Source/WebCore/inspector/front-end/SnippetsModel.js
deleted file mode 100644
index 4051d5347..000000000
--- a/Source/WebCore/inspector/front-end/SnippetsModel.js
+++ /dev/null
@@ -1,487 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
- * OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * @constructor
- * @extends {WebInspector.Object}
- */
-WebInspector.SnippetsModel = function()
-{
-    this._snippets = {};
-
-    this._lastSnippetIdentifierSetting = WebInspector.settings.createSetting("lastSnippetIdentifier", 0);
-    this._snippetsSetting = WebInspector.settings.createSetting("snippets", []);
-    this._lastSnippetEvaluationIndexSetting = WebInspector.settings.createSetting("lastSnippetEvaluationIndex", 0);
-
-    this._loadSettings();
-}
-
-WebInspector.SnippetsModel.snippetsSourceURLPrefix = "snippets://";
-
-WebInspector.SnippetsModel.EventTypes = {
-    SnippetAdded: "SnippetAdded",
-    SnippetWillBeEvaluated: "SnippetWillBeEvaluated",
-    SnippetRenamed: "SnippetRenamed",
-    SnippetRemoved: "SnippetRemoved",
-}
-
-WebInspector.SnippetsModel.prototype = {
-    _saveSettings: function()
-    {
-        var savedSnippets = [];
-        for (var id in this._snippets)
-            savedSnippets.push(this._snippets[id].serializeToObject());
-        this._snippetsSetting.set(savedSnippets);
-    },
-
-    /**
-     * @return {Array.<WebInspector.Snippet>}
-     */
-    get snippets()
-    {
-        var result = [];
-        for (var id in this._snippets)
-            result.push(this._snippets[id]);
-        return result;
-    },
-
-    _loadSettings: function()
-    {
-        var savedSnippets = this._snippetsSetting.get();
-        for (var i = 0; i < savedSnippets.length; ++i)
-            this._snippetAdded(WebInspector.Snippet.fromObject(savedSnippets[i]));
-    },
-
-    /**
-     * @param {WebInspector.Snippet} snippet
-     */
-    deleteSnippet: function(snippet)
-    {
-        delete this._snippets[snippet.id];
-        this._saveSettings();
-        this.dispatchEventToListeners(WebInspector.SnippetsModel.EventTypes.SnippetRemoved, snippet);
-    },
-
-    /**
-     * @return {WebInspector.Snippet}
-     */
-    createSnippet: function()
-    {
-        var nextId = this._lastSnippetIdentifierSetting.get() + 1;
-        var snippetId = String(nextId);
-        this._lastSnippetIdentifierSetting.set(nextId);
-        var snippet = new WebInspector.Snippet(this, snippetId);
-        this._snippetAdded(snippet);
-        this._saveSettings();
-
-        return snippet;
-    },
-
-    /**
-     * @param {WebInspector.Snippet} snippet
-     */
-    _snippetAdded: function(snippet)
-    {
-        this._snippets[snippet.id] = snippet;
-        this.dispatchEventToListeners(WebInspector.SnippetsModel.EventTypes.SnippetAdded, snippet);
-    },
-
-    /**
-     * @param {string} snippetId
-     */
-    _snippetContentUpdated: function(snippetId)
-    {
-        this._saveSettings();
-    },
-
-    /**
-     * @param {WebInspector.Snippet} snippet
-     */
-    _snippetRenamed: function(snippet)
-    {
-        this._saveSettings();
-        this.dispatchEventToListeners(WebInspector.SnippetsModel.EventTypes.SnippetRenamed, snippet);
-    },
-
-    /**
-     * @param {WebInspector.Snippet} snippet
-     */
-    _evaluateSnippet: function(snippet)
-    {
-        this.dispatchEventToListeners(WebInspector.SnippetsModel.EventTypes.SnippetWillBeEvaluated, snippet);
-        var evaluationIndex = this._lastSnippetEvaluationIndexSetting.get() + 1;
-        this._lastSnippetEvaluationIndexSetting.set(evaluationIndex);
-
-        var sourceURL = this._sourceURLForSnippet(snippet, evaluationIndex);
-        snippet._lastEvaluationSourceURL = sourceURL;
-        var expression = "\n//@ sourceURL=" + sourceURL + "\n" + snippet.content;
-        WebInspector.evaluateInConsole(expression, true);
-    },
-
-    /**
-     * @param {WebInspector.Snippet} snippet
-     * @param {string} evaluationIndex
-     * @return {string}
-     */
-    _sourceURLForSnippet: function(snippet, evaluationIndex)
-    {
-        var snippetsPrefix = WebInspector.SnippetsModel.snippetsSourceURLPrefix;
-        var evaluationSuffix = evaluationIndex ? "_" + evaluationIndex : "";
-        return snippetsPrefix + snippet.id + evaluationSuffix;
-    },
-
-    /**
-     * @param {string} sourceURL
-     * @return {string|null}
-     */
-    snippetIdForSourceURL: function(sourceURL)
-    {
-        var snippetsPrefix = WebInspector.SnippetsModel.snippetsSourceURLPrefix;
-        if (!sourceURL.startsWith(snippetsPrefix))
-            return null;
-        var splittedURL = sourceURL.substring(snippetsPrefix.length).split("_");
-        var snippetId = splittedURL[0];
-        return snippetId;
-    },
-
-    /**
-     * @param {string} sourceURL
-     * @return {WebInspector.Snippet|null}
-     */
-    snippetForSourceURL: function(sourceURL)
-    {
-        var snippetId = this.snippetIdForSourceURL(sourceURL);
-        if (!snippetId)
-            return null;
-        var snippet = this._snippets[snippetId];
-        if (!snippet || snippet._lastEvaluationSourceURL !== sourceURL)
-            return null;
-        return snippet;
-    }
-}
-
-WebInspector.SnippetsModel.prototype.__proto__ = WebInspector.Object.prototype;
-
-/**
- * @constructor
- * @extends {WebInspector.Object}
- * @param {WebInspector.SnippetsModel} model
- * @param {string} id
- * @param {string=} name
- * @param {string=} content
- */
-WebInspector.Snippet = function(model, id, name, content)
-{
-    this._model = model;
-    this._id = id;
-    this._name = name || "Snippet #" + id;
-    this._content = content || "";
-}
-
-WebInspector.Snippet.evaluatedSnippetExtraLinesCount = 2;
-
-/**
- * @param {Object} serializedSnippet
- * @return {WebInspector.Snippet}
- */
-WebInspector.Snippet.fromObject = function(serializedSnippet)
-{
-    return new WebInspector.Snippet(this, serializedSnippet.id, serializedSnippet.name, serializedSnippet.content);
-}
-
-WebInspector.Snippet.prototype = {
-    /**
-     * @return {string}
-     */
-    get id()
-    {
-        return this._id;
-    },
-
-    /**
-     * @return {string}
-     */
-    get name()
-    {
-        return this._name;
-    },
-
-    set name(name)
-    {
-        if (this._name === name)
-            return;
-
-        this._name = name;
-        this._model._snippetRenamed(this);
-    },
-
-    /**
-     * @return {string}
-     */
-    get content()
-    {
-        return this._content;
-    },
-
-    set content(content)
-    {
-        if (this._content === content)
-            return;
-
-        this._content = content;
-        this._model._snippetContentUpdated(this._id);
-    },
-
-    evaluate: function()
-    {
-        this._model._evaluateSnippet(this);
-    },
-
-    /**
-     * @return {Object}
-     */
-    serializeToObject: function()
-    {
-        var serializedSnippet = {};
-        serializedSnippet.id = this.id;
-        serializedSnippet.name = this.name;
-        serializedSnippet.content = this.content;
-        return serializedSnippet;
-    }
-}
-
-WebInspector.Snippet.prototype.__proto__ = WebInspector.Object.prototype;
-
-/**
- * @constructor
- * @extends {WebInspector.ScriptMapping}
- */
-WebInspector.SnippetsScriptMapping = function()
-{
-    this._snippetForScriptId = {};
-    this._uiSourceCodeForScriptId = {};
-    this._scriptForUISourceCode = new Map();
-    this._uiSourceCodeForSnippet = new Map();
-
-    WebInspector.snippetsModel.addEventListener(WebInspector.SnippetsModel.EventTypes.SnippetAdded, this._handleSnippetAdded.bind(this));
-    WebInspector.snippetsModel.addEventListener(WebInspector.SnippetsModel.EventTypes.SnippetWillBeEvaluated, this._snippetWillBeEvaluated.bind(this));
-    WebInspector.snippetsModel.addEventListener(WebInspector.SnippetsModel.EventTypes.SnippetRemoved, this._snippetRemoved.bind(this));
-    for (var i = 0; i < WebInspector.snippetsModel.snippets.length; ++i)
-        this._snippetAdded(WebInspector.snippetsModel.snippets[i]);
-}
-
-WebInspector.SnippetsScriptMapping.prototype = {
-    /**
-     * @param {DebuggerAgent.Location} rawLocation
-     * @return {WebInspector.UILocation}
-     */
-    rawLocationToUILocation: function(rawLocation)
-    {
-        var uiSourceCode = this._uiSourceCodeForScriptId[rawLocation.scriptId];
-
-        var snippet = this._snippetForScriptId[rawLocation.scriptId];
-        if (snippet) {
-            var uiLineNumber = rawLocation.lineNumber - WebInspector.Snippet.evaluatedSnippetExtraLinesCount;
-            return new WebInspector.UILocation(uiSourceCode, uiLineNumber, rawLocation.columnNumber || 0);
-        }
-
-        return new WebInspector.UILocation(uiSourceCode, rawLocation.lineNumber, rawLocation.columnNumber || 0);
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {number} lineNumber
-     * @param {number} columnNumber
-     * @return {DebuggerAgent.Location}
-     */
-    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
-    {
-        var script = this._scriptForUISourceCode.get(uiSourceCode);
-        if (!script)
-            return null;
-
-        if (uiSourceCode.isSnippet) {
-            var rawLineNumber = lineNumber + WebInspector.Snippet.evaluatedSnippetExtraLinesCount;
-            return WebInspector.debuggerModel.createRawLocation(script, rawLineNumber, columnNumber);
-        }
-
-        return WebInspector.debuggerModel.createRawLocation(script, lineNumber, columnNumber);
-    },
-
-    /**
-     * @return {Array.<WebInspector.UISourceCode>}
-     */
-    uiSourceCodeList: function()
-    {
-        var result = this._uiSourceCodeForSnippet.values();
-        result = result.concat(this._releasedUISourceCodes());
-        return result;
-    },
-
-    /**
-     * @return {Array.<WebInspector.UISourceCode>}
-     */
-    _releasedUISourceCodes: function()
-    {
-        var result = [];
-        for (var scriptId in this._uiSourceCodeForScriptId) {
-            var uiSourceCode = this._uiSourceCodeForScriptId[scriptId];
-            if (uiSourceCode.isSnippet)
-                continue;
-            result.push(uiSourceCode);
-        }
-        return result;
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     */
-    addScript: function(script)
-    {
-        var snippet = WebInspector.snippetsModel.snippetForSourceURL(script.sourceURL);
-        if (!snippet) {
-            this._createUISourceCodeForScript(script);
-            return;
-        }
-        var uiSourceCode = this._uiSourceCodeForSnippet.get(snippet);
-        console.assert(!this._scriptForUISourceCode.get(uiSourceCode));
-
-        this._uiSourceCodeForScriptId[script.scriptId] = uiSourceCode;
-        this._snippetForScriptId[script.scriptId] = snippet;
-        this._scriptForUISourceCode.put(uiSourceCode, script);
-        script.setSourceMapping(this);
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _handleSnippetAdded: function(event)
-    {
-        var snippet = /** @type {WebInspector.Snippet} */ event.data;
-        this._snippetAdded(snippet);
-    },
-
-    /**
-     * @param {WebInspector.Snippet} snippet
-     */
-    _snippetAdded: function(snippet)
-    {
-        var uiSourceCodeId = ""; // FIXME: to be implemented.
-        var uiSourceCodeURL = ""; // FIXME: to be implemented.
-        var uiSourceCode = new WebInspector.JavaScriptSource(uiSourceCodeId, uiSourceCodeURL, new WebInspector.SnippetContentProvider(snippet));
-        uiSourceCode.isSnippet = true;
-        uiSourceCode.isEditable = true;
-        this._uiSourceCodeForSnippet.put(snippet, uiSourceCode);
-        uiSourceCode.snippet = snippet;
-        var data = { removedItems: [], addedItems: [uiSourceCode] };
-        this.dispatchEventToListeners(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, data);
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _snippetWillBeEvaluated: function(event)
-    {
-        var snippet = /** @type {WebInspector.Snippet} */ event.data;
-        this._releaseSnippetScript(snippet);
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     */
-    _createUISourceCodeForScript: function(script)
-    {
-        var uiSourceCode = new WebInspector.JavaScriptSource(script.sourceURL, script.sourceURL, script);
-        uiSourceCode.isSnippetEvaluation = true;
-        var oldUISourceCode = this._uiSourceCodeForScriptId[script.scriptId];
-        this._uiSourceCodeForScriptId[script.scriptId] = uiSourceCode;
-        this._scriptForUISourceCode.put(uiSourceCode, script);
-        var data = { removedItems: [], addedItems: [uiSourceCode] };
-        this.dispatchEventToListeners(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, data);
-        script.setSourceMapping(this);
-    },
-
-    /**
-     * @param {WebInspector.Snippet} snippet
-     */
-    _releaseSnippetScript: function(snippet)
-    {
-        var uiSourceCode = this._uiSourceCodeForSnippet.get(snippet);
-        var script = this._scriptForUISourceCode.get(uiSourceCode);
-        if (!script)
-            return;
-
-        delete this._uiSourceCodeForScriptId[script.scriptId];
-        delete this._snippetForScriptId[script.scriptId];
-        this._scriptForUISourceCode.remove(uiSourceCode);
-
-        this._createUISourceCodeForScript(script);
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _snippetRemoved: function(event)
-    {
-        var snippet = /** @type {WebInspector.Snippet} */ event.data;
-        var uiSourceCode = this._uiSourceCodeForSnippet.get(snippet);
-        this._releaseSnippetScript(snippet);
-        this._uiSourceCodeForSnippet.remove(snippet);
-        var data = { removedItems: [uiSourceCode], addedItems: [] };
-        this.dispatchEventToListeners(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, data);
-    },
-
-    reset: function()
-    {
-        var removedUISourceCodes = this._releasedUISourceCodes();
-        this._snippetForScriptId = {};
-        this._uiSourceCodeForScriptId = {};
-        this._scriptForUISourceCode = new Map();
-        var data = { removedItems: removedUISourceCodes, addedItems: [] };
-        this.dispatchEventToListeners(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, data);
-    }
-}
-
-WebInspector.SnippetsScriptMapping.prototype.__proto__ = WebInspector.ScriptMapping.prototype;
-
-/**
- * @constructor
- * @extends {WebInspector.StaticContentProvider}
- * @param {WebInspector.Snippet} snippet
- */
-WebInspector.SnippetContentProvider = function(snippet)
-{
-    WebInspector.StaticContentProvider.call(this, "text/javascript", snippet.content);
-}
-
-WebInspector.SnippetContentProvider.prototype.__proto__ = WebInspector.StaticContentProvider.prototype;
-
-/**
- * @type {?WebInspector.SnippetsModel}
- */
-WebInspector.snippetsModel = null;
diff --git a/Source/WebCore/inspector/front-end/SourceFrame.js b/Source/WebCore/inspector/front-end/SourceFrame.js
index 11db645d7..b6df75f28 100644
--- a/Source/WebCore/inspector/front-end/SourceFrame.js
+++ b/Source/WebCore/inspector/front-end/SourceFrame.js
@@ -31,13 +31,15 @@
 /**
  * @extends {WebInspector.View}
  * @constructor
+ * @param {WebInspector.ContentProvider} contentProvider
  */
-WebInspector.SourceFrame = function(url)
+WebInspector.SourceFrame = function(contentProvider)
 {
     WebInspector.View.call(this);
     this.element.addStyleClass("script-view");
 
-    this._url = url;
+    this._url = contentProvider.contentURL();
+    this._contentProvider = contentProvider;
 
     this._textModel = new WebInspector.TextEditorModel();
 
@@ -114,18 +116,11 @@ WebInspector.SourceFrame.prototype = {
     {
         if (!this._contentRequested) {
             this._contentRequested = true;
-            this.requestContent(this.setContent.bind(this));
+            this._contentProvider.requestContent(this.setContent.bind(this));
         }
     },
 
     /**
-     * @param {function(?string, boolean, string)} callback
-     */
-    requestContent: function(callback)
-    {
-    },
-
-    /**
      * @param {TextDiff} diffData
      */
     markDiff: function(diffData)
@@ -473,6 +468,33 @@ WebInspector.SourceFrame.prototype = {
         rowMessage.repeatCountElement.textContent = WebInspector.UIString(" (repeated %d times)", rowMessage.repeatCount);
     },
 
+    removeMessageFromSource: function(lineNumber, msg)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            lineNumber = this._textModel.linesCount - 1;
+        if (lineNumber < 0)
+            lineNumber = 0;
+
+        var rowMessages = this._rowMessages[lineNumber];
+        for (var i = 0; rowMessages && i < rowMessages.length; ++i) {
+            var rowMessage = rowMessages[i];
+            if (rowMessage.consoleMessage !== msg)
+                continue;
+
+            var messageLineElement = rowMessage.element;
+            var messageBubbleElement = messageLineElement.parentElement;
+            messageBubbleElement.removeChild(messageLineElement);
+            rowMessages.remove(rowMessage);
+            if (!rowMessages.length)
+                delete this._rowMessages[lineNumber];
+            if (!messageBubbleElement.childElementCount) {
+                this._textViewer.removeDecoration(lineNumber, messageBubbleElement);
+                delete this._messageBubbles[lineNumber];
+            }
+            break;
+        }
+    },
+
     populateLineGutterContextMenu: function(contextMenu, lineNumber)
     {
     },
@@ -489,29 +511,18 @@ WebInspector.SourceFrame.prototype = {
         this._textViewer.inheritScrollPositions(sourceFrame._textViewer);
     },
 
+    /**
+     * @return {boolean}
+     */
     canEditSource: function()
     {
         return false;
     },
 
-    commitEditing: function()
-    {
-        function callback(error)
-        {
-            this.didEditContent(error, this._textModel.text);
-        }
-        this.editContent(this._textModel.text, callback.bind(this));
-    },
-
-    didEditContent: function(error, content)
-    {
-        if (error) {
-            WebInspector.log(error, WebInspector.ConsoleMessage.MessageLevel.Error, true);
-            return;
-        }
-    },
-
-    editContent: function(newContent, callback)
+    /**
+     * @param {string} text 
+     */
+    commitEditing: function(text)
     {
     }
 }
@@ -541,7 +552,7 @@ WebInspector.TextViewerDelegateForSourceFrame.prototype = {
 
     commitEditing: function()
     {
-        this._sourceFrame.commitEditing();
+        this._sourceFrame.commitEditing(this._sourceFrame._textModel.text);
     },
 
     populateLineGutterContextMenu: function(contextMenu, lineNumber)
diff --git a/Source/WebCore/inspector/front-end/SourceMapping.js b/Source/WebCore/inspector/front-end/SourceMapping.js
new file mode 100644
index 000000000..432a76db9
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/SourceMapping.js
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @interface
+ */
+WebInspector.SourceMapping = function()
+{
+}
+
+WebInspector.SourceMapping.prototype = {
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.UILocation}
+     */
+    rawLocationToUILocation: function(rawLocation) { },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber) { }
+}
diff --git a/Source/WebCore/inspector/front-end/Spectrum.js b/Source/WebCore/inspector/front-end/Spectrum.js
index 0c1b814d8..6f0725706 100644
--- a/Source/WebCore/inspector/front-end/Spectrum.js
+++ b/Source/WebCore/inspector/front-end/Spectrum.js
@@ -94,7 +94,7 @@ WebInspector.Spectrum = function()
         this._onchange();
     }
 
-    this._hideProxy = this.hide.bind(this);
+    this._hideProxy = this.hide.bind(this, true);
 };
 
 WebInspector.Spectrum.Events = {
@@ -364,7 +364,7 @@ WebInspector.Spectrum.prototype = {
     toggle: function(element, color, format)
     {
         if (this.visible)
-            this.hide();
+            this.hide(true);
         else
             this.show(element, color, format);
 
@@ -378,7 +378,7 @@ WebInspector.Spectrum.prototype = {
                 return false;
 
             // Reopen the picker for another anchor element.
-            this.hide();
+            this.hide(true);
         }
 
         this.reposition(element);
@@ -409,14 +409,17 @@ WebInspector.Spectrum.prototype = {
         WebInspector.setCurrentFocusElement(this._containerElement);
     },
 
-    hide: function()
+    /**
+     * @param {boolean} commitEdit
+     */
+    hide: function(commitEdit)
     {
         this._popover.hide();
 
         document.removeEventListener("mousedown", this._hideProxy, false);
         window.removeEventListener("blur", this._hideProxy, false);
 
-        this.dispatchEventToListeners(WebInspector.Spectrum.Events.Hidden);
+        this.dispatchEventToListeners(WebInspector.Spectrum.Events.Hidden, !!commitEdit);
 
         WebInspector.setCurrentFocusElement(this._previousFocusElement);
         delete this._previousFocusElement;
@@ -426,8 +429,13 @@ WebInspector.Spectrum.prototype = {
 
     _onKeyDown: function(event)
     {
-        if (event.keyIdentifier === "Enter" || event.keyIdentifier === "U+001B") { // Escape key
-            this.hide();
+        if (event.keyIdentifier === "Enter") {
+            this.hide(true);
+            event.consume(true);
+            return;
+        }
+        if (event.keyIdentifier === "U+001B") { // Escape key
+            this.hide(false);
             event.consume(true);
         }
     }
diff --git a/Source/WebCore/inspector/front-end/StylesPanel.js b/Source/WebCore/inspector/front-end/StylesPanel.js
index ded11a7c2..ec975b299 100644
--- a/Source/WebCore/inspector/front-end/StylesPanel.js
+++ b/Source/WebCore/inspector/front-end/StylesPanel.js
@@ -28,70 +28,31 @@
 
 /**
  * @constructor
- * @extends {WebInspector.Panel}
- * @implements {WebInspector.TabbedEditorContainerDelegate}
+ * @extends {WebInspector.Object}
+ * @implements {WebInspector.UISourceCodeProvider}
  */
-WebInspector.StylesPanel = function()
+WebInspector.StylesUISourceCodeProvider = function()
 {
-    WebInspector.Panel.call(this, "styles");
-    this.registerRequiredCSS("scriptsPanel.css");
-
-    const initialNavigatorWidth = 225;
-    const minimalViewsContainerWidthPercent = 50;
-
-    this._mainView = new WebInspector.SplitView(WebInspector.SplitView.SidebarPosition.Left, "stylesPanelNavigatorSidebarWidth", initialNavigatorWidth);
-    this._mainView.element.id = "styles-main-view";
-    this._mainView.element.tabIndex = 0;
-
-    this._mainView.minimalSidebarWidth = Preferences.minScriptsSidebarWidth;
-    this._mainView.minimalMainWidthPercent = minimalViewsContainerWidthPercent;
-
-    this._navigatorView = new WebInspector.NavigatorView();
-    this._navigatorView.addEventListener(WebInspector.NavigatorView.Events.ItemSelected, this._itemSelected, this);
-
-    this._tabbedPane = new WebInspector.TabbedPane();
-    this._tabbedPane.element.addStyleClass("navigator-tabbed-pane");
-    this._tabbedPane.shrinkableTabs = true;
-    this._tabbedPane.appendTab(WebInspector.ScriptsNavigator.ScriptsTab, WebInspector.UIString("Stylesheets"), this._navigatorView);
-    this._tabbedPane.show(this._mainView.sidebarElement);
-
-    this._editorContainer = new WebInspector.TabbedEditorContainer(this, "previouslyViewedCSSFiles");
-    this._editorContainer.show(this._mainView.mainElement);
-
-    this._mainView.show(this.element);
-
-    this._navigatorController = new WebInspector.NavigatorOverlayController(this, this._mainView, this._tabbedPane, this._editorContainer.view);
-
-    WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.CachedResourcesLoaded, this._cachedResourcesLoaded, this);
+    WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.CachedResourcesLoaded, this._initialize, this);
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.WillLoadCachedResources, this._reset, this);
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.MainFrameNavigated, this._reset, this);
 
-    this._sourceFramesForResource = new Map();
-    this._urlToResource = {};
-
-    var openResourceShortcut = WebInspector.OpenResourceDialog.createShortcut();
-    this.registerShortcut(openResourceShortcut.key, this._showOpenStylesheetDialog.bind(this));
+    this._uiSourceCodes = [];
 }
 
-WebInspector.StylesPanel.prototype = {
-    wasShown: function()
+WebInspector.StylesUISourceCodeProvider.prototype = {
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodes: function()
     {
-        WebInspector.Panel.prototype.wasShown.call(this);
-        this._navigatorController.wasShown();
-        this._initialize();
+        return this._uiSourceCodes;
     },
 
     _initialize: function()
     {
-        if (!this._initialized && this.isShowing() && this._cachedResourcesWereLoaded) {
-            this._populateResourceTree();
-            this._initialized = true;
-        }
-    },
-
-    _populateResourceTree: function()
-    {
-        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, this._resourceAdded, this);
+        if (this._initialized)
+            return;
 
         function populateFrame(frame)
         {
@@ -103,6 +64,9 @@ WebInspector.StylesPanel.prototype = {
                 this._resourceAdded({data:resources[i]});
         }
         populateFrame.call(this, WebInspector.resourceTreeModel.mainFrame);
+
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, this._resourceAdded, this);
+        this._initialized = true;
     },
 
     _resourceAdded: function(event)
@@ -110,120 +74,197 @@ WebInspector.StylesPanel.prototype = {
         var resource = event.data;
         if (resource.type !== WebInspector.resourceTypes.Stylesheet)
             return;
-        this._urlToResource[resource.url] = resource;
-        this._navigatorView.addUISourceCode(resource);
-        this._editorContainer.uiSourceCodeAdded(resource);
+        var uiSourceCode = new WebInspector.StyleSource(resource);
+        this._uiSourceCodes.push(uiSourceCode);
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, uiSourceCode);
     },
 
     _reset: function()
     {
-        this._navigatorView.reset();
-        this._editorContainer.reset();
-        this._urlToResource = {};
-        this._sourceFramesForResource = new Map();
-    },
+        this._uiSourceCodes = [];
+    }
+}
 
-    _cachedResourcesLoaded: function()
-    {
-        this._cachedResourcesWereLoaded = true;
-        this._initialize();
-    },
+WebInspector.StylesUISourceCodeProvider.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.UISourceCode}
+ * @param {WebInspector.Resource} resource
+ */
+WebInspector.StyleSource = function(resource)
+{
+    WebInspector.UISourceCode.call(this, resource.url, resource);
+    this._resource = resource;
+}
+
+WebInspector.StyleSource.prototype = {
+}
 
-    get toolbarItemLabel()
+WebInspector.StyleSource.prototype.__proto__ = WebInspector.UISourceCode.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.SourceFrame}
+ * @param {WebInspector.StyleSource} styleSource
+ */
+WebInspector.StyleSourceFrame = function(styleSource)
+{
+    this._resource = styleSource._resource;
+    this._styleSource = styleSource;
+    WebInspector.SourceFrame.call(this, this._styleSource);
+    this._resource.addEventListener(WebInspector.Resource.Events.RevisionAdded, this._contentChanged, this);
+}
+
+WebInspector.StyleSourceFrame.prototype = {
+    /**
+     * @return {boolean}
+     */
+    canEditSource: function()
     {
-        return WebInspector.UIString("Styles");
+        return true;
     },
 
     /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     * @return {WebInspector.SourceFrame}
+     * @param {string} text
      */
-    viewForFile: function(uiSourceCode)
+    commitEditing: function(text)
     {
-        var sourceFrame = this._sourceFramesForResource.get(uiSourceCode);
-        if (!sourceFrame) {
-            sourceFrame = new WebInspector.EditableResourceSourceFrame(uiSourceCode);
-            sourceFrame.addEventListener(WebInspector.EditableResourceSourceFrame.Events.TextEdited, this._textEdited, this);
-            this._sourceFramesForResource.put(uiSourceCode, sourceFrame);
-        }
-        return sourceFrame;
+        this._resource.setContent(text, true, function() {});
     },
 
-    _textEdited: function(event)
+    afterTextChanged: function(oldRange, newRange)
     {
-        var sourceFrame = /** @type {WebInspector.EditableResourceSourceFrame} */ event.data;
-        this._editorContainer.setFileIsDirty(sourceFrame.resource, sourceFrame.isDirty());
+        function commitIncrementalEdit()
+        {
+            var text = this._textModel.text;
+            this._styleSource.setWorkingCopy(text);
+            this._resource.setContent(text, false, function() {});
+        }
+        const updateTimeout = 200;
+        this._incrementalUpdateTimer = setTimeout(commitIncrementalEdit.bind(this), updateTimeout);
     },
 
-    _itemSelected: function(event)
+    _clearIncrementalUpdateTimer: function()
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data.uiSourceCode;
-        this._showFile(uiSourceCode);
-        this._navigatorController.hideNavigatorOverlay();
-        if (event.data.focusSource)
-            this._editorContainer.view.focus();
+        if (this._incrementalUpdateTimer)
+            clearTimeout(this._incrementalUpdateTimer);
+        delete this._incrementalUpdateTimer;
     },
 
-    _showFile: function(uiSourceCode)
+    _contentChanged: function(event)
     {
-        this._navigatorView.revealUISourceCode(uiSourceCode);
-        this._editorContainer.showFile(uiSourceCode);
-    },
+        this._styleSource.contentChanged(this._resource.content || "");
+        this.setContent(this._resource.content, false, "text/stylesheet");
+    }
+}
+
+WebInspector.StyleSourceFrame.prototype.__proto__ = WebInspector.SourceFrame.prototype;
+
+/**
+ * @constructor
+ * @implements {WebInspector.SelectionDialogContentProvider}
+ * @param {WebInspector.View} view
+ * @param {WebInspector.StyleSource} styleSource
+ */
+WebInspector.StyleSheetOutlineDialog = function(view, styleSource)
+{
+    WebInspector.SelectionDialogContentProvider.call(this);
+
+    this._rules = [];
+    this._view = view;
+    this._styleSource = styleSource;
+}
+
+/**
+ * @param {WebInspector.View} view
+ * @param {WebInspector.StyleSource} styleSource
+ */
+WebInspector.StyleSheetOutlineDialog.show = function(view, styleSource)
+{
+    if (WebInspector.Dialog.currentInstance())
+        return null;
+    var delegate = new WebInspector.StyleSheetOutlineDialog(view, styleSource);
+    var filteredItemSelectionDialog = new WebInspector.FilteredItemSelectionDialog(delegate);
+    WebInspector.Dialog.show(view.element, filteredItemSelectionDialog);
+}
 
-    canShowAnchorLocation: function(anchor)
+WebInspector.StyleSheetOutlineDialog.prototype = {
+    /**
+     * @param {number} itemIndex
+     * @return {string}
+     */
+    itemTitleAt: function(itemIndex)
     {
-        var resource = WebInspector.resourceForURL(anchor.href);
-        return !!resource && resource.type === WebInspector.resourceTypes.Stylesheet;
+        return this._rules[itemIndex].selectorText;
     },
 
-    showAnchorLocation: function(anchor)
+    /**
+     * @param {number} itemIndex
+     * @return {string}
+     */
+    itemKeyAt: function(itemIndex)
     {
-        var resource = this._urlToResource[anchor.href];
-        if (!resource)
-            return;
-
-        this._showFile(resource);
-        var sourceFrame = this._sourceFramesForResource.get(resource);
-        if (typeof anchor.lineNumber === "number")
-            sourceFrame.highlightLine(anchor.lineNumber);
-        this._editorContainer.view.focus();
+        return this._rules[itemIndex].selectorText;
     },
 
-    _showOpenStylesheetDialog: function()
+    /**
+     * @return {number}
+     */
+    itemsCount: function()
     {
-        if (WebInspector.Dialog.currentInstance())
-            return;
+        return this._rules.length;
+    },
 
-        var dialog = new WebInspector.FilteredItemSelectionDialog(new WebInspector.OpenStylesheetDialog(this));
-        WebInspector.Dialog.show(this.element, dialog);
-    }
-}
+    /**
+     * @param {function(number, number, number, number)} callback
+     */
+    requestItems: function(callback)
+    {
+        function didGetAllStyleSheets(error, infos)
+        {
+            if (error) {
+                callback(0, 0, 0, 0);
+                return;
+            }
+  
+            for (var i = 0; i < infos.length; ++i) {
+                var info = infos[i];
+                if (info.sourceURL === this._styleSource.contentURL()) {
+                    WebInspector.CSSStyleSheet.createForId(info.styleSheetId, didGetStyleSheet.bind(this));
+                    return;
+                }
+            }
+            callback(0, 0, 0, 0);
+        }
 
-WebInspector.StylesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
+        CSSAgent.getAllStyleSheets(didGetAllStyleSheets.bind(this));
 
-/**
- * @constructor
- * @extends {WebInspector.OpenResourceDialog}
- * @param {WebInspector.StylesPanel} panel
- */
-WebInspector.OpenStylesheetDialog = function(panel)
-{
-    var resources = [];
-    for (var url in panel._urlToResource)
-        resources.push(panel._urlToResource[url]);
-    WebInspector.OpenResourceDialog.call(this, resources);
+        /**
+         * @param {?WebInspector.CSSStyleSheet} styleSheet
+         */
+        function didGetStyleSheet(styleSheet)
+        {
+            if (!styleSheet) {
+                callback(0, 0, 0, 0);
+                return;
+            }
 
-    this._panel = panel;
-}
+            this._rules = styleSheet.rules;
+            callback(0, this._rules.length, 0, 1);
+        }
+    },
 
-WebInspector.OpenStylesheetDialog.prototype = {
     /**
      * @param {number} itemIndex
      */
     selectItem: function(itemIndex)
     {
-        this._panel._showFile(this.resources[itemIndex]);
+        var lineNumber = this._rules[itemIndex].sourceLine;
+        if (!isNaN(lineNumber) && lineNumber >= 0)
+            this._view.highlightLine(lineNumber);
+        this._view.focus();
     }
 }
 
-WebInspector.OpenStylesheetDialog.prototype.__proto__ = WebInspector.OpenResourceDialog.prototype;
+WebInspector.StyleSheetOutlineDialog.prototype.__proto__ = WebInspector.SelectionDialogContentProvider.prototype;
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index 26a3fb818..ea1856ced 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -217,7 +217,7 @@ WebInspector.StylesSidebarPane.prototype = {
     update: function(node, forceUpdate)
     {
         if (this._spectrum.visible)
-            this._spectrum.hide();
+            this._spectrum.hide(false);
 
         var refresh = false;
 
@@ -879,7 +879,7 @@ WebInspector.StylesSidebarPane.prototype = {
     willHide: function()
     {
         if (this._spectrum.visible)
-            this._spectrum.hide();
+            this._spectrum.hide(false);
     }
 }
 
@@ -959,7 +959,7 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
                 var refElement = mediaDataElement.createChild("div", "subtitle");
                 var lineNumber = media.sourceLine < 0 ? undefined : media.sourceLine;
                 var anchor = WebInspector.linkifyResourceAsNode(media.sourceURL, lineNumber, "subtitle", media.sourceURL + (isNaN(lineNumber) ? "" : (":" + (lineNumber + 1))));
-                anchor.preferredPanel = "styles";
+                anchor.preferredPanel = "scripts";
                 anchor.style.float = "right";
                 refElement.appendChild(anchor);
             }
@@ -1213,7 +1213,7 @@ WebInspector.StylePropertiesSection.prototype = {
         function linkifyUncopyable(url, line)
         {
             var link = WebInspector.linkifyResourceAsNode(url, line, "", url + ":" + (line + 1));
-            link.preferredPanel = "styles";
+            link.preferredPanel = "scripts";
             link.classList.add("webkit-html-resource-link");
             link.setAttribute("data-uncopyable", link.textContent);
             link.textContent = "";
@@ -1774,14 +1774,17 @@ WebInspector.StylePropertyTreeElement.prototype = {
                     self.applyStyleText(nameElement.textContent + ": " + valueElement.textContent, false, false, false);
                 }
 
-                function spectrumHidden()
+                function spectrumHidden(event)
                 {
                     scrollerElement.removeEventListener("scroll", repositionSpectrum, false);
-                    self.applyStyleText(nameElement.textContent + ": " + valueElement.textContent, true, true, false);
+                    var commitEdit = event.data;
+                    var propertyText = !commitEdit && self.originalPropertyText ? self.originalPropertyText : (nameElement.textContent + ": " + valueElement.textContent);
+                    self.applyStyleText(propertyText, true, true, false);
                     spectrum.removeEventListener(WebInspector.Spectrum.Events.ColorChanged, spectrumChanged);
                     spectrum.removeEventListener(WebInspector.Spectrum.Events.Hidden, spectrumHidden);
 
                     delete self._parentPane._isEditingStyle;
+                    delete self.originalPropertyText;
                 }
 
                 function repositionSpectrum()
@@ -1800,6 +1803,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
                         if (visible) {
                             spectrum.displayText = color.toString(format);
+                            self.originalPropertyText = self.property.propertyText;
                             self._parentPane._isEditingStyle = true;
                             spectrum.addEventListener(WebInspector.Spectrum.Events.ColorChanged, spectrumChanged);
                             spectrum.addEventListener(WebInspector.Spectrum.Events.Hidden, spectrumHidden);
@@ -1888,7 +1892,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
                         colorValueElement.textContent = currentValue;
                 }
 
-                var container = document.createDocumentFragment();
+                var container = document.createElement("nobr");
                 container.appendChild(swatchElement);
                 container.appendChild(colorValueElement);
                 return container;
diff --git a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
index 57e696bbe..58c0e1934 100644
--- a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
+++ b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
@@ -47,6 +47,7 @@ WebInspector.TabbedEditorContainerDelegate.prototype = {
  */
 WebInspector.TabbedEditorContainer = function(delegate, settingName)
 {
+    WebInspector.Object.call(this);
     this._delegate = delegate;
 
     this._tabbedPane = new WebInspector.TabbedPane();
@@ -135,15 +136,21 @@ WebInspector.TabbedEditorContainer.prototype = {
         const maxDisplayNameLength = 30;
         const minDisplayQueryParamLength = 5;
 
+        var title;
         var parsedURL = uiSourceCode.parsedURL;
         if (!parsedURL.isValid)
-            return parsedURL.url ? parsedURL.url.trimMiddle(maxDisplayNameLength) : WebInspector.UIString("(program)");
-
-        var maxDisplayQueryParamLength = Math.max(minDisplayQueryParamLength, maxDisplayNameLength - parsedURL.lastPathComponent.length);
-        var displayQueryParams = parsedURL.queryParams ? "?" + parsedURL.queryParams.trimEnd(maxDisplayQueryParamLength - 1) : "";
-        var displayLastPathComponent = parsedURL.lastPathComponent.trimMiddle(maxDisplayNameLength - displayQueryParams.length);
-        var displayName = displayLastPathComponent + displayQueryParams;
-        return displayName || WebInspector.UIString("(program)");
+            title = parsedURL.url ? parsedURL.url.trimMiddle(maxDisplayNameLength) : WebInspector.UIString("(program)");
+        else {
+            var maxDisplayQueryParamLength = Math.max(minDisplayQueryParamLength, maxDisplayNameLength - parsedURL.lastPathComponent.length);
+            var displayQueryParams = parsedURL.queryParams ? "?" + parsedURL.queryParams.trimEnd(maxDisplayQueryParamLength - 1) : "";
+            var displayLastPathComponent = parsedURL.lastPathComponent.trimMiddle(maxDisplayNameLength - displayQueryParams.length);
+            var displayName = displayLastPathComponent + displayQueryParams;
+            title = displayName || WebInspector.UIString("(program)");
+        }
+        
+        if (uiSourceCode.isDirty())
+            title += "*";
+        return title;
     },
 
     /**
@@ -217,8 +224,12 @@ WebInspector.TabbedEditorContainer.prototype = {
         var tabId = this._generateTabId();
         this._tabIds.put(uiSourceCode, tabId);
         this._files[tabId] = uiSourceCode;
-        
+
         this._tabbedPane.appendTab(tabId, title, view, tooltip, userGesture);
+
+        uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.TitleChanged, this._uiSourceCodeTitleChanged, this);
+        uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.WorkingCopyChanged, this._uiSourceCodeWorkingCopyChanged, this);
+        uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.ContentChanged, this._uiSourceCodeContentChanged, this);
         return tabId;
     },
 
@@ -228,7 +239,7 @@ WebInspector.TabbedEditorContainer.prototype = {
     _removeFileTab: function(uiSourceCode)
     {
         var tabId = this._tabIds.get(uiSourceCode);
-        
+
         if (tabId)
             this._tabbedPane.closeTab(tabId);
     },
@@ -246,6 +257,10 @@ WebInspector.TabbedEditorContainer.prototype = {
         delete this._files[tabId];
         delete this._currentFile;
 
+        uiSourceCode.removeEventListener(WebInspector.UISourceCode.Events.TitleChanged, this._uiSourceCodeTitleChanged, this);
+        uiSourceCode.removeEventListener(WebInspector.UISourceCode.Events.WorkingCopyChanged, this._uiSourceCodeWorkingCopyChanged, this);
+        uiSourceCode.removeEventListener(WebInspector.UISourceCode.Events.ContentChanged, this._uiSourceCodeContentChanged, this);
+
         this.dispatchEventToListeners(WebInspector.TabbedEditorContainer.Events.EditorClosed, uiSourceCode);
 
         if (userGesture)
@@ -266,9 +281,9 @@ WebInspector.TabbedEditorContainer.prototype = {
 
     /**
      * @param {WebInspector.UISourceCode} oldUISourceCode
-     * @param {WebInspector.UISourceCode} newUISourceCode
+     * @param {WebInspector.UISourceCode} uiSourceCode
      */
-    _replaceFileTab: function(oldUISourceCode, newUISourceCode)
+    replaceFile: function(oldUISourceCode, uiSourceCode)
     {
         var tabId = this._tabIds.get(oldUISourceCode);
         
@@ -277,52 +292,44 @@ WebInspector.TabbedEditorContainer.prototype = {
         
         delete this._files[this._tabIds.get(oldUISourceCode)]
         this._tabIds.remove(oldUISourceCode);
-        this._tabIds.put(newUISourceCode, tabId);
-        this._files[tabId] = newUISourceCode;
+        this._tabIds.put(uiSourceCode, tabId);
+        this._files[tabId] = uiSourceCode;
 
-        this._tabbedPane.changeTabTitle(tabId, this._titleForFile(newUISourceCode));
-        this._tabbedPane.changeTabView(tabId, this._delegate.viewForFile(newUISourceCode));
-        this._tabbedPane.changeTabTooltip(tabId, this._tooltipForFile(newUISourceCode));
+        this._tabbedPane.changeTabTitle(tabId, this._titleForFile(uiSourceCode));
+        this._tabbedPane.changeTabView(tabId, this._delegate.viewForFile(uiSourceCode));
+        this._tabbedPane.changeTabTooltip(tabId, this._tooltipForFile(uiSourceCode));
     },
 
     /**
-     * @param {Array.<WebInspector.UISourceCode>} oldUISourceCodeList
-     * @param {Array.<WebInspector.UISourceCode>} uiSourceCodeList
-     */
-    replaceFiles: function(oldUISourceCodeList, uiSourceCodeList)
-    {
-        var mainFile;
-        for (var i = 0; i < oldUISourceCodeList.length; ++i) {
-            var tabId = this._tabIds.get(oldUISourceCodeList[i]);
-            if (tabId && (!mainFile || this._tabbedPane.selectedTabId === tabId)) {
-                mainFile = oldUISourceCodeList[i];
-                break;
-            } 
-        }
-        
-        if (!mainFile)
-            return;
-        
-        this._replaceFileTab(mainFile, uiSourceCodeList[0]);
-        for (var i = 0; i < oldUISourceCodeList.length; ++i)
-            this._removeFileTab(oldUISourceCodeList[i]);
-    },
-    
-    /**
      * @param {WebInspector.UISourceCode} uiSourceCode
-     * @param {boolean} isDirty
      */
-    setFileIsDirty: function(uiSourceCode, isDirty)
+    _updateFileTitle: function(uiSourceCode)
     {
         var tabId = this._tabIds.get(uiSourceCode);
         if (tabId) {
             var title = this._titleForFile(uiSourceCode);
-            if (isDirty)
-                title += "*";
             this._tabbedPane.changeTabTitle(tabId, title);
         }
     },
 
+    _uiSourceCodeTitleChanged: function(event)
+    {
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        this._updateFileTitle(uiSourceCode);
+    },
+
+    _uiSourceCodeWorkingCopyChanged: function(event)
+    {
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        this._updateFileTitle(uiSourceCode);
+    },
+
+    _uiSourceCodeContentChanged: function(event)
+    {
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        this._updateFileTitle(uiSourceCode);
+    },
+
     reset: function()
     {
         this._tabbedPane.closeAllTabs();
@@ -339,6 +346,14 @@ WebInspector.TabbedEditorContainer.prototype = {
     _generateTabId: function()
     {
         return "tab_" + (WebInspector.TabbedEditorContainer._tabId++);
+    },
+
+    /**
+     * @return {WebInspector.UISourceCode} uiSourceCode
+     */
+    currentFile: function()
+    {
+        return this._currentFile;
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/TabbedPane.js b/Source/WebCore/inspector/front-end/TabbedPane.js
index da694e414..09dc22059 100644
--- a/Source/WebCore/inspector/front-end/TabbedPane.js
+++ b/Source/WebCore/inspector/front-end/TabbedPane.js
@@ -139,7 +139,7 @@ WebInspector.TabbedPane.prototype = {
 
         this._tabsHistory.splice(this._tabsHistory.indexOf(tab), 1);
         this._tabs.splice(this._tabs.indexOf(tab), 1);
-        if (tab.shown)
+        if (tab._shown)
             this._hideTabElement(tab);
 
         var eventData = { tabId: id, view: tab.view, isUserGesture: userGesture };
@@ -160,6 +160,20 @@ WebInspector.TabbedPane.prototype = {
 
     /**
      * @param {string} id
+     */
+    closeOtherTabs: function(id)
+    {
+        var tabs = this._tabs.slice();
+        for (var i = 0; i < tabs.length; ++i) {
+            if (tabs[i].id !== id)
+                this._innerCloseTab(tabs[i].id, true);
+        }
+        this._updateTabElements();
+        this.selectTab(id, true);
+    },
+
+    /**
+     * @param {string} id
      * @param {boolean=} userGesture
      */
     selectTab: function(id, userGesture)
@@ -267,7 +281,7 @@ WebInspector.TabbedPane.prototype = {
             this._tabsElement.appendChild(tab.tabElement);
         else
             this._tabsElement.insertBefore(tab.tabElement, this._tabsElement.children[index]);
-        tab.shown = true;
+        tab._shown = true;
     },
 
     /**
@@ -276,7 +290,7 @@ WebInspector.TabbedPane.prototype = {
     _hideTabElement: function(tab)
     {
         this._tabsElement.removeChild(tab.tabElement);
-        tab.shown = false;
+        tab._shown = false;
     },
 
     _createDropDownButton: function()
@@ -295,12 +309,12 @@ WebInspector.TabbedPane.prototype = {
         var tabsToShowIndexes = this._tabsToShowIndexes(this._tabs, this._tabsHistory, this._headerContentsElement.offsetWidth, this._measuredDropDownButtonWidth);
 
         for (var i = 0; i < this._tabs.length; ++i) {
-            if (this._tabs[i].shown && tabsToShowIndexes.indexOf(i) === -1)
+            if (this._tabs[i]._shown && tabsToShowIndexes.indexOf(i) === -1)
                 this._hideTabElement(this._tabs[i]);
         }
         for (var i = 0; i < tabsToShowIndexes.length; ++i) {
             var tab = this._tabs[tabsToShowIndexes[i]];
-            if (!tab.shown)
+            if (!tab._shown)
                 this._showTabElement(i, tab);
         }
         
@@ -315,7 +329,7 @@ WebInspector.TabbedPane.prototype = {
         this._tabsSelect.removeChildren();
         var tabsToShow = [];
         for (var i = 0; i < this._tabs.length; ++i) {
-            if (!this._tabs[i].shown)
+            if (!this._tabs[i]._shown)
                 tabsToShow.push(this._tabs[i]);
                 continue;
         }
@@ -468,6 +482,20 @@ WebInspector.TabbedPane.prototype = {
     elementsToRestoreScrollPositionsFor: function()
     {
         return [ this._contentElement ];
+    },
+
+    /**
+     * @param {WebInspector.TabbedPaneTab} tab
+     * @param {number} index
+     */
+    _insertBefore: function(tab, index)
+    {
+        this._tabsElement.insertBefore(tab._tabElement, this._tabsElement.childNodes[index]);
+        var oldIndex = this._tabs.indexOf(tab);
+        this._tabs.splice(oldIndex, 1);
+        if (oldIndex < index)
+            --index;
+        this._tabs.splice(index, 0, tab);
     }
 }
 
@@ -493,7 +521,7 @@ WebInspector.TabbedPaneTab = function(tabbedPane, measureElement, id, title, clo
     this._title = title;
     this._tooltip = tooltip;
     this._view = view;
-    this.shown = false;
+    this._shown = false;
     /** @type {number} */ this._measuredWidth;
     /** @type {Element} */ this._tabElement;
 }
@@ -614,6 +642,11 @@ WebInspector.TabbedPaneTab.prototype = {
         else {
             this._tabElement = tabElement;
             tabElement.addEventListener("click", this._tabClicked.bind(this), false);
+            tabElement.addEventListener("mousedown", this._tabMouseDown.bind(this), false);
+            if (this._closeable) {
+                tabElement.addEventListener("contextmenu", this._tabContextMenu.bind(this), false);
+                tabElement.addEventListener("mousemove", this._tabMouseMove.bind(this), false);
+            }
         }
         
         return tabElement;
@@ -634,8 +667,104 @@ WebInspector.TabbedPaneTab.prototype = {
     {
         if (this._closeable && (event.button === 1 || event.target.hasStyleClass("tabbed-pane-header-tab-close-button")))
             this._tabbedPane.closeTab(this.id, true);
-        else
-            this._tabbedPane.selectTab(this.id, true);
-        this._tabbedPane.focus();
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _tabMouseDown: function(event)
+    {
+        if (event.target.hasStyleClass("tabbed-pane-header-tab-close-button") || event.button === 1)
+            return;
+        this._tabbedPane.selectTab(this.id, true);
+        this._dragStartX = event.pageX;
+    },
+
+    _tabContextMenu: function(event)
+    {
+        function close()
+        {
+            this._tabbedPane.closeTab(this.id, true);
+        }
+  
+        function closeOthers()
+        {
+            this._tabbedPane.closeOtherTabs(this.id);
+        }
+  
+        function closeAll()
+        {
+            this._tabbedPane.closeAllTabs(true);
+        }
+  
+        var contextMenu = new WebInspector.ContextMenu();
+        contextMenu.appendItem(WebInspector.UIString("Close"), close.bind(this));
+        contextMenu.appendItem(WebInspector.UIString("Close Others"), closeOthers.bind(this));
+        contextMenu.appendItem(WebInspector.UIString("Close All"), closeAll.bind(this));
+        contextMenu.show(event);
+    },
+
+    _tabMouseMove: function(event)
+    {
+        if (isNaN(this._dragStartX))
+            return;
+        if (event.which !== 1)
+            return;
+        this._tabbedPane.selectTab(this.id, true);
+        WebInspector.elementDragStart(this._tabElement, this._tabDragging.bind(this), this._endTabDragging.bind(this), event, "pointer");
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _tabDragging: function(event)
+    {
+        var tabElements = this._tabbedPane._tabsElement.childNodes;
+        for (var i = 0; i < tabElements.length; ++i) {
+            var tabElement = tabElements[i];
+            if (tabElement === this._tabElement)
+                continue;
+
+            var intersects = tabElement.offsetLeft + tabElement.clientWidth > this._tabElement.offsetLeft &&
+                this._tabElement.offsetLeft + this._tabElement.clientWidth > tabElement.offsetLeft;
+            if (!intersects)
+                continue;
+
+            if (Math.abs(event.pageX - this._dragStartX) < tabElement.clientWidth / 2 + 5)
+                break;
+
+            if (event.pageX - this._dragStartX > 0) {
+                tabElement = tabElement.nextSibling;
+                ++i;
+            }
+
+            var oldOffsetLeft = this._tabElement.offsetLeft;
+            this._tabbedPane._insertBefore(this, i);
+            this._dragStartX += this._tabElement.offsetLeft - oldOffsetLeft;
+            break;
+        }
+
+        if (!this._tabElement.previousSibling && event.pageX - this._dragStartX < 0) {
+            this._tabElement.style.setProperty("left", "0px");
+            return;
+        }
+        if (!this._tabElement.nextSibling && event.pageX - this._dragStartX > 0) {
+            this._tabElement.style.setProperty("left", "0px");
+            return;
+        }
+
+        this._tabElement.style.setProperty("position", "relative");
+        this._tabElement.style.setProperty("left", (event.pageX - this._dragStartX) + "px");
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _endTabDragging: function(event)
+    {
+        this._tabElement.style.removeProperty("position");
+        this._tabElement.style.removeProperty("left");
+        delete this._dragStartX;
+        WebInspector.elementDragEnd(event);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/UISourceCode.js b/Source/WebCore/inspector/front-end/UISourceCode.js
index 71af95984..f2c838fee 100644
--- a/Source/WebCore/inspector/front-end/UISourceCode.js
+++ b/Source/WebCore/inspector/front-end/UISourceCode.js
@@ -32,28 +32,35 @@
 /**
  * @constructor
  * @extends {WebInspector.Object}
- * @param {string} id
+ * @implements {WebInspector.ContentProvider}
  * @param {string} url
  * @param {WebInspector.ContentProvider} contentProvider
+ * @param {WebInspector.SourceMapping=} sourceMapping
  */
-WebInspector.UISourceCode = function(id, url, contentProvider)
+WebInspector.UISourceCode = function(url, contentProvider, sourceMapping)
 {
-    this._id = id;
     this._url = url;
     this._parsedURL = new WebInspector.ParsedURL(url);
     this._contentProvider = contentProvider;
+    this._sourceMapping = sourceMapping;
     this.isContentScript = false;
-    this.isEditable = false;
     /**
      * @type Array.<function(?string,boolean,string)>
      */
     this._requestContentCallbacks = [];
     this._liveLocations = [];
+    /**
+     * @type {Array.<WebInspector.PresentationConsoleMessage>}
+     */
+    this._consoleMessages = [];
 }
 
 WebInspector.UISourceCode.Events = {
     ContentChanged: "ContentChanged",
+    WorkingCopyChanged: "WorkingCopyChanged",
+    TitleChanged: "TitleChanged",
     ConsoleMessageAdded: "ConsoleMessageAdded",
+    ConsoleMessageRemoved: "ConsoleMessageRemoved",
     ConsoleMessagesCleared: "ConsoleMessagesCleared"
 }
 
@@ -61,17 +68,19 @@ WebInspector.UISourceCode.prototype = {
     /**
      * @return {string}
      */
-    get id()
+    get url()
     {
-        return this._id;
+        return this._url;
     },
 
     /**
-     * @return {string}
+     * @param {string} url
      */
-    get url()
+    urlChanged: function(url)
     {
-        return this._url;
+        this._url = url;
+        this._parsedURL = new WebInspector.ParsedURL(this._url);
+        this.dispatchEventToListeners(WebInspector.UISourceCode.Events.TitleChanged, null);
     },
 
     /**
@@ -83,6 +92,22 @@ WebInspector.UISourceCode.prototype = {
     },
 
     /**
+     * @return {?string}
+     */
+    contentURL: function()
+    {
+        return this._url;
+    },
+
+    /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function()
+    {
+        return this._contentProvider.contentType();
+    },
+
+    /**
      * @param {function(?string,boolean,string)} callback
      */
     requestContent: function(callback)
@@ -91,10 +116,9 @@ WebInspector.UISourceCode.prototype = {
             callback(this._content, false, this._mimeType);
             return;
         }
-
         this._requestContentCallbacks.push(callback);
         if (this._requestContentCallbacks.length === 1)
-            this._contentProvider.requestContent(this._didRequestContent.bind(this));
+            this._contentProvider.requestContent(this.fireContentAvailable.bind(this));
     },
 
     /**
@@ -105,10 +129,66 @@ WebInspector.UISourceCode.prototype = {
         console.assert(this._contentLoaded);
         var oldContent = this._content;
         this._content = newContent;
+        delete this._workingCopy;
         this.dispatchEventToListeners(WebInspector.UISourceCode.Events.ContentChanged, {oldContent: oldContent, content: newContent});
     },
 
     /**
+     * @return {boolean}
+     */
+    isEditable: function()
+    {
+        return false;
+    },
+
+    /**
+     * @return {string}
+     */
+    workingCopy: function()
+    {
+        console.assert(this._contentLoaded);
+        return this._workingCopy;
+    },
+
+    /**
+     * @param {string} newWorkingCopy
+     */
+    setWorkingCopy: function(newWorkingCopy)
+    {
+        console.assert(this._contentLoaded);
+        var oldWorkingCopy = this._workingCopy;
+        if (this._content === newWorkingCopy)
+            delete this._workingCopy;
+        else
+            this._workingCopy = newWorkingCopy;
+        this.dispatchEventToListeners(WebInspector.UISourceCode.Events.WorkingCopyChanged, {oldWorkingCopy: oldWorkingCopy, workingCopy: newWorkingCopy});
+    },
+
+    /**
+     * @return {boolean}
+     */
+    isDirty: function()
+    {
+        return this._contentLoaded && typeof this._workingCopy !== "undefined" && this._workingCopy !== this._content;
+    },
+
+    /**
+     * @return {string}
+     */
+    mimeType: function()
+    {
+        return this._mimeType;
+    },
+
+    /**
+     * @return {?string}
+     */
+    content: function()
+    {
+        return this._content;
+    },
+
+    /**
      * @param {string} query
      * @param {boolean} caseSensitive
      * @param {boolean} isRegex
@@ -124,19 +204,38 @@ WebInspector.UISourceCode.prototype = {
      * @param {boolean} contentEncoded
      * @param {string} mimeType
      */
-    _didRequestContent: function(content, contentEncoded, mimeType)
+    fireContentAvailable: function(content, contentEncoded, mimeType)
     {
         this._contentLoaded = true;
         this._mimeType = mimeType;
         this._content = content;
 
-        for (var i = 0; i < this._requestContentCallbacks.length; ++i)
-            this._requestContentCallbacks[i](content, contentEncoded, mimeType);
+        var callbacks = this._requestContentCallbacks.slice();
         this._requestContentCallbacks = [];
+        for (var i = 0; i < callbacks.length; ++i)
+            callbacks[i](content, contentEncoded, mimeType);
     },
 
     /**
-     * @param {WebInspector.LiveLocation} liveLocation
+     * @return {boolean}
+     */
+    contentLoaded: function()
+    {
+        return this._contentLoaded;
+    },
+
+    /**
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function(lineNumber, columnNumber)
+    {
+        return this._sourceMapping.uiLocationToRawLocation(this, lineNumber, columnNumber);
+    },
+
+    /**
+     * @param {WebInspector.Script.Location} liveLocation
      */
     addLiveLocation: function(liveLocation)
     {
@@ -144,7 +243,7 @@ WebInspector.UISourceCode.prototype = {
     },
 
     /**
-     * @param {WebInspector.LiveLocation} liveLocation
+     * @param {WebInspector.Script.Location} liveLocation
      */
     removeLiveLocation: function(liveLocation)
     {
@@ -170,7 +269,91 @@ WebInspector.UISourceCode.prototype = {
     /**
      * @return {Array.<WebInspector.PresentationConsoleMessage>}
      */
-    consoleMessages: function() {}
+    consoleMessages: function()
+    {
+        return this._consoleMessages;
+    },
+
+    /**
+     * @param {WebInspector.PresentationConsoleMessage} message
+     */
+    consoleMessageAdded: function(message)
+    {
+        this._consoleMessages.push(message);
+        this.dispatchEventToListeners(WebInspector.UISourceCode.Events.ConsoleMessageAdded, message);
+    },
+
+    /**
+     * @param {WebInspector.PresentationConsoleMessage} message
+     */
+    consoleMessageRemoved: function(message)
+    {
+        this._consoleMessages.remove(message);
+        this.dispatchEventToListeners(WebInspector.UISourceCode.Events.ConsoleMessageRemoved, message);
+    },
+
+    consoleMessagesCleared: function()
+    {
+        this._consoleMessages = [];
+        this.dispatchEventToListeners(WebInspector.UISourceCode.Events.ConsoleMessagesCleared);
+    }
 }
 
 WebInspector.UISourceCode.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @interface
+ */
+WebInspector.UISourceCodeProvider = function()
+{
+}
+
+WebInspector.UISourceCodeProvider.Events = {
+    UISourceCodeAdded: "UISourceCodeAdded",
+    UISourceCodeReplaced: "UISourceCodeReplaced",
+    UISourceCodeRemoved: "UISourceCodeRemoved"
+}
+
+WebInspector.UISourceCodeProvider.prototype = {
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodes: function() {},
+
+    /**
+     * @param {string} eventType
+     * @param {function(WebInspector.Event)} listener
+     * @param {Object=} thisObject
+     */
+    addEventListener: function(eventType, listener, thisObject) { },
+
+    /**
+     * @param {string} eventType
+     * @param {function(WebInspector.Event)} listener
+     * @param {Object=} thisObject
+     */
+    removeEventListener: function(eventType, listener, thisObject) { }
+}
+
+/**
+ * @constructor
+ * @param {WebInspector.UISourceCode} uiSourceCode
+ * @param {number} lineNumber
+ * @param {number} columnNumber
+ */
+WebInspector.UILocation = function(uiSourceCode, lineNumber, columnNumber)
+{
+    this.uiSourceCode = uiSourceCode;
+    this.lineNumber = lineNumber;
+    this.columnNumber = columnNumber;
+}
+
+WebInspector.UILocation.prototype = {
+    /**
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function()
+    {
+        return this.uiSourceCode.uiLocationToRawLocation(this.lineNumber, this.columnNumber);
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index a70ac73e5..ca39e0f9d 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -138,6 +138,7 @@ WebInspector.WatchExpressionsSection = function()
 
     this.element.addEventListener("mousemove", this._mouseMove.bind(this), true);
     this.element.addEventListener("mouseout", this._mouseOut.bind(this), true);
+    this.element.addEventListener("dblclick", this._sectionDoubleClick.bind(this), false);
 }
 
 WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
@@ -236,9 +237,20 @@ WebInspector.WatchExpressionsSection.prototype = {
         this.update();
     },
 
+    _sectionDoubleClick: function(event)
+    {
+        if (event.target !== this.element && event.target !== this.propertiesElement && event.target !== this.emptyElement)
+            return;
+        event.consume();
+        this.addNewExpressionAndEdit();
+    },
+
     updateExpression: function(element, value)
     {
-        this.watchExpressions[element.property.watchIndex] = value;
+        if (value === null)
+            delete this.watchExpressions[element.property.watchIndex];
+        else
+            this.watchExpressions[element.property.watchIndex] = value;
         this.saveExpressions();
         this.update();
     },
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index 8dd9376a0..19f9ca6bd 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -27,6 +27,7 @@
     <file>CookieItemsView.js</file>
     <file>CookieParser.js</file>
     <file>CookiesTable.js</file>
+    <file>CPUProfileView.js</file>
     <file>CSSCompletions.js</file>
     <file>CSSKeywordCompletions.js</file>
     <file>CSSSelectorProfileView.js</file>
@@ -36,7 +37,8 @@
     <file>DatabaseTableView.js</file>
     <file>DataGrid.js</file>
     <file>DebuggerModel.js</file>
-    <file>DebuggerPresentationModel.js</file>
+    <file>DebuggerResourceBinding.js</file>
+    <file>DebuggerScriptMapping.js</file>
     <file>Dialog.js</file>
     <file>DOMAgent.js</file>
     <file>DOMBreakpointsSidebarPane.js</file>
@@ -101,10 +103,10 @@
     <file>PanelEnablerView.js</file>
     <file>Placard.js</file>
     <file>Popover.js</file>
+    <file>PresentationConsoleMessageHelper.js</file>
     <file>ProfileDataGridTree.js</file>
     <file>ProfileLauncherView.js</file>
     <file>ProfilesPanel.js</file>
-    <file>ProfileView.js</file>
     <file>PropertiesSection.js</file>
     <file>PropertiesSidebarPane.js</file>
     <file>RawSourceCode.js</file>
@@ -129,7 +131,7 @@
     <file>Script.js</file>
     <file>ScriptFormatter.js</file>
     <file>ScriptFormatterWorker.js</file>
-    <file>ScriptMapping.js</file>
+    <file>ScriptSnippetModel.js</file>
     <file>ScriptsPanel.js</file>
     <file>ScriptsNavigator.js</file>
     <file>ScriptsSearchScope.js</file>
@@ -142,12 +144,13 @@
     <file>SidebarOverlay.js</file>
     <file>SidebarPane.js</file>
     <file>SidebarTreeElement.js</file>
-    <file>SnippetsModel.js</file>
+    <file>SnippetStorage.js</file>
     <file>SoftContextMenu.js</file>
     <file>SourceCSSTokenizer.js</file>
     <file>SourceFrame.js</file>
     <file>SourceHTMLTokenizer.js</file>
     <file>SourceJavaScriptTokenizer.js</file>
+    <file>SourceMapping.js</file>
     <file>SourceTokenizer.js</file>
     <file>Spectrum.js</file>
     <file>SplitView.js</file>
@@ -250,7 +253,6 @@
     <file>Images/indexedDBIndex.png</file>
     <file>Images/localStorage.png</file>
     <file>Images/navigatorShowHideButton.png</file>
-    <file>Images/navigatorPinButton.png</file>
     <file>Images/paneAddButtons.png</file>
     <file>Images/paneBottomGrow.png</file>
     <file>Images/paneBottomGrowActive.png</file>
diff --git a/Source/WebCore/inspector/front-end/WorkerManager.js b/Source/WebCore/inspector/front-end/WorkerManager.js
index c9f053dc4..37f4678f7 100644
--- a/Source/WebCore/inspector/front-end/WorkerManager.js
+++ b/Source/WebCore/inspector/front-end/WorkerManager.js
@@ -205,13 +205,9 @@ WebInspector.WorkerManager.prototype = {
 
     _disconnectedFromWorker: function()
     {
-        function onHide()
-        {
-            WebInspector.debuggerModel.removeEventListener(WebInspector.DebuggerModel.Events.GlobalObjectCleared, screen.hide, screen);
-        }
         var screen = new WebInspector.WorkerTerminatedScreen();
         WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.GlobalObjectCleared, screen.hide, screen);
-        screen.show(onHide.bind(this));
+        screen.showModal();
     }
 }
 
@@ -272,4 +268,15 @@ WebInspector.WorkerTerminatedScreen = function()
     p.textContent = WebInspector.UIString("Inspected worker has terminated. Once it restarts we will attach to it automatically.");
 }
 
+WebInspector.WorkerTerminatedScreen.prototype = {
+    /**
+     * @override
+     */
+    willHide: function()
+    {
+        WebInspector.debuggerModel.removeEventListener(WebInspector.DebuggerModel.Events.GlobalObjectCleared, this.hide, this);
+        WebInspector.HelpScreen.prototype.willHide.call(this);
+    }
+}
+
 WebInspector.WorkerTerminatedScreen.prototype.__proto__ = WebInspector.HelpScreen.prototype;
diff --git a/Source/WebCore/inspector/front-end/auditsPanel.css b/Source/WebCore/inspector/front-end/auditsPanel.css
index 121baff62..4f6f17e8a 100644
--- a/Source/WebCore/inspector/front-end/auditsPanel.css
+++ b/Source/WebCore/inspector/front-end/auditsPanel.css
@@ -178,6 +178,18 @@
     margin: 0;
 }
 
+.audit-result-tree ol.outline-disclosure {
+    -webkit-padding-start: 0;
+}
+
+.audit-result-tree .section .header {
+    padding-left: 13px;
+}
+
+.audit-result-tree .section .header::before {
+    left: 2px;
+}
+
 .audit-result-tree li {
     padding: 0 0 0 14px;
     margin-top: 1px;
diff --git a/Source/WebCore/inspector/front-end/elementsPanel.css b/Source/WebCore/inspector/front-end/elementsPanel.css
index 8f9224a69..61024cc62 100644
--- a/Source/WebCore/inspector/front-end/elementsPanel.css
+++ b/Source/WebCore/inspector/front-end/elementsPanel.css
@@ -246,13 +246,17 @@
 .styles-section .properties li.not-parsed-ok img.exclamation-mark {
     content: url(Images/warningIcon.png);
     opacity: 0.75;
+    position: relative;
+    float: left;
     width: 12px;
     height: 10px;
     margin: 0 6px 0 0;
-    padding: 0 1px;
+    left: -38px; /* outdent to compensate for the top-level property indent */
+    padding-left: 2px;
     vertical-align: baseline;
     -webkit-user-select: none;
     cursor: default;
+    z-index: 1;
 }
 
 .styles-section .header {
@@ -320,11 +324,41 @@
 
 .styles-section .properties li {
     margin-left: 12px;
-    white-space: nowrap;
+    padding-left: 22px;
+    white-space: normal;
     text-overflow: ellipsis;
     overflow: hidden;
     cursor: auto;
 }
+
+.styles-section.computed-style.expanded .properties > li {
+    padding-left: 0;
+}
+
+.styles-section.computed-style.expanded .properties > li .webkit-css-property {
+    margin-left: 0;
+}
+
+.styles-section .properties li .webkit-css-property {
+    margin-left: -22px; /* outdent the first line of longhand properties (in an expanded shorthand) to compensate for the "padding-left" shift in .styles-section .properties li */
+}
+
+.styles-section.expanded .properties > li {
+    padding-left: 38px;
+}
+
+.styles-section .properties > li .webkit-css-property {
+    margin-left: -38px; /* outdent the first line of the top-level properties to compensate for the "padding-left" shift in .styles-section .properties > li */
+}
+
+.styles-section .properties > li.child-editing {
+    padding-left: 8px;
+}
+
+.styles-section .properties > li.child-editing .webkit-css-property {
+    margin-left: -8px;
+}
+
 .styles-section.matched-styles .properties li {
     margin-left: 0 !important;
 }
@@ -403,7 +437,7 @@
     position: relative;
     z-index: 1;
     width: 18px;
-    left: -2px;
+    left: -40px; /* original -2px + (-38px) to compensate for the first line outdent */
 }
 
 .styles-section.matched-styles .properties ol.expanded {
diff --git a/Source/WebCore/inspector/front-end/helpScreen.css b/Source/WebCore/inspector/front-end/helpScreen.css
index fe1cf50ee..020557242 100644
--- a/Source/WebCore/inspector/front-end/helpScreen.css
+++ b/Source/WebCore/inspector/front-end/helpScreen.css
@@ -1,23 +1,23 @@
 .help-window-outer {
     position: absolute;
-    top: 60px;
+    top: 12px;
     left: 5%;
     width: 90%;
-    bottom: 40px;
+    bottom: 12px;
     z-index: 2000;
 }
 
 body.compact .help-window-outer {
-    top: 32px;
+    top: 0;
     left: 0;
     width: 100%;
-    bottom: 23px;
+    bottom: 0;
 }
 
 .help-window-main {
     max-height: 100%;
     color: white;
-    background-color: rgba(34, 34, 34, 0.85);
+    background-color: rgba(17, 17, 17, 0.85);
     display: -webkit-box;
     -webkit-box-orient: vertical;
     border-top-width: 0;
@@ -26,24 +26,16 @@ body.compact .help-window-outer {
 
 body.compact .help-window-main {
     height: 100%;
-    padding: 10px;
-}
-
-body.compact .help-window-main {
     border-radius: 0;
-    -webkit-box-shadow: 0 0 0;
 }
 
 .help-window-caption {
     border-bottom: solid 1px rgb(153, 153, 153);
-    margin: 0 16px;
+    margin: 0 8px;
+    padding: 0 2px;
     line-height: 36px;
 }
 
-body.compact .help-window-caption {
-    margin: 0;
-}
-
 .help-window-title {
     font-size: 16px;
     margin: 0;
@@ -54,7 +46,8 @@ body.compact .help-window-caption {
     overflow-x: hidden;
     scrollbar-width: 11px;
     -webkit-box-flex: 1;
-    margin: 0px 16px 16px 16px;
+    margin: 8px;
+    padding: 0 4px;
     font-size: 13px;
 }
 
@@ -95,12 +88,8 @@ body.compact .help-window-caption {
     margin: 10px 0;
 }
 
-body.compact .help-close-button {
-    margin: 0;
-}
-
 body.compact .help-content {
-    margin: 8px 0 0 8px;
+    margin-bottom: 8px;
 }
 
 .help-close-button:hover {
@@ -117,31 +106,45 @@ body:not(.platform-mac) .help-close-button {
     float: right;
 }
 
-.help-table {
+.help-container {
     width: 100%;
     -webkit-user-select: auto;
+    -webkit-column-width: 480px;
 }
 
-.help-column-table {
-    border-collapse: collapse;
+.help-block {
+    display: inline-block;
+    width: 480px;
+    padding-bottom: 9px;
 }
 
-.help-table > tr > th {
-    padding-top: 6px;
-    text-align: left;
-    color: rgb(221, 221, 0);
+#settings .help-container {
+    -webkit-column-width: 240px;
+}
+
+#settings .help-block {
+    width: 240px;
 }
 
-.help-table > tr > td {
-    white-space: nowrap;
-    vertical-align: top;
-    width: 50%;
+.help-line {
+    padding-bottom: 3px;
 }
 
 .help-key-cell {
+    display: inline-block;
+    width: 280px;
     text-align: right;
 }
 
+.help-cell {
+    display: inline;
+}
+
+.help-section-title {
+    font-weight: bold;
+    color: rgb(221, 221, 0);
+}
+
 .help-key {
     color: rgb(221, 221, 0);
 }
@@ -165,7 +168,7 @@ body.platform-mac .help-key {
 }
 
 .help-content p {
-    margin: 5px 0 5px 0;
+    margin: 0 0 3px 0;
 }
 
 .help-content fieldset {
@@ -185,13 +188,7 @@ body.platform-mac .help-key {
 }
 
 .help-content p.help-section {
-    margin-bottom: 15px;
-}
-
-.help-section-title {
-    color: rgb(221, 221, 0);
-    text-align: left;
-    padding-top: 8px;
+    margin: 0 0 15px 0;
 }
 
 .settings-experiments-warning-subsection-warning {
@@ -217,7 +214,7 @@ body.platform-mac .help-key {
     background-color: rgb(64, 64, 64);
     color: white;
     border-color: black;
-    padding: 0px 4px;
+    padding: 0 4px;
 }
 
 .help-content select:disabled {
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index 70b9a99dc..7ddd8f3f4 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -993,6 +993,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 
 iframe.extension {
     width: 100%;
+    height: 100%;
 }
 
 iframe.panel.extension {
@@ -1177,20 +1178,15 @@ iframe.panel.extension {
 }
 
 .placard.selected {
-    border-top: 1px solid rgb(145, 160, 192);
-    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(162, 177, 207)), to(rgb(120, 138, 177)));
+    border-top: 1px solid rgb(172, 172, 172);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(182, 182, 182)), to(rgb(162, 162, 162)));
     -webkit-background-origin: padding;
     -webkit-background-clip: padding;
 }
 
 :focus .placard.selected {
-    border-top: 1px solid rgb(68, 128, 200);
-    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(92, 147, 213)), to(rgb(21, 83, 170)));
-}
-
-body.inactive .placard.selected {
-    border-top: 1px solid rgb(151, 151, 151);
-    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(180, 180, 180)), to(rgb(138, 138, 138)));
+    border-top: 1px solid rgb(70, 103, 215);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(92, 147, 213)), to(rgb(56, 121, 217)));
 }
 
 .placard .title {
@@ -1498,7 +1494,8 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
 .swatch-inner {
     width: 100%;
     height: 100%;
-    display: block;
+    display: inline-block;
+    margin-bottom: 1px;
 }
 
 .swatch:hover {
@@ -2151,7 +2148,7 @@ ol.breakpoint-list {
 }
 
 .breakpoint-list li:hover {
-    color: rgb(15%, 15%, 15%);
+    background-color: rgba(56, 121, 217, 0.2);
 }
 
 .breakpoint-list .checkbox-elem {
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index 61259a3df..5251b9e8d 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -33,7 +33,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <link rel="stylesheet" type="text/css" href="inspector.css">
     <link rel="stylesheet" type="text/css" href="inspectorCommon.css">
     <link rel="stylesheet" type="text/css" href="inspectorSyntaxHighlight.css">
-    <link rel="stylesheet" type="text/css" href="helpScreen.css">
     <link rel="stylesheet" type="text/css" href="popover.css">
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="DOMExtension.js"></script>
@@ -46,6 +45,8 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="InspectorFrontendAPI.js"></script>
     <script type="text/javascript" src="Object.js"></script>
     <script type="text/javascript" src="Settings.js"></script>
+    <script type="text/javascript" src="View.js"></script>
+    <script type="text/javascript" src="HelpScreen.js"></script>
     <script type="text/javascript" src="InspectorFrontendHostStub.js"></script>
     <script type="text/javascript" src="FileManager.js"></script>
     <script type="text/javascript" src="Checkbox.js"></script>
@@ -55,7 +56,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="TextPrompt.js"></script>
     <script type="text/javascript" src="Popover.js"></script>
     <script type="text/javascript" src="Placard.js"></script>
-    <script type="text/javascript" src="View.js"></script>
     <script type="text/javascript" src="TabbedPane.js"></script>
     <script type="text/javascript" src="Drawer.js"></script>
     <script type="text/javascript" src="ConsoleModel.js"></script>
@@ -167,7 +167,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ProfileDataGridTree.js"></script>
     <script type="text/javascript" src="BottomUpProfileDataGridTree.js"></script>
     <script type="text/javascript" src="TopDownProfileDataGridTree.js"></script>
-    <script type="text/javascript" src="ProfileView.js"></script>
+    <script type="text/javascript" src="CPUProfileView.js"></script>
     <script type="text/javascript" src="CSSSelectorProfileView.js"></script>
     <script type="text/javascript" src="HeapSnapshot.js"></script>
     <script type="text/javascript" src="HeapSnapshotProxy.js"></script>
@@ -177,11 +177,13 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="HeapSnapshotDataGrids.js"></script>
     <script type="text/javascript" src="HeapSnapshotView.js"></script>
     <script type="text/javascript" src="DebuggerModel.js"></script>
-    <script type="text/javascript" src="ScriptMapping.js"></script>
+    <script type="text/javascript" src="SourceMapping.js"></script>
     <script type="text/javascript" src="UISourceCode.js"></script>
     <script type="text/javascript" src="JavaScriptSource.js"></script>
     <script type="text/javascript" src="Linkifier.js"></script>
-    <script type="text/javascript" src="DebuggerPresentationModel.js"></script>
+    <script type="text/javascript" src="DebuggerScriptMapping.js"></script>
+    <script type="text/javascript" src="DebuggerResourceBinding.js"></script>
+    <script type="text/javascript" src="PresentationConsoleMessageHelper.js"></script>
     <script type="text/javascript" src="BreakpointManager.js"></script>
     <script type="text/javascript" src="ContentProviders.js"></script>
     <script type="text/javascript" src="RawSourceCode.js"></script>
@@ -194,7 +196,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="TimelineOverviewPane.js"></script>
     <script type="text/javascript" src="TimelineFrameController.js"></script>
     <script type="text/javascript" src="TestController.js"></script>
-    <script type="text/javascript" src="HelpScreen.js"></script>
     <script type="text/javascript" src="Dialog.js"></script>
     <script type="text/javascript" src="GoToLineDialog.js"></script>
     <script type="text/javascript" src="FilteredItemSelectionDialog.js"></script>
@@ -210,7 +211,8 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="JavaScriptContextManager.js"></script>
     <script type="text/javascript" src="HandlerRegistry.js"></script>
     <script type="text/javascript" src="MemoryStatistics.js"></script>
-    <script type="text/javascript" src="SnippetsModel.js"></script>
+    <script type="text/javascript" src="SnippetStorage.js"></script>
+    <script type="text/javascript" src="ScriptSnippetModel.js"></script>
     <script type="text/javascript" src="StylesPanel.js"></script>
 </head>
 <body class="detached" id="-webkit-web-inspector">
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index 5b1c0c415..439ccb307 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -38,7 +38,7 @@ var WebInspector = {
         WebInspector.inspectorView.addEventListener(WebInspector.InspectorView.Events.PanelSelected, this._panelSelected, this);
 
         if (WebInspector.WorkerManager.isWorkerFrontend()) {
-            this.panels.scripts = new WebInspector.ScriptsPanel(this.debuggerPresentationModel);
+            this.panels.scripts = new WebInspector.ScriptsPanel();
             this.panels.timeline = new WebInspector.TimelinePanel();
             this.panels.profiles = new WebInspector.ProfilesPanel();
             this.panels.console = new WebInspector.ConsolePanel();
@@ -52,9 +52,7 @@ var WebInspector = {
         if (hiddenPanels.indexOf("network") === -1)
             this.panels.network = new WebInspector.NetworkPanel();
         if (hiddenPanels.indexOf("scripts") === -1)
-            this.panels.scripts = new WebInspector.ScriptsPanel(this.debuggerPresentationModel);
-        if (hiddenPanels.indexOf("styles") === -1 && WebInspector.experimentsSettings.showStylesPanel.isEnabled())
-            this.panels.styles = new WebInspector.StylesPanel();
+            this.panels.scripts = new WebInspector.ScriptsPanel();
         if (hiddenPanels.indexOf("timeline") === -1)
             this.panels.timeline = new WebInspector.TimelinePanel();
         if (hiddenPanels.indexOf("profiles") === -1)
@@ -77,9 +75,6 @@ var WebInspector = {
         this._dockToggleButton.toggled = !this.attached;
         WebInspector.updateDockToggleButton();
 
-        this._settingsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Settings"), "settings-status-bar-item");
-        this._settingsButton.addEventListener("click", this._toggleSettings.bind(this), false);
-
         var anchoredStatusBar = document.getElementById("anchored-status-bar-items");
         anchoredStatusBar.appendChild(this._dockToggleButton.element);
 
@@ -89,7 +84,7 @@ var WebInspector = {
 
         if (this.panels.elements)
             anchoredStatusBar.appendChild(this.panels.elements.nodeSearchButton.element);
-        anchoredStatusBar.appendChild(this._settingsButton.element);
+        anchoredStatusBar.appendChild(this.settingsController.statusBarItem);
     },
 
     _dockButtonTitle: function()
@@ -146,35 +141,6 @@ var WebInspector = {
         this.drawer.show(view, WebInspector.Drawer.AnimationType.Immediately);
     },
 
-    _toggleSettings: function()
-    {
-        this._settingsButton.toggled = !this._settingsButton.toggled;
-        if (this._settingsButton.toggled)
-            this._showSettingsScreen();
-        else
-            this._hideSettingsScreen();
-    },
-
-    _showSettingsScreen: function()
-    {
-        function onhide()
-        {
-            this._settingsButton.toggled = false;
-            delete this._settingsScreen;
-        }
-
-        if (!this._settingsScreen) {
-            this._settingsScreen = new WebInspector.SettingsScreen();
-            this._settingsScreen.show(onhide.bind(this));
-        }
-    },
-
-    _hideSettingsScreen: function()
-    {
-        if (this._settingsScreen)
-            this._settingsScreen.hide();
-    },
-
     get attached()
     {
         return this._attached;
@@ -412,8 +378,8 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     this.console.addEventListener(WebInspector.ConsoleModel.Events.RepeatCountUpdated, this._updateErrorAndWarningCounts, this);
 
     this.debuggerModel = new WebInspector.DebuggerModel();
-    this.snippetsModel = new WebInspector.SnippetsModel();
-    this.debuggerPresentationModel = new WebInspector.DebuggerPresentationModel();
+    this.scriptSnippetModel = new WebInspector.ScriptSnippetModel();
+    this.breakpointManager = new WebInspector.BreakpointManager(WebInspector.settings.breakpoints, this.debuggerModel);
 
     this.drawer = new WebInspector.Drawer();
     this.consoleView = new WebInspector.ConsoleView(WebInspector.WorkerManager.isWorkerFrontend());
@@ -422,7 +388,7 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     this.resourceTreeModel = new WebInspector.ResourceTreeModel(this.networkManager);
     this.networkLog = new WebInspector.NetworkLog();
     this.domAgent = new WebInspector.DOMAgent();
-    new WebInspector.JavaScriptContextManager(this.resourceTreeModel, this.consoleView);
+    this.javaScriptContextManager = new WebInspector.JavaScriptContextManager(this.resourceTreeModel, this.consoleView);
 
     InspectorBackend.registerInspectorDispatcher(this);
 
@@ -434,6 +400,7 @@ WebInspector._doLoadedDoneWithCapabilities = function()
 
     this.searchController = new WebInspector.SearchController();
     this.advancedSearchController = new WebInspector.AdvancedSearchController();
+    this.settingsController = new WebInspector.SettingsController();
 
     if (Capabilities.nativeInstrumentationEnabled)
         this.domBreakpointsSidebarPane = new WebInspector.DOMBreakpointsSidebarPane();
@@ -686,7 +653,7 @@ WebInspector._registerShortcuts = function()
     section.addKey(shortcut.shortcutToString("f", shortcut.Modifiers.CtrlOrMeta), WebInspector.UIString("Search"));
     
     var advancedSearchShortcut = WebInspector.AdvancedSearchController.createShortcut();
-    section.addKey(advancedSearchShortcut.name, WebInspector.UIString("Search across all scripts"));
+    section.addKey(advancedSearchShortcut.name, WebInspector.UIString("Search across all sources"));
     
     if (WebInspector.isMac()) {
         keys = [
@@ -706,7 +673,7 @@ WebInspector.documentKeyDown = function(event)
 
     if (event.keyIdentifier === "F1" ||
         (event.keyIdentifier === helpKey && event.shiftKey && (!WebInspector.isBeingEdited(event.target) || event.metaKey))) {
-        WebInspector.shortcutsScreen.show();
+        WebInspector.shortcutsScreen.showModal();
         event.consume(true);
         return;
     }
@@ -802,6 +769,11 @@ WebInspector.documentCopy = function(event)
 {
     if (WebInspector.inspectorView.currentPanel() && WebInspector.inspectorView.currentPanel().handleCopyEvent)
         WebInspector.inspectorView.currentPanel().handleCopyEvent(event);
+    WebInspector.documentCopyEventFired(event);
+}
+
+WebInspector.documentCopyEventFired = function(event)
+{
 }
 
 WebInspector.contextMenuEventFired = function(event)
diff --git a/Source/WebCore/inspector/front-end/navigatorView.css b/Source/WebCore/inspector/front-end/navigatorView.css
index b7c261947..fbc0fae51 100644
--- a/Source/WebCore/inspector/front-end/navigatorView.css
+++ b/Source/WebCore/inspector/front-end/navigatorView.css
@@ -40,6 +40,14 @@
     content: url(Images/resourceJSIcon.png);
 }
 
+.navigator-stylesheet-tree-item .icon {
+    content: url(Images/resourceCSSIcon.png);
+}
+
+.navigator-document-tree-item .icon {
+    content: url(Images/resourceDocumentIcon.png);
+}
+
 .navigator li {
     height: 17px;
     white-space: nowrap;
@@ -129,6 +137,6 @@
 }
 
 .navigator-tabbed-pane .tabbed-pane-header-contents {
-    margin-left: 20px;
+    margin-left: 2px;
     margin-right: 28px;
 }
diff --git a/Source/WebCore/inspector/front-end/profilesPanel.css b/Source/WebCore/inspector/front-end/profilesPanel.css
index 10f6b49fe..a7f2bacfb 100644
--- a/Source/WebCore/inspector/front-end/profilesPanel.css
+++ b/Source/WebCore/inspector/front-end/profilesPanel.css
@@ -186,3 +186,12 @@
 body.inactive .profile-launcher-view-content button.running:not(.status-bar-item) {
     color: rgb(220, 130, 130);
 }
+
+.highlighted-row {
+    -webkit-animation: "row_highlight" 2s 0s;
+}
+
+@-webkit-keyframes row_highlight {
+    from {background-color: rgb(255, 255, 120); }
+    to { background-color: white; }
+}
diff --git a/Source/WebCore/inspector/front-end/scriptsPanel.css b/Source/WebCore/inspector/front-end/scriptsPanel.css
index 187267290..3d7fb058a 100644
--- a/Source/WebCore/inspector/front-end/scriptsPanel.css
+++ b/Source/WebCore/inspector/front-end/scriptsPanel.css
@@ -53,6 +53,10 @@
     height: 24px;
 }
 
+#scripts-debug-toolbar img {
+    padding-top: 2px;
+}
+
 #scripts-debug-sidebar-contents {
     position: absolute;
     top: 22px;
@@ -146,48 +150,34 @@
     background-position: center;
 }
 
-.scripts-navigator-control-button {
-    position: absolute;
-    padding: 0;
-    margin: 0;
-    border: 0 transparent none;
-    background-color: transparent;
-}
-
-#scripts-navigator-show-hide-button {
-    top: 3px;
-    height: 16px;
-    left: 2px;
-    width: 16px;
-}
-
-#scripts-navigator-show-hide-button .glyph {
+.status-bar-item.scripts-navigator-show-hide-button > .glyph {
+    background-color: rgba(0, 0, 0, 0.5);
+    -webkit-mask-position: 0 0;
     -webkit-mask-image: url(Images/navigatorShowHideButton.png);
 }
 
-#scripts-navigator-show-hide-button:active .glyph {
-    top: 1px;
-    bottom: -1px;
+.status-bar-item.scripts-navigator-show-hide-button.toggled-pinned > .glyph {
+    -webkit-mask-position: -16px 0;
 }
 
-#scripts-navigator-show-hide-button.toggled-on .glyph {
-    background-color: #4281EB;
-}
-
-#scripts-navigator-pin-button {
-    top: 6px;
-    height: 10px;
-    right: 16px;
-    width: 10px;
+.status-bar-item.scripts-navigator-show-hide-button.toggled-overlay > .glyph {
+    -webkit-mask-position: -32px 0;
 }
 
-#scripts-navigator-pin-button .glyph {
-    -webkit-mask-image: url(Images/navigatorPinButton.png);
+button.status-bar-item.scripts-navigator-show-hide-button {
+    position: absolute;
+    top: 0;
+    left: 0;
+    background-image: none;
+    height: 16px;
+    width: 16px;
+    margin: 3px 2px 2px 2px;
 }
 
-#scripts-navigator-pin-button:active .glyph {
-    top: 1px;
-    bottom: -1px;
+button.status-bar-item.scripts-navigator-show-hide-button.toggled-overlay
+{
+    left: auto;
+    right: 15px;
 }
 
 .scripts-views-container {
@@ -231,12 +221,8 @@
 }
 
 #scripts-editor-container-tabbed-pane .tabbed-pane-header-contents {
-    margin-left: 1px;
-    margin-right: 16px;
-}
-
-#scripts-editor-container-tabbed-pane.navigator-hidden .tabbed-pane-header-contents {
     margin-left: 20px;
+    margin-right: 36px;
 }
 
 #scripts-editor-container-tabbed-pane .tabbed-pane-header-tab {
@@ -257,3 +243,27 @@
 .function-popover-title .function-name {
     font-weight: bold;
 }
+
+button.status-bar-item.scripts-debugger-show-hide-button {
+    position: absolute;
+    top: 0;
+    right: 16px;
+    background-image: none;
+    height: 16px;
+    width: 16px;
+    margin: 3px 2px 2px 2px;
+}
+
+.status-bar-item.scripts-debugger-show-hide-button > .glyph {
+    background-color: rgba(0, 0, 0, 0.5);
+    -webkit-mask-position: 0 0;
+    -webkit-mask-image: url(Images/navigatorShowHideButton.png);
+}
+
+.status-bar-item.scripts-debugger-show-hide-button.toggled-shown > .glyph {
+    -webkit-mask-position: 0 -16px;
+}
+
+.status-bar-item.scripts-debugger-show-hide-button.toggled-hidden > .glyph {
+    -webkit-mask-position: -16px -16px;
+}
diff --git a/Source/WebCore/inspector/front-end/utilities.js b/Source/WebCore/inspector/front-end/utilities.js
index 016d05613..e520ebdaf 100644
--- a/Source/WebCore/inspector/front-end/utilities.js
+++ b/Source/WebCore/inspector/front-end/utilities.js
@@ -218,6 +218,10 @@ Object.defineProperty(Array.prototype, "upperBound",
     }
 });
 
+Object.defineProperty(Uint32Array.prototype, "sort", {
+   value: Array.prototype.sort
+});
+
 (function() {
 var partition = {
     /**
diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index 3ebcdb309..ba79b90cd 100644
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -837,17 +837,7 @@ void DocumentLoader::startLoadingMainResource()
     // FIXME: Is there any way the extra fields could have not been added by now?
     // If not, it would be great to remove this line of code.
     frameLoader()->addExtraFieldsToMainResourceRequest(m_request);
-    
-    // Protect MainResourceLoader::load() method chain from clearMainResourceLoader() stomping m_mainResourceLoader.
-    RefPtr<MainResourceLoader> protectedMainResourceLoader(m_mainResourceLoader);
-    if (!protectedMainResourceLoader->load(m_request, m_substituteData)) {
-        // FIXME: If this should really be caught, we should just ASSERT this doesn't happen;
-        // should it be caught by other parts of WebKit or other parts of the app?
-        LOG_ERROR("could not create WebResourceHandle for URL %s -- should be caught by policy handler level", m_request.url().string().ascii().data());
-        m_mainResourceLoader = 0;
-        ASSERT(!isLoading());
-        checkLoadComplete();
-    }
+    m_mainResourceLoader->load(m_request, m_substituteData);
 }
 
 void DocumentLoader::cancelMainResourceLoad(const ResourceError& error)
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index 1f6c43bd9..a308b36c0 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -416,6 +416,7 @@ public:
 
 class EmptyTextCheckerClient : public TextCheckerClient {
 public:
+    virtual bool shouldEraseMarkersAfterChangeSelection(TextCheckingType) const { return true; }
     virtual void ignoreWordInSpellDocument(const String&) { }
     virtual void learnWord(const String&) { }
     virtual void checkSpellingOfString(const UChar*, int, int*, int*) { }
@@ -436,6 +437,7 @@ public:
     EmptyEditorClient() { }
     virtual ~EmptyEditorClient() { }
     virtual void pageDestroyed() { }
+    virtual void frameWillDetachPage(Frame*) { }
 
     virtual bool shouldDeleteRange(Range*) { return false; }
     virtual bool shouldShowDeleteInterface(HTMLElement*) { return false; }
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 68302915f..548aa2c11 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -1632,7 +1632,7 @@ void FrameLoader::commitProvisionalLoad()
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
     // We are doing this here because we know for sure that a new page is about to be loaded.
     HistoryItem* item = history()->currentItem();
-    if (!m_frame->tree()->parent() && PageCache::canCache(m_frame->page()) && !item->isInPageCache())
+    if (!m_frame->tree()->parent() && pageCache()->canCache(m_frame->page()) && !item->isInPageCache())
         pageCache()->add(item, m_frame->page());
 
     if (m_loadType != FrameLoadTypeReplace)
diff --git a/Source/WebCore/loader/ImageLoader.cpp b/Source/WebCore/loader/ImageLoader.cpp
index c71d31a3c..f4a9ff535 100644
--- a/Source/WebCore/loader/ImageLoader.cpp
+++ b/Source/WebCore/loader/ImageLoader.cpp
@@ -194,15 +194,18 @@ void ImageLoader::updateFromElement()
             errorEventSender().cancelEvent(this);
 
         m_image = newImage;
-        m_hasPendingBeforeLoadEvent = newImage;
+        m_hasPendingBeforeLoadEvent = !m_element->document()->isImageDocument() && newImage;
         m_hasPendingLoadEvent = newImage;
         m_imageComplete = !newImage;
 
         if (newImage) {
-            if (!m_element->document()->hasListenerType(Document::BEFORELOAD_LISTENER))
-                dispatchPendingBeforeLoadEvent();
-            else
-                beforeLoadEventSender().dispatchEventSoon(this);
+            if (!m_element->document()->isImageDocument()) {
+                if (!m_element->document()->hasListenerType(Document::BEFORELOAD_LISTENER))
+                    dispatchPendingBeforeLoadEvent();
+                else
+                    beforeLoadEventSender().dispatchEventSoon(this);
+            } else
+                updateRenderer();
 
             // If newImage is cached, addClient() will result in the load event
             // being queued to fire. Ensure this happens after beforeload is
diff --git a/Source/WebCore/loader/LinkLoader.cpp b/Source/WebCore/loader/LinkLoader.cpp
index e562d1050..af25a8680 100644
--- a/Source/WebCore/loader/LinkLoader.cpp
+++ b/Source/WebCore/loader/LinkLoader.cpp
@@ -44,6 +44,11 @@
 #include "Settings.h"
 #include "StyleResolver.h"
 
+#if ENABLE(LINK_PRERENDER)
+#include "PrerenderHandle.h"
+#include "Prerenderer.h"
+#endif
+
 namespace WebCore {
 
 LinkLoader::LinkLoader(LinkLoaderClient* client)
@@ -103,7 +108,7 @@ bool LinkLoader::loadLink(const LinkRelAttribute& relAttribute, const String& ty
     }
 
 #if ENABLE(LINK_PREFETCH)
-    if ((relAttribute.m_isLinkPrefetch || relAttribute.m_isLinkPrerender || relAttribute.m_isLinkSubresource) && href.isValid() && document->frame()) {
+    if ((relAttribute.m_isLinkPrefetch || relAttribute.m_isLinkSubresource) && href.isValid() && document->frame()) {
         if (!m_client->shouldLoadLink())
             return false;
         ResourceLoadPriority priority = ResourceLoadPriorityUnresolved;
@@ -113,9 +118,7 @@ bool LinkLoader::loadLink(const LinkRelAttribute& relAttribute, const String& ty
         if (relAttribute.m_isLinkSubresource) {
             priority = ResourceLoadPriorityLow;
             type = CachedResource::LinkSubresource;
-        } else if (relAttribute.m_isLinkPrerender)
-            type = CachedResource::LinkPrerender;
-
+        }
         ResourceRequest linkRequest(document->completeURL(href));
         
         if (m_cachedLinkResource) {
@@ -127,8 +130,26 @@ bool LinkLoader::loadLink(const LinkRelAttribute& relAttribute, const String& ty
             m_cachedLinkResource->addClient(this);
     }
 #endif
+
+#if ENABLE(LINK_PRERENDER)
+    if (relAttribute.m_isLinkPrerender) {
+        ASSERT(!m_prerenderHandle);
+        m_prerenderHandle = document->prerenderer()->render(href);
+    }
+#endif
     return true;
 }
 
+void LinkLoader::released()
+{
+    // Only prerenders need treatment here; other links either use the CachedResource interface, or are notionally
+    // atomic (dns prefetch).
+#if ENABLE(LINK_PRERENDER)
+    if (m_prerenderHandle) {
+        m_prerenderHandle->cancel();
+        m_prerenderHandle.clear();
+    }
+#endif
+}
 
 }
diff --git a/Source/WebCore/loader/LinkLoader.h b/Source/WebCore/loader/LinkLoader.h
index 1fbc18d7c..58b29a774 100644
--- a/Source/WebCore/loader/LinkLoader.h
+++ b/Source/WebCore/loader/LinkLoader.h
@@ -37,9 +37,14 @@
 #include "LinkLoaderClient.h"
 #include "Timer.h"
 
+#include <wtf/RefPtr.h>
+
 namespace WebCore {
 
 struct LinkRelAttribute;
+#if ENABLE(LINK_PRERENDER)
+class PrerenderHandle;
+#endif
 
 // The LinkLoader can load link rel types icon, dns-prefetch, subresource, prefetch and prerender.
 class LinkLoader : public CachedResourceClient {
@@ -50,6 +55,7 @@ public:
     // from CachedResourceClient
     virtual void notifyFinished(CachedResource*);
     
+    void released();
     bool loadLink(const LinkRelAttribute&, const String& type, const String& sizes, const KURL&, Document*);
 
 private:
@@ -61,6 +67,10 @@ private:
     CachedResourceHandle<CachedResource> m_cachedLinkResource;
     Timer<LinkLoader> m_linkLoadTimer;
     Timer<LinkLoader> m_linkLoadingErrorTimer;
+
+#if ENABLE(LINK_PRERENDER)
+    RefPtr<PrerenderHandle> m_prerenderHandle;
+#endif
 };
     
 }
diff --git a/Source/WebCore/loader/MainResourceLoader.cpp b/Source/WebCore/loader/MainResourceLoader.cpp
index 715a4ba89..dc93460b3 100644
--- a/Source/WebCore/loader/MainResourceLoader.cpp
+++ b/Source/WebCore/loader/MainResourceLoader.cpp
@@ -651,10 +651,14 @@ bool MainResourceLoader::loadNow(ResourceRequest& r)
     return false;
 }
 
-bool MainResourceLoader::load(const ResourceRequest& r, const SubstituteData& substituteData)
+void MainResourceLoader::load(const ResourceRequest& r, const SubstituteData& substituteData)
 {
     ASSERT(!m_handle);
 
+    // It appears that it is possible for this load to be cancelled and derefenced by the DocumentLoader
+    // in willSendRequest() if loadNow() is called.
+    RefPtr<MainResourceLoader> protect(this);
+
     m_substituteData = substituteData;
 
     ASSERT(documentLoader()->timing()->navigationStart());
@@ -679,8 +683,6 @@ bool MainResourceLoader::load(const ResourceRequest& r, const SubstituteData& su
     }
     if (defer)
         m_initialRequest = request;
-
-    return true;
 }
 
 void MainResourceLoader::setDefersLoading(bool defers)
diff --git a/Source/WebCore/loader/MainResourceLoader.h b/Source/WebCore/loader/MainResourceLoader.h
index 2547f3b98..e3413cab9 100644
--- a/Source/WebCore/loader/MainResourceLoader.h
+++ b/Source/WebCore/loader/MainResourceLoader.h
@@ -54,7 +54,7 @@ namespace WebCore {
         static PassRefPtr<MainResourceLoader> create(Frame*);
         virtual ~MainResourceLoader();
 
-        virtual bool load(const ResourceRequest&, const SubstituteData&);
+        void load(const ResourceRequest&, const SubstituteData&);
         virtual void addData(const char*, int, bool allAtOnce);
 
         virtual void setDefersLoading(bool);
diff --git a/Source/WebCore/loader/Prerenderer.cpp b/Source/WebCore/loader/Prerenderer.cpp
new file mode 100644
index 000000000..75fd8dd8b
--- /dev/null
+++ b/Source/WebCore/loader/Prerenderer.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "Prerenderer.h"
+
+#if ENABLE(LINK_PRERENDER)
+
+#include "Document.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "PrerenderHandle.h"
+#include "PrerendererClient.h"
+#include "ReferrerPolicy.h"
+#include "SecurityPolicy.h"
+
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+// static
+PassOwnPtr<Prerenderer> Prerenderer::create(Document* document)
+{
+    Prerenderer* prerenderer = new Prerenderer(document);
+    prerenderer->suspendIfNeeded();
+    return adoptPtr(prerenderer);
+}
+
+Prerenderer::Prerenderer(Document* document)
+    : ActiveDOMObject(document, this)
+    , m_client(0)
+{
+}
+
+Prerenderer::~Prerenderer()
+{
+}
+
+PassRefPtr<PrerenderHandle> Prerenderer::render(const KURL& url)
+{
+    // Prerenders are unlike requests in most ways (for instance, they pass down fragments, and they don't return data),
+    // but they do have referrers.
+    const ReferrerPolicy referrerPolicy = document()->referrerPolicy();
+    const String referrer = SecurityPolicy::generateReferrerHeader(referrerPolicy, url, document()->frame()->loader()->outgoingReferrer());
+
+    RefPtr<PrerenderHandle> prerenderHandle = PrerenderHandle::create(url, referrer, referrerPolicy);
+
+    client()->willAddPrerender(prerenderHandle.get());
+    prerenderHandle->add();
+
+    m_activeHandles.append(prerenderHandle);
+    return prerenderHandle;
+}
+
+void Prerenderer::stop()
+{
+    while (!m_activeHandles.isEmpty()) {
+        RefPtr<PrerenderHandle> handle = m_activeHandles[0].release();
+        m_activeHandles.remove(0);
+        handle->abandon();
+    }
+    while (!m_suspendedHandles.isEmpty()) {
+        RefPtr<PrerenderHandle> handle = m_suspendedHandles[0].release();
+        m_suspendedHandles.remove(0);
+        handle->abandon();
+    }
+}
+
+void Prerenderer::suspend(ReasonForSuspension reason)
+{
+    if (reason == DocumentWillBecomeInactive || reason == PageWillBeSuspended) {
+        while (!m_activeHandles.isEmpty()) {
+            RefPtr<PrerenderHandle> handle = m_activeHandles[0].release();
+            m_activeHandles.remove(0);
+            handle->suspend();
+            m_suspendedHandles.append(handle);
+        }
+    }
+}
+
+void Prerenderer::resume()
+{
+    while (!m_suspendedHandles.isEmpty()) {
+        RefPtr<PrerenderHandle> handle = m_suspendedHandles[0].release();
+        m_suspendedHandles.remove(0);
+        handle->resume();
+        m_activeHandles.append(handle);
+    }
+}
+
+Document* Prerenderer::document()
+{
+    ASSERT(scriptExecutionContext()->isDocument());
+    return static_cast<Document*>(scriptExecutionContext());
+}
+
+PrerendererClient* Prerenderer::client()
+{
+    if (!m_client)
+        m_client = PrerendererClient::from(document()->page());
+    return m_client;
+}
+
+}
+
+#endif // ENABLE(LINK_PRERENDER)
diff --git a/Source/WebCore/loader/Prerenderer.h b/Source/WebCore/loader/Prerenderer.h
new file mode 100644
index 000000000..32f350834
--- /dev/null
+++ b/Source/WebCore/loader/Prerenderer.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef Prerenderer_h
+#define Prerenderer_h
+
+#if ENABLE(LINK_PRERENDER)
+
+#include "ActiveDOMObject.h"
+#include "KURL.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/SinglyLinkedList.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Document;
+class PrerenderHandle;
+class PrerendererClient;
+class Page;
+
+class Prerenderer : public ActiveDOMObject {
+    WTF_MAKE_NONCOPYABLE(Prerenderer);
+public:
+    virtual ~Prerenderer();
+
+    PassRefPtr<PrerenderHandle> render(const KURL&);
+
+    static PassOwnPtr<Prerenderer> create(Document*);
+
+private:
+    typedef Vector<RefPtr<PrerenderHandle> > HandleVector;
+    typedef Vector<KURL> KURLVector;
+
+    explicit Prerenderer(Document*);
+
+    virtual bool canSuspend() const OVERRIDE { return true; }
+    virtual void stop() OVERRIDE;
+    virtual void suspend(ReasonForSuspension) OVERRIDE;
+    virtual void resume() OVERRIDE;
+
+    Document* document();
+    PrerendererClient* client();
+
+    PrerendererClient* m_client;
+    HandleVector m_activeHandles;
+    HandleVector m_suspendedHandles;
+};
+
+}
+
+#endif // ENABLE(LINK_PRERENDER)
+
+#endif // Prerenderer_h
diff --git a/Source/WebCore/loader/PrerendererClient.cpp b/Source/WebCore/loader/PrerendererClient.cpp
new file mode 100644
index 000000000..78f2470e2
--- /dev/null
+++ b/Source/WebCore/loader/PrerendererClient.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "PrerendererClient.h"
+
+#include "Page.h"
+#include "Supplementable.h"
+#include <wtf/text/AtomicString.h>
+
+#if ENABLE(LINK_PRERENDER)
+
+namespace WebCore {
+
+// static
+const AtomicString& PrerendererClient::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("PrerendererClient"));
+    return name;
+}
+
+// static
+PrerendererClient* PrerendererClient::from(Page* page)
+{
+    PrerendererClient* supplement = static_cast<PrerendererClient*>(Supplement<Page>::from(page, supplementName()));
+    ASSERT(supplement);
+    return supplement;
+}
+
+void providePrerendererClientTo(Page* page, PrerendererClient* client)
+{
+    PrerendererClient::provideTo(page, PrerendererClient::supplementName(), adoptPtr(client));
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/loader/PrerendererClient.h b/Source/WebCore/loader/PrerendererClient.h
new file mode 100644
index 000000000..5a4ce946f
--- /dev/null
+++ b/Source/WebCore/loader/PrerendererClient.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef PrerendererClient_h
+#define PrerendererClient_h
+
+#if ENABLE(LINK_PRERENDER)
+
+#include "Supplementable.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class Document;
+class Page;
+class PrerenderHandle;
+
+class PrerendererClient : public Supplement<Page> {
+public:
+    virtual ~PrerendererClient() { }
+
+    virtual void willAddPrerender(PrerenderHandle*) = 0;
+
+    static const AtomicString& supplementName();
+    static PrerendererClient* from(Page*);
+
+protected:
+    PrerendererClient() { }
+};
+
+void providePrerendererClientTo(Page*, PrerendererClient*);
+
+} // namespace WebCore
+
+#endif // ENABLED(LINK_PRERENDER)
+
+#endif // PrerendererClient_h
diff --git a/Source/WebCore/loader/cache/CachedImage.cpp b/Source/WebCore/loader/cache/CachedImage.cpp
index 33a401570..b4f0b2739 100644
--- a/Source/WebCore/loader/cache/CachedImage.cpp
+++ b/Source/WebCore/loader/cache/CachedImage.cpp
@@ -75,6 +75,7 @@ CachedImage::CachedImage(Image* image)
 
 CachedImage::~CachedImage()
 {
+    clearImage();
 }
 
 void CachedImage::decodedDataDeletionTimerFired(Timer<CachedImage>*)
@@ -302,7 +303,7 @@ void CachedImage::clear()
 #if ENABLE(SVG)
     m_svgImageCache.clear();
 #endif
-    m_image = 0;
+    clearImage();
     setEncodedSize(0);
 }
 
@@ -328,6 +329,15 @@ inline void CachedImage::createImage()
     m_image = BitmapImage::create(this);
 }
 
+inline void CachedImage::clearImage()
+{
+    // If our Image has an observer, it's always us so we need to clear the back pointer
+    // before dropping our reference.
+    if (m_image)
+        m_image->setImageObserver(0);
+    m_image.clear();
+}
+
 size_t CachedImage::maximumDecodedImageSize()
 {
     if (!m_loader || m_loader->reachedTerminalState())
diff --git a/Source/WebCore/loader/cache/CachedImage.h b/Source/WebCore/loader/cache/CachedImage.h
index e7184e130..89f019ded 100644
--- a/Source/WebCore/loader/cache/CachedImage.h
+++ b/Source/WebCore/loader/cache/CachedImage.h
@@ -98,6 +98,7 @@ private:
     void clear();
 
     void createImage();
+    void clearImage();
     size_t maximumDecodedImageSize();
     // If not null, changeRect is the changed part of the image.
     void notifyObservers(const IntRect* changeRect = 0);
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 0368a7245..c95abedb4 100755
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -73,8 +73,6 @@ static ResourceLoadPriority defaultPriorityForResourceType(CachedResource::Type
 #if ENABLE(LINK_PREFETCH)
         case CachedResource::LinkPrefetch:
             return ResourceLoadPriorityVeryLow;
-        case CachedResource::LinkPrerender:
-            return ResourceLoadPriorityVeryLow;
         case CachedResource::LinkSubresource:
             return ResourceLoadPriorityVeryLow;
 #endif
@@ -114,8 +112,6 @@ static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource
 #if ENABLE(LINK_PREFETCH)
     case CachedResource::LinkPrefetch:
         return ResourceRequest::TargetIsPrefetch;
-    case CachedResource::LinkPrerender:
-        return ResourceRequest::TargetIsPrerender;
     case CachedResource::LinkSubresource:
         return ResourceRequest::TargetIsSubresource;
 #endif
@@ -220,7 +216,7 @@ void CachedResource::load(CachedResourceLoader* cachedResourceLoader, const Reso
     }
 
 #if ENABLE(LINK_PREFETCH)
-    if (type() == CachedResource::LinkPrefetch || type() == CachedResource::LinkPrerender || type() == CachedResource::LinkSubresource)
+    if (type() == CachedResource::LinkPrefetch || type() == CachedResource::LinkSubresource)
         m_resourceRequest.setHTTPHeaderField("Purpose", "prefetch");
 #endif
     m_resourceRequest.setPriority(loadPriority());
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index c07b231d4..911f850e8 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -74,7 +74,6 @@ public:
 #endif
 #if ENABLE(LINK_PREFETCH)
         , LinkPrefetch
-        , LinkPrerender
         , LinkSubresource
 #endif
 #if ENABLE(VIDEO_TRACK)
@@ -150,7 +149,6 @@ public:
         return false
 #if ENABLE(LINK_PREFETCH)
             || type() == LinkPrefetch
-            || type() == LinkPrerender
             || type() == LinkSubresource
 #endif
             || type() == RawResource;
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index 9e39c1e48..7e0c8fbfa 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -88,8 +88,6 @@ static CachedResource* createResource(CachedResource::Type type, ResourceRequest
 #if ENABLE(LINK_PREFETCH)
     case CachedResource::LinkPrefetch:
         return new CachedResource(request, CachedResource::LinkPrefetch);
-    case CachedResource::LinkPrerender:
-        return new CachedResource(request, CachedResource::LinkPrerender);
     case CachedResource::LinkSubresource:
         return new CachedResource(request, CachedResource::LinkSubresource);
 #endif
@@ -236,7 +234,7 @@ CachedResourceHandle<CachedSVGDocument> CachedResourceLoader::requestSVGDocument
 CachedResourceHandle<CachedResource> CachedResourceLoader::requestLinkResource(CachedResource::Type type, ResourceRequest& request, ResourceLoadPriority priority)
 {
     ASSERT(frame());
-    ASSERT(type == CachedResource::LinkPrefetch || type == CachedResource::LinkPrerender || type == CachedResource::LinkSubresource);
+    ASSERT(type == CachedResource::LinkPrefetch || type == CachedResource::LinkSubresource);
     return requestResource(type, request, String(), defaultCachedResourceOptions(), priority);
 }
 #endif
@@ -282,7 +280,6 @@ bool CachedResourceLoader::checkInsecureContent(CachedResource::Type type, const
     case CachedResource::RawResource:
 #if ENABLE(LINK_PREFETCH)
     case CachedResource::LinkPrefetch:
-    case CachedResource::LinkPrerender:
     case CachedResource::LinkSubresource:
         // Prefetch cannot affect the current document.
 #endif
@@ -311,7 +308,6 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
     case CachedResource::RawResource:
 #if ENABLE(LINK_PREFETCH)
     case CachedResource::LinkPrefetch:
-    case CachedResource::LinkPrerender:
     case CachedResource::LinkSubresource:
 #endif
 #if ENABLE(VIDEO_TRACK)
@@ -381,7 +377,6 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
     case CachedResource::RawResource:
 #if ENABLE(LINK_PREFETCH)
     case CachedResource::LinkPrefetch:
-    case CachedResource::LinkPrerender:
     case CachedResource::LinkSubresource:
 #endif
         break;
diff --git a/Source/WebCore/loader/icon/IconDatabase.cpp b/Source/WebCore/loader/icon/IconDatabase.cpp
index 6e97c02f0..3db3fe889 100644
--- a/Source/WebCore/loader/icon/IconDatabase.cpp
+++ b/Source/WebCore/loader/icon/IconDatabase.cpp
@@ -222,6 +222,9 @@ Image* IconDatabase::synchronousIconForPageURL(const String& pageURLOriginal, co
         return 0;
 
     MutexLocker locker(m_urlAndIconLock);
+
+    if (m_retainOrReleaseIconRequested)
+        performPendingRetainAndReleaseOperations();
     
     String pageURLCopy; // Creates a null string for easy testing
     
@@ -389,18 +392,20 @@ Image* IconDatabase::defaultIcon(const IntSize& size)
     return m_defaultIconRecord->image(size);
 }
 
-
-void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
-{    
+void IconDatabase::retainIconForPageURL(const String& pageURL)
+{
     ASSERT_NOT_SYNC_THREAD();
-    
-    // Cannot do anything with pageURLOriginal that would end up storing it without deep copying first
-    
-    if (!isEnabled() || !documentCanHaveIcon(pageURLOriginal))
+
+    if (!isEnabled() || !documentCanHaveIcon(pageURL))
         return;
        
-    MutexLocker locker(m_urlAndIconLock);
+    MutexLocker locker(m_urlsToRetainOrReleaseLock);
+    m_urlsToRetain.add(pageURL);
+    scheduleOrDeferSyncTimer();
+}
 
+void IconDatabase::performRetainIconForPageURL(const String& pageURLOriginal, int retainCount)
+{
     PageURLRecord* record = m_pageURLToRecordMap.get(pageURLOriginal);
     
     String pageURL;
@@ -412,7 +417,7 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
         m_pageURLToRecordMap.set(pageURL, record);
     }
     
-    if (!record->retain()) {
+    if (!record->retain(retainCount)) {
         if (pageURL.isNull())
             pageURL = pageURLOriginal.isolatedCopy();
 
@@ -434,17 +439,23 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
     }
 }
 
-void IconDatabase::releaseIconForPageURL(const String& pageURLOriginal)
+void IconDatabase::releaseIconForPageURL(const String& pageURL)
 {
     ASSERT_NOT_SYNC_THREAD();
         
     // Cannot do anything with pageURLOriginal that would end up storing it without deep copying first
     
-    if (!isEnabled() || !documentCanHaveIcon(pageURLOriginal))
+    if (!isEnabled() || !documentCanHaveIcon(pageURL))
         return;
-    
-    MutexLocker locker(m_urlAndIconLock);
 
+    MutexLocker locker(m_urlsToRetainOrReleaseLock);
+    m_urlsToRelease.add(pageURL);
+    m_retainOrReleaseIconRequested = true;
+    scheduleOrDeferSyncTimer();
+}
+
+void IconDatabase::performReleaseIconForPageURL(const String& pageURLOriginal, int releaseCount)
+{
     // Check if this pageURL is actually retained
     if (!m_retainedPageURLs.contains(pageURLOriginal)) {
         LOG_ERROR("Attempting to release icon for URL %s which is not retained", urlForLogging(pageURLOriginal).ascii().data());
@@ -458,7 +469,7 @@ void IconDatabase::releaseIconForPageURL(const String& pageURLOriginal)
     ASSERT(pageRecord->retainCount() > 0);
         
     // If it still has a positive retain count, store the new count and bail
-    if (pageRecord->release())
+    if (pageRecord->release(releaseCount))
         return;
         
     // This pageRecord has now been fully released.  Do the appropriate cleanup
@@ -498,9 +509,6 @@ void IconDatabase::releaseIconForPageURL(const String& pageURLOriginal)
     }
     
     delete pageRecord;
-
-    if (isOpen())
-        scheduleOrDeferSyncTimer();
 }
 
 void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> dataOriginal, const String& iconURLOriginal)
@@ -736,6 +744,10 @@ size_t IconDatabase::pageURLMappingCount()
 size_t IconDatabase::retainedPageURLCount()
 {
     MutexLocker locker(m_urlAndIconLock);
+
+    if (m_retainOrReleaseIconRequested)
+        performPendingRetainAndReleaseOperations();
+
     return m_retainedPageURLs.size();
 }
 
@@ -762,6 +774,7 @@ size_t IconDatabase::iconRecordCountWithData()
 IconDatabase::IconDatabase()
     : m_syncTimer(this, &IconDatabase::syncTimerFired)
     , m_syncThreadRunning(false)
+    , m_scheduleOrDeferSyncTimerRequested(false)
     , m_isEnabled(false)
     , m_privateBrowsingEnabled(false)
     , m_threadTerminationRequested(false)
@@ -823,17 +836,30 @@ void IconDatabase::wakeSyncThread()
     m_syncCondition.signal();
 }
 
+void IconDatabase::performScheduleOrDeferSyncTimer()
+{
+    m_syncTimer.startOneShot(updateTimerDelay);
+    m_scheduleOrDeferSyncTimerRequested = false;
+}
+
+void IconDatabase::performScheduleOrDeferSyncTimerOnMainThread(void* context)
+{
+    static_cast<IconDatabase*>(context)->performScheduleOrDeferSyncTimer();
+}
+
 void IconDatabase::scheduleOrDeferSyncTimer()
 {
     ASSERT_NOT_SYNC_THREAD();
 
-    if (!m_syncTimer.isActive()) {
-        // The following is balanced by the call to enableSuddenTermination in the
-        // syncTimerFired function.
-        disableSuddenTermination();
-    }
+    if (m_scheduleOrDeferSyncTimerRequested)
+        return;
 
-    m_syncTimer.startOneShot(updateTimerDelay);
+    // The following is balanced by the call to enableSuddenTermination in the
+    // syncTimerFired function.
+    disableSuddenTermination();
+
+    m_scheduleOrDeferSyncTimerRequested = true;
+    callOnMainThread(performScheduleOrDeferSyncTimerOnMainThread, this);
 }
 
 void IconDatabase::syncTimerFired(Timer<IconDatabase>*)
@@ -1306,7 +1332,10 @@ void IconDatabase::performURLImport()
     // Keep a set of ones that are retained and pending notification
     {
         MutexLocker locker(m_urlAndIconLock);
-        
+
+        if (m_retainOrReleaseIconRequested)
+            performPendingRetainAndReleaseOperations();
+
         for (unsigned i = 0; i < urls.size(); ++i) {
             if (!m_retainedPageURLs.contains(urls[i])) {
                 PageURLRecord* record = m_pageURLToRecordMap.get(urls[i]);
@@ -1387,6 +1416,11 @@ void IconDatabase::syncThreadMainLoop()
         // Then, if the thread should be quitting, quit now!
         if (m_threadTerminationRequested)
             break;
+
+        if (m_retainOrReleaseIconRequested) {
+            MutexLocker locker(m_urlAndIconLock);
+            performPendingRetainAndReleaseOperations();
+        }
         
         bool didAnyWork = true;
         while (didAnyWork) {
@@ -1471,6 +1505,25 @@ void IconDatabase::syncThreadMainLoop()
     }
 }
 
+void IconDatabase::performPendingRetainAndReleaseOperations()
+{
+    ASSERT(m_retainOrReleaseIconRequested);
+
+    // NOTE: The caller is assumed to hold m_urlAndIconLock.
+    ASSERT(!m_urlAndIconLock.tryLock());
+
+    MutexLocker vectorLocker(m_urlsToRetainOrReleaseLock);
+
+    for (HashCountedSet<String>::const_iterator it = m_urlsToRetain.begin(), end = m_urlsToRetain.end(); it != end; ++it)
+        performRetainIconForPageURL(it->first, it->second);
+    for (HashCountedSet<String>::const_iterator it = m_urlsToRelease.begin(), end = m_urlsToRelease.end(); it != end; ++it)
+        performReleaseIconForPageURL(it->first, it->second);
+
+    m_urlsToRetain.clear();
+    m_urlsToRelease.clear();
+    m_retainOrReleaseIconRequested = false;
+}
+
 bool IconDatabase::readFromDatabase()
 {
     ASSERT_ICON_SYNC_THREAD();
diff --git a/Source/WebCore/loader/icon/IconDatabase.h b/Source/WebCore/loader/icon/IconDatabase.h
index e4d8ca73a..3ec9b744c 100644
--- a/Source/WebCore/loader/icon/IconDatabase.h
+++ b/Source/WebCore/loader/icon/IconDatabase.h
@@ -29,6 +29,7 @@
 
 #include "IconDatabaseBase.h"
 #include "Timer.h"
+#include <wtf/HashCountedSet.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
@@ -135,6 +136,11 @@ private:
 
     RefPtr<IconRecord> m_defaultIconRecord;
 
+    static void performScheduleOrDeferSyncTimerOnMainThread(void*);
+    void performScheduleOrDeferSyncTimer();
+
+    bool m_scheduleOrDeferSyncTimerRequested;
+
 // *** Any Thread ***
 public:
     virtual bool isOpen() const;
@@ -159,6 +165,7 @@ private:
     bool m_iconURLImportComplete;
     bool m_syncThreadHasWorkToDo;
     bool m_disabledSuddenTerminationForSyncThread;
+    bool m_retainOrReleaseIconRequested;
 
     Mutex m_urlAndIconLock;
     // Holding m_urlAndIconLock is required when accessing any of the following data structures or the objects they contain
@@ -177,6 +184,11 @@ private:
     HashSet<String> m_pageURLsInterestedInIcons;
     HashSet<IconRecord*> m_iconsPendingReading;
 
+    Mutex m_urlsToRetainOrReleaseLock;
+    // Holding m_urlsToRetainOrReleaseLock is required when accessing any of the following data structures.
+    HashCountedSet<String> m_urlsToRetain;
+    HashCountedSet<String> m_urlsToRelease;
+
 // *** Sync Thread Only ***
 public:
     // Should be used only on the sync thread and only by the Safari 2 Icons import procedure
@@ -202,6 +214,8 @@ private:
     void removeAllIconsOnThread();
     void deleteAllPreparedStatements();
     void* cleanupSyncThread();
+    void performRetainIconForPageURL(const String&, int retainCount);
+    void performReleaseIconForPageURL(const String&, int releaseCount);
 
     // Record (on disk) whether or not Safari 2-style icons were imported (once per dataabse)
     bool imported();
@@ -220,7 +234,9 @@ private:
     PassRefPtr<SharedBuffer> getImageDataForIconURLFromSQLDatabase(const String& iconURL);
     void removeIconFromSQLDatabase(const String& iconURL);
     void writeIconSnapshotToSQLDatabase(const IconSnapshot&);    
-    
+
+    void performPendingRetainAndReleaseOperations();
+
     // Methods to dispatch client callbacks on the main thread
     void dispatchDidImportIconURLForPageURLOnMainThread(const String&);
     void dispatchDidImportIconDataForPageURLOnMainThread(const String&);
diff --git a/Source/WebCore/loader/icon/PageURLRecord.h b/Source/WebCore/loader/icon/PageURLRecord.h
index b9e0a41ee..307a71920 100644
--- a/Source/WebCore/loader/icon/PageURLRecord.h
+++ b/Source/WebCore/loader/icon/PageURLRecord.h
@@ -69,13 +69,19 @@ public:
     PageURLSnapshot snapshot(bool forDeletion = false) const;
 
     // Returns false if the page wasn't retained beforehand, true if the retain count was already 1 or higher
-    inline bool retain() { return m_retainCount++; }
+    bool retain(int count)
+    {
+        bool wasRetained = m_retainCount > 0;
+        m_retainCount += count;
+        return wasRetained;
+    }
 
     // Returns true if the page is still retained after the call.  False if the retain count just dropped to 0
-    inline bool release()
+    bool release(int count)
     {
-        ASSERT(m_retainCount > 0);
-        return --m_retainCount;
+        ASSERT(m_retainCount >= count);
+        m_retainCount -= count;
+        return m_retainCount > 0;
     }
 
     inline int retainCount() const { return m_retainCount; }
diff --git a/Source/WebCore/mathml/MathMLElement.cpp b/Source/WebCore/mathml/MathMLElement.cpp
index 44a1ac3d8..1f9a9c532 100644
--- a/Source/WebCore/mathml/MathMLElement.cpp
+++ b/Source/WebCore/mathml/MathMLElement.cpp
@@ -55,32 +55,32 @@ bool MathMLElement::isPresentationAttribute(const QualifiedName& name) const
     return StyledElement::isPresentationAttribute(name);
 }
 
-void MathMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void MathMLElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (attr->name() == mathbackgroundAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyBackgroundColor, attr->value());
-    else if (attr->name() == mathsizeAttr) {
+    if (attribute.name() == mathbackgroundAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyBackgroundColor, attribute.value());
+    else if (attribute.name() == mathsizeAttr) {
         // The following three values of mathsize are handled in WebCore/css/mathml.css
-        if (attr->value() != "normal" && attr->value() != "small" && attr->value() != "big")
-            addPropertyToAttributeStyle(style, CSSPropertyFontSize, attr->value());
-    } else if (attr->name() == mathcolorAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyColor, attr->value());
+        if (attribute.value() != "normal" && attribute.value() != "small" && attribute.value() != "big")
+            addPropertyToAttributeStyle(style, CSSPropertyFontSize, attribute.value());
+    } else if (attribute.name() == mathcolorAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyColor, attribute.value());
     // FIXME: deprecated attributes that should loose in a conflict with a non deprecated attribute
-    else if (attr->name() == fontsizeAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyFontSize, attr->value());
-    else if (attr->name() == backgroundAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyBackgroundColor, attr->value());
-    else if (attr->name() == colorAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyColor, attr->value());
-    else if (attr->name() == fontstyleAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyFontStyle, attr->value());
-    else if (attr->name() == fontweightAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyFontWeight, attr->value());
-    else if (attr->name() == fontfamilyAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyFontFamily, attr->value());
+    else if (attribute.name() == fontsizeAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyFontSize, attribute.value());
+    else if (attribute.name() == backgroundAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyBackgroundColor, attribute.value());
+    else if (attribute.name() == colorAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyColor, attribute.value());
+    else if (attribute.name() == fontstyleAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyFontStyle, attribute.value());
+    else if (attribute.name() == fontweightAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyFontWeight, attribute.value());
+    else if (attribute.name() == fontfamilyAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyFontFamily, attribute.value());
     else {
-        ASSERT(!isPresentationAttribute(attr->name()));
-        StyledElement::collectStyleForAttribute(attr, style);
+        ASSERT(!isPresentationAttribute(attribute.name()));
+        StyledElement::collectStyleForAttribute(attribute, style);
     }
 }
 
diff --git a/Source/WebCore/mathml/MathMLElement.h b/Source/WebCore/mathml/MathMLElement.h
index 753537bc3..bf4b7987a 100644
--- a/Source/WebCore/mathml/MathMLElement.h
+++ b/Source/WebCore/mathml/MathMLElement.h
@@ -43,7 +43,7 @@ protected:
 private:    
     virtual bool isMathMLElement() const { return true; }
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
 };
 
 inline MathMLElement* toMathMLElement(Element* element)
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index 28da4dcd0..0e7c95a7e 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -503,7 +503,7 @@ public:
     bool allowStyleFromSource(const KURL&) const;
     bool allowFontFromSource(const KURL&) const;
     bool allowMediaFromSource(const KURL&) const;
-    bool allowConnectFromSource(const KURL&) const;
+    bool allowConnectToSource(const KURL&) const;
 
 private:
     explicit CSPDirectiveList(ScriptExecutionContext*);
@@ -544,7 +544,7 @@ private:
     OwnPtr<CSPDirective> m_mediaSrc;
     OwnPtr<CSPDirective> m_connectSrc;
 
-    Vector<KURL> m_reportURLs;
+    Vector<KURL> m_reportURIs;
 };
 
 CSPDirectiveList::CSPDirectiveList(ScriptExecutionContext* scriptExecutionContext)
@@ -580,7 +580,7 @@ void CSPDirectiveList::reportViolation(const String& directiveText, const String
     String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleMessage;
     m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message);
 
-    if (m_reportURLs.isEmpty())
+    if (m_reportURIs.isEmpty())
         return;
 
     // FIXME: Support sending reports from worker.
@@ -618,8 +618,8 @@ void CSPDirectiveList::reportViolation(const String& directiveText, const String
 
     RefPtr<FormData> report = FormData::create(reportObject->toJSONString().utf8());
 
-    for (size_t i = 0; i < m_reportURLs.size(); ++i)
-        PingLoader::reportContentSecurityPolicyViolation(frame, m_reportURLs[i], report);
+    for (size_t i = 0; i < m_reportURIs.size(); ++i)
+        PingLoader::reportContentSecurityPolicyViolation(frame, m_reportURIs[i], report);
 }
 
 void CSPDirectiveList::logUnrecognizedDirective(const String& name) const
@@ -642,7 +642,7 @@ bool CSPDirectiveList::checkInlineAndReportViolation(CSPDirective* directive, co
 {
     if (!directive || directive->allowInline())
         return true;
-    reportViolation(directive->text(), consoleMessage);
+    reportViolation(directive->text(), consoleMessage + "\"" + directive->text() + "\".\n");
     return denyIfEnforcingPolicy();
 }
 
@@ -650,7 +650,7 @@ bool CSPDirectiveList::checkEvalAndReportViolation(CSPDirective* directive, cons
 {
     if (checkEval(directive))
         return true;
-    reportViolation(directive->text(), consoleMessage);
+    reportViolation(directive->text(), consoleMessage + "\"" + directive->text() + "\".\n");
     return denyIfEnforcingPolicy();
 }
 
@@ -658,37 +658,38 @@ bool CSPDirectiveList::checkSourceAndReportViolation(CSPDirective* directive, co
 {
     if (!directive || directive->allows(url))
         return true;
-    reportViolation(directive->text(), "Refused to load " + type + " from '" + url.string() + "' because of Content-Security-Policy.\n", url);
+    String verb = type == "connect" ? "connect to" : "load the";
+    reportViolation(directive->text(), "Refused to " + verb + " " + type + " '" + url.string() + "' because it violates the following Content Security Policy directive: \"" + directive->text() + "\".\n", url);
     return denyIfEnforcingPolicy();
 }
 
 bool CSPDirectiveList::allowJavaScriptURLs() const
 {
-    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute JavaScript URL because of Content-Security-Policy.\n"));
+    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute JavaScript URL because it violates the following Content Security Policy directive: "));
     return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
 }
 
 bool CSPDirectiveList::allowInlineEventHandlers() const
 {
-    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline event handler because of Content-Security-Policy.\n"));
+    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline event handler because it violates the following Content Security Policy directive: "));
     return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
 }
 
 bool CSPDirectiveList::allowInlineScript() const
 {
-    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline script because of Content-Security-Policy.\n"));
+    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline script because it violates the following Content Security Policy directive: "));
     return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
 }
 
 bool CSPDirectiveList::allowInlineStyle() const
 {
-    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to apply inline style because of Content-Security-Policy.\n"));
+    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to apply inline style because it violates the following Content Security Policy directive: "));
     return checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), consoleMessage);
 }
 
 bool CSPDirectiveList::allowEval() const
 {
-    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to evaluate script because of Content-Security-Policy.\n"));
+    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to evaluate script because it violates the following Content Security Policy directive: "));
     return checkEvalAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
 }
 
@@ -738,7 +739,7 @@ bool CSPDirectiveList::allowMediaFromSource(const KURL& url) const
     return checkSourceAndReportViolation(operativeDirective(m_mediaSrc.get()), url, type);
 }
 
-bool CSPDirectiveList::allowConnectFromSource(const KURL& url) const
+bool CSPDirectiveList::allowConnectToSource(const KURL& url) const
 {
     DEFINE_STATIC_LOCAL(String, type, ("connect"));
     return checkSourceAndReportViolation(operativeDirective(m_connectSrc.get()), url, type);
@@ -826,7 +827,7 @@ void CSPDirectiveList::parseReportURI(const String& value)
 
         if (urlBegin < position) {
             String url = String(urlBegin, position - urlBegin);
-            m_reportURLs.append(m_scriptExecutionContext->completeURL(url));
+            m_reportURIs.append(m_scriptExecutionContext->completeURL(url));
         }
     }
 }
@@ -879,7 +880,7 @@ void CSPDirectiveList::addDirective(const String& name, const String& value)
         m_connectSrc = createCSPDirective(name, value);
     else if (!m_haveSandboxPolicy && equalIgnoringCase(name, sandbox))
         applySandboxPolicy(value);
-    else if (m_reportURLs.isEmpty() && equalIgnoringCase(name, reportURI))
+    else if (m_reportURIs.isEmpty() && equalIgnoringCase(name, reportURI))
         parseReportURI(value);
     else
         logUnrecognizedDirective(name);
@@ -1004,9 +1005,9 @@ bool ContentSecurityPolicy::allowMediaFromSource(const KURL& url) const
     return isAllowedByAll<&CSPDirectiveList::allowMediaFromSource>(m_policies, url);
 }
 
-bool ContentSecurityPolicy::allowConnectFromSource(const KURL& url) const
+bool ContentSecurityPolicy::allowConnectToSource(const KURL& url) const
 {
-    return isAllowedByAll<&CSPDirectiveList::allowConnectFromSource>(m_policies, url);
+    return isAllowedByAll<&CSPDirectiveList::allowConnectToSource>(m_policies, url);
 }
 
 }
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
index 55d21800e..f13014f13 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.h
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -74,7 +74,7 @@ public:
     bool allowStyleFromSource(const KURL&) const;
     bool allowFontFromSource(const KURL&) const;
     bool allowMediaFromSource(const KURL&) const;
-    bool allowConnectFromSource(const KURL&) const;
+    bool allowConnectToSource(const KURL&) const;
 
     void setOverrideAllowInlineStyle(bool);
 
diff --git a/Source/WebCore/page/DOMSelection.cpp b/Source/WebCore/page/DOMSelection.cpp
index fd846583f..59f266f41 100644
--- a/Source/WebCore/page/DOMSelection.cpp
+++ b/Source/WebCore/page/DOMSelection.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -58,11 +59,17 @@ static Node* selectionShadowAncestor(Frame* frame)
     return shadowAncestor;
 }
 
-DOMSelection::DOMSelection(Frame* frame)
-    : DOMWindowProperty(frame)
+DOMSelection::DOMSelection(const TreeScope* treeScope)
+    : DOMWindowProperty(treeScope->rootNode()->document()->frame())
+    , m_treeScope(treeScope)
 {
 }
 
+void DOMSelection::clearTreeScope()
+{
+    m_treeScope = 0;
+}
+
 const VisibleSelection& DOMSelection::visibleSelection() const
 {
     ASSERT(m_frame);
@@ -95,72 +102,64 @@ Node* DOMSelection::anchorNode() const
 {
     if (!m_frame)
         return 0;
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
-        return shadowAncestor->parentNodeGuaranteedHostFree();
-    return anchorPosition(visibleSelection()).containerNode();
+
+    return shadowAdjustedNode(anchorPosition(visibleSelection()));
 }
 
 int DOMSelection::anchorOffset() const
 {
     if (!m_frame)
         return 0;
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
-        return shadowAncestor->nodeIndex();
-    return anchorPosition(visibleSelection()).offsetInContainerNode();
+
+    return shadowAdjustedOffset(anchorPosition(visibleSelection()));
 }
 
 Node* DOMSelection::focusNode() const
 {
     if (!m_frame)
         return 0;
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
-        return shadowAncestor->parentNodeGuaranteedHostFree();
-    return focusPosition(visibleSelection()).containerNode();
+
+    return shadowAdjustedNode(focusPosition(visibleSelection()));
 }
 
 int DOMSelection::focusOffset() const
 {
     if (!m_frame)
         return 0;
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
-        return shadowAncestor->nodeIndex();
-    return focusPosition(visibleSelection()).offsetInContainerNode();
+
+    return shadowAdjustedOffset(focusPosition(visibleSelection()));
 }
 
 Node* DOMSelection::baseNode() const
 {
     if (!m_frame)
         return 0;
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
-        return shadowAncestor->parentNodeGuaranteedHostFree();
-    return basePosition(visibleSelection()).containerNode();
+
+    return shadowAdjustedNode(basePosition(visibleSelection()));
 }
 
 int DOMSelection::baseOffset() const
 {
     if (!m_frame)
         return 0;
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
-        return shadowAncestor->nodeIndex();
-    return basePosition(visibleSelection()).offsetInContainerNode();
+
+    return shadowAdjustedOffset(basePosition(visibleSelection()));
 }
 
 Node* DOMSelection::extentNode() const
 {
     if (!m_frame)
         return 0;
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
-        return shadowAncestor->parentNodeGuaranteedHostFree();
-    return extentPosition(visibleSelection()).containerNode();
+
+    return shadowAdjustedNode(extentPosition(visibleSelection()));
 }
 
 int DOMSelection::extentOffset() const
 {
     if (!m_frame)
         return 0;
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
-        return shadowAncestor->nodeIndex();
-    return extentPosition(visibleSelection()).offsetInContainerNode();
+
+    return shadowAdjustedOffset(extentPosition(visibleSelection()));
 }
 
 bool DOMSelection::isCollapsed() const
@@ -500,6 +499,40 @@ String DOMSelection::toString()
     return plainText(m_frame->selection()->selection().toNormalizedRange().get());
 }
 
+Node* DOMSelection::shadowAdjustedNode(const Position& position) const
+{
+    if (position.isNull())
+        return 0;
+
+    Node* containerNode = position.containerNode();
+    Node* adjustedNode = m_treeScope->ancestorInThisScope(containerNode);
+
+    if (!adjustedNode)
+        return 0;
+
+    if (containerNode == adjustedNode)
+        return containerNode;
+
+    return adjustedNode->parentNodeGuaranteedHostFree();
+}
+
+int DOMSelection::shadowAdjustedOffset(const Position& position) const
+{
+    if (position.isNull())
+        return 0;
+
+    Node* containerNode = position.containerNode();
+    Node* adjustedNode = m_treeScope->ancestorInThisScope(containerNode);
+
+    if (!adjustedNode)
+        return 0;
+
+    if (containerNode == adjustedNode)
+        return position.computeOffsetInContainerNode();
+
+    return adjustedNode->nodeIndex();
+}
+
 bool DOMSelection::isValidForPosition(Node* node) const
 {
     ASSERT(m_frame);
diff --git a/Source/WebCore/page/DOMSelection.h b/Source/WebCore/page/DOMSelection.h
index 9803acca2..76b1b46ef 100644
--- a/Source/WebCore/page/DOMSelection.h
+++ b/Source/WebCore/page/DOMSelection.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,15 +39,19 @@
 namespace WebCore {
 
     class Frame;
-    class Range;
     class Node;
+    class Position;
+    class Range;
+    class TreeScope;
     class VisibleSelection;
 
     typedef int ExceptionCode;
 
     class DOMSelection : public RefCounted<DOMSelection>, public DOMWindowProperty {
     public:
-        static PassRefPtr<DOMSelection> create(Frame* frame) { return adoptRef(new DOMSelection(frame)); }
+        static PassRefPtr<DOMSelection> create(const TreeScope* treeScope) { return adoptRef(new DOMSelection(treeScope)); }
+
+        void clearTreeScope();
 
         // Safari Selection Object API
         // These methods return the valid equivalents of internal editing positions.
@@ -88,11 +93,16 @@ namespace WebCore {
         void empty();
 
     private:
-        explicit DOMSelection(Frame*);
+        const TreeScope* m_treeScope;
+
+        explicit DOMSelection(const TreeScope*);
 
         // Convenience method for accessors, does not NULL check m_frame.
         const VisibleSelection& visibleSelection() const;
 
+        Node* shadowAdjustedNode(const Position&) const;
+        int shadowAdjustedOffset(const Position&) const;
+
         bool isValidForPosition(Node*) const;
     };
 
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 1b8d44c92..40e0b2aff 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -399,7 +399,6 @@ DOMWindow::~DOMWindow()
 #ifndef NDEBUG
     if (!m_suspendedForPageCache) {
         ASSERT(!m_screen);
-        ASSERT(!m_selection);
         ASSERT(!m_history);
         ASSERT(!m_crypto);
         ASSERT(!m_locationbar);
@@ -572,7 +571,6 @@ void DOMWindow::clearDOMWindowProperties()
     m_properties.clear();
 
     m_screen = 0;
-    m_selection = 0;
     m_history = 0;
     m_crypto = 0;
     m_locationbar = 0;
@@ -886,11 +884,10 @@ void DOMWindow::dispatchMessageEventWithOriginCheck(SecurityOrigin* intendedTarg
 
 DOMSelection* DOMWindow::getSelection()
 {
-    if (!isCurrentlyDisplayedInFrame())
+    if (!isCurrentlyDisplayedInFrame() || !m_frame)
         return 0;
-    if (!m_selection)
-        m_selection = DOMSelection::create(m_frame);
-    return m_selection.get();
+
+    return m_frame->document()->getSelection();
 }
 
 Element* DOMWindow::frameElement() const
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index bb6df85b0..4ac81624d 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -428,7 +428,6 @@ namespace WebCore {
         HashSet<DOMWindowProperty*> m_properties;
 
         mutable RefPtr<Screen> m_screen;
-        mutable RefPtr<DOMSelection> m_selection;
         mutable RefPtr<History> m_history;
         mutable RefPtr<Crypto>  m_crypto;
         mutable RefPtr<BarInfo> m_locationbar;
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 89d72ae83..135446cf4 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -77,7 +77,12 @@ static PlatformMouseEvent createMouseEvent(DragData* dragData)
 {
     bool shiftKey, ctrlKey, altKey, metaKey;
     shiftKey = ctrlKey = altKey = metaKey = false;
-    PlatformKeyboardEvent::getCurrentModifierState(shiftKey, ctrlKey, altKey, metaKey);
+    int keyState = dragData->modifierKeyState();
+    shiftKey = static_cast<bool>(keyState & PlatformEvent::ShiftKey);
+    ctrlKey = static_cast<bool>(keyState & PlatformEvent::CtrlKey);
+    altKey = static_cast<bool>(keyState & PlatformEvent::AltKey);
+    metaKey = static_cast<bool>(keyState & PlatformEvent::MetaKey);
+
     return PlatformMouseEvent(dragData->clientPosition(), dragData->globalPosition(),
                               LeftButton, PlatformEvent::MouseMoved, 0, shiftKey, ctrlKey, altKey,
                               metaKey, currentTime());
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index 17e95061b..7bc8f413c 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -63,7 +63,8 @@ class EditorClient {
 public:
     virtual ~EditorClient() {  }
     virtual void pageDestroyed() = 0;
-    
+    virtual void frameWillDetachPage(Frame*) = 0;
+
     virtual bool shouldDeleteRange(Range*) = 0;
     virtual bool shouldShowDeleteInterface(HTMLElement*) = 0;
     virtual bool smartInsertDeleteEnabled() = 0; 
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 5cf991f96..b4221b0b4 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -72,6 +72,7 @@
 #include "ScrollAnimator.h"
 #include "Scrollbar.h"
 #include "Settings.h"
+#include "ShadowRoot.h"
 #include "SpatialNavigation.h"
 #include "StaticHashSetNodeList.h"
 #include "StyleCachedImage.h"
@@ -2091,7 +2092,7 @@ static inline SVGElementInstance* instanceAssociatedWithShadowTreeElement(Node*
     if (!referenceNode || !referenceNode->isSVGElement())
         return 0;
 
-    Node* shadowTreeElement = referenceNode->shadowTreeRootNode();
+    Node* shadowTreeElement = referenceNode->shadowRoot();
     if (!shadowTreeElement)
         return 0;
 
@@ -2429,11 +2430,12 @@ bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
     return false;
 }
 
-bool EventHandler::handleGestureTap(const PlatformGestureEvent& gestureEvent, Node* preTargetedNode)
+bool EventHandler::handleGestureTap(const PlatformGestureEvent& gestureEvent)
 {
+    // FIXME: Refactor this code to not hit test multiple times.
     IntPoint adjustedPoint = gestureEvent.position();
 #if ENABLE(TOUCH_ADJUSTMENT)
-    if (!gestureEvent.area().isEmpty() && !preTargetedNode) {
+    if (!gestureEvent.area().isEmpty()) {
         Node* targetNode = 0;
         // For now we use the adjusted position to ensure the later redundant hit-tests hits the right node.
         bestClickableNodeForTouchPoint(gestureEvent.position(), IntSize(gestureEvent.area().width() / 2, gestureEvent.area().height() / 2), adjustedPoint, targetNode);
@@ -2441,9 +2443,6 @@ bool EventHandler::handleGestureTap(const PlatformGestureEvent& gestureEvent, No
             return false;
     }
 #endif
-    // FIXME: Refactor to avoid hit testing multiple times (this is only an interim step).
-    if (preTargetedNode)
-        adjustedPoint = preTargetedNode->getPixelSnappedRect().center();
 
     bool defaultPrevented = false;
     PlatformMouseEvent fakeMouseMove(adjustedPoint, gestureEvent.globalPosition(), NoButton, PlatformEvent::MouseMoved, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index 53f360802..b8cfa1b81 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -163,7 +163,7 @@ public:
 
 #if ENABLE(GESTURE_EVENTS)
     bool handleGestureEvent(const PlatformGestureEvent&);
-    bool handleGestureTap(const PlatformGestureEvent&, Node* preTargetedNode = 0);
+    bool handleGestureTap(const PlatformGestureEvent&);
     bool handleGestureScrollUpdate(const PlatformGestureEvent&);
 #endif
 
diff --git a/Source/WebCore/page/EventSource.cpp b/Source/WebCore/page/EventSource.cpp
index 543f1e1ac..2a4db03fa 100644
--- a/Source/WebCore/page/EventSource.cpp
+++ b/Source/WebCore/page/EventSource.cpp
@@ -88,7 +88,7 @@ PassRefPtr<EventSource> EventSource::create(ScriptExecutionContext* context, con
         return 0;
     }
 
-    if (!context->contentSecurityPolicy()->allowConnectFromSource(fullURL)) {
+    if (!context->contentSecurityPolicy()->allowConnectToSource(fullURL)) {
         // FIXME: Should this be throwing an exception?
         ec = SECURITY_ERR;
         return 0;
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index 41f979523..37e97df6d 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -611,7 +611,7 @@ bool FocusController::setFocusedNode(Node* node, PassRefPtr<Frame> newFocusedFra
         return true;
 
     // FIXME: Might want to disable this check for caretBrowsing
-    if (oldFocusedNode && oldFocusedNode->rootEditableElement() == oldFocusedNode && !relinquishesEditingFocus(oldFocusedNode))
+    if (oldFocusedNode && oldFocusedNode->isRootEditableElement() && !relinquishesEditingFocus(oldFocusedNode))
         return false;
 
     m_page->editorClient()->willSetInputMethodState();
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 25531b08b..0f3fc6de1 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -395,16 +395,6 @@ void FrameView::setFrameRect(const IntRect& newRect)
     if (newRect == oldRect)
         return;
 
-#if ENABLE(VIEWPORT)
-    if (useFixedLayout()) {
-        Document* document = m_frame->document();
-        ViewportArguments viewport = document->viewportArguments();
-        Page* page = frame() ? frame()->page() : 0;
-        if (page)
-            page->chrome()->client()->dispatchViewportPropertiesDidChange(viewport);
-    }
-#endif
-
     ScrollView::setFrameRect(newRect);
 
     updateScrollableAreaSet();
@@ -1464,8 +1454,6 @@ IntPoint FrameView::currentMousePosition() const
 
 bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect)
 {
-    const size_t fixedObjectThreshold = 5;
-
     RenderBlock::PositionedObjectsListHashSet* positionedObjects = 0;
     if (RenderView* root = rootRenderer(this))
         positionedObjects = root->positionedObjects();
@@ -1478,8 +1466,7 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
     const bool isCompositedContentLayer = contentsInCompositedLayer();
 
     // Get the rects of the fixed objects visible in the rectToScroll
-    Vector<IntRect, fixedObjectThreshold> subRectToUpdate;
-    bool updateInvalidatedSubRect = true;
+    Region regionToUpdate;
     RenderBlock::PositionedObjectsListHashSet::const_iterator end = positionedObjects->end();
     for (RenderBlock::PositionedObjectsListHashSet::const_iterator it = positionedObjects->begin(); it != end; ++it) {
         RenderBox* renderBox = *it;
@@ -1489,49 +1476,44 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
         if (renderBox->isComposited())
             continue;
 #endif
-        IntRect updateRect = pixelSnappedIntRect(renderBox->layer()->repaintRectIncludingDescendants());
+        IntRect updateRect = pixelSnappedIntRect(renderBox->layer()->repaintRectIncludingNonCompositingDescendants());
         updateRect = contentsToRootView(updateRect);
         if (!isCompositedContentLayer && clipsRepaints())
             updateRect.intersect(rectToScroll);
-        if (!updateRect.isEmpty()) {
-            if (subRectToUpdate.size() >= fixedObjectThreshold) {
-                updateInvalidatedSubRect = false;
-                break;
-            }
-            subRectToUpdate.append(updateRect);
-        }
+        if (!updateRect.isEmpty())
+            regionToUpdate.unite(updateRect);
     }
 
-    // Scroll the view
-    if (updateInvalidatedSubRect) {
-        // 1) scroll
-        hostWindow()->scroll(scrollDelta, rectToScroll, clipRect);
+    // The area to be painted by fixed objects exceeds 50% of the area of the view, we cannot use the fast path.
+    if (regionToUpdate.totalArea() > (clipRect.width() * clipRect.height() * 0.5))
+        return false;
 
-        // 2) update the area of fixed objects that has been invalidated
-        size_t fixObjectsCount = subRectToUpdate.size();
-        for (size_t i = 0; i < fixObjectsCount; ++i) {
-            IntRect updateRect = subRectToUpdate[i];
-            IntRect scrolledRect = updateRect;
-            scrolledRect.move(scrollDelta);
-            updateRect.unite(scrolledRect);
+    // 1) scroll
+    hostWindow()->scroll(scrollDelta, rectToScroll, clipRect);
+
+    // 2) update the area of fixed objects that has been invalidated
+    Vector<IntRect> subRectsToUpdate = regionToUpdate.rects();
+    size_t fixObjectsCount = subRectsToUpdate.size();
+    for (size_t i = 0; i < fixObjectsCount; ++i) {
+        IntRect updateRect = subRectsToUpdate[i];
+        IntRect scrolledRect = updateRect;
+        scrolledRect.move(scrollDelta);
+        updateRect.unite(scrolledRect);
 #if USE(ACCELERATED_COMPOSITING)
-            if (isCompositedContentLayer) {
-                updateRect = rootViewToContents(updateRect);
-                RenderView* root = rootRenderer(this);
-                ASSERT(root);
-                root->layer()->setBackingNeedsRepaintInRect(updateRect);
-                continue;
-            }
-#endif
-            if (clipsRepaints())
-                updateRect.intersect(rectToScroll);
-            hostWindow()->invalidateContentsAndRootView(updateRect, false);
+        if (isCompositedContentLayer) {
+            updateRect = rootViewToContents(updateRect);
+            RenderView* root = rootRenderer(this);
+            ASSERT(root);
+            root->layer()->setBackingNeedsRepaintInRect(updateRect);
+            continue;
         }
-        return true;
+#endif
+        if (clipsRepaints())
+            updateRect.intersect(rectToScroll);
+        hostWindow()->invalidateContentsAndRootView(updateRect, false);
     }
 
-    // the number of fixed objects exceed the threshold, we cannot use the fast path
-    return false;
+    return true;
 }
 
 void FrameView::scrollContentsSlowPath(const IntRect& updateRect)
@@ -1704,6 +1686,10 @@ void FrameView::setScrollPosition(const IntPoint& scrollPoint)
 {
     TemporaryChange<bool> changeInProgrammaticScroll(m_inProgrammaticScroll, true);
     m_maintainScrollPositionAnchor = 0;
+
+    if (requestScrollPositionUpdate(scrollPoint))
+        return;
+
     ScrollView::setScrollPosition(scrollPoint);
 }
 
@@ -1718,11 +1704,13 @@ void FrameView::delegatesScrollingDidChange()
 
 void FrameView::setFixedVisibleContentRect(const IntRect& visibleContentRect)
 {
+    bool visibleContentSizeDidChange = false;
     if (visibleContentRect.size() != this->fixedVisibleContentRect().size()) {
         // When the viewport size changes or the content is scaled, we need to
         // reposition the fixed positioned elements.
         if (RenderView* root = rootRenderer(this))
             root->setFixedPositionedObjectsNeedLayout();
+        visibleContentSizeDidChange = true;
     }
 
     IntSize offset = scrollOffset();
@@ -1730,8 +1718,13 @@ void FrameView::setFixedVisibleContentRect(const IntRect& visibleContentRect)
     if (offset != scrollOffset()) {
         if (m_frame->page()->settings()->acceleratedCompositingForFixedPositionEnabled())
             updateFixedElementsAfterScrolling();
+        scrollAnimator()->setCurrentPosition(scrollPosition());
         scrollPositionChanged();
     }
+    if (visibleContentSizeDidChange) {
+        // Update the scroll-bars to calculate new page-step size.
+        updateScrollbars(scrollOffset());
+    }
     frame()->loader()->client()->didChangeScrollOffset();
 }
 
@@ -2561,7 +2554,8 @@ IntRect FrameView::windowClipRect(bool clipToContents) const
     // Take our owner element and get its clip rect.
     HTMLFrameOwnerElement* ownerElement = m_frame->ownerElement();
     FrameView* parentView = ownerElement->document()->view();
-    clipRect.intersect(parentView->windowClipRectForFrameOwner(ownerElement, true));
+    if (parentView)
+        clipRect.intersect(parentView->windowClipRectForFrameOwner(ownerElement, true));
     return clipRect;
 }
 
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 50232755c..25d962b73 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -242,6 +242,7 @@ public:
     PaintBehavior paintBehavior() const;
     bool isPainting() const;
     bool hasEverPainted() const { return m_lastPaintTime; }
+    void setLastPaintTime(double lastPaintTime) { m_lastPaintTime = lastPaintTime; }
     void setNodeToDraw(Node*);
 
     virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
diff --git a/Source/WebCore/page/GestureTapHighlighter.cpp b/Source/WebCore/page/GestureTapHighlighter.cpp
index 0cb694fec..7bd5db985 100644
--- a/Source/WebCore/page/GestureTapHighlighter.cpp
+++ b/Source/WebCore/page/GestureTapHighlighter.cpp
@@ -39,6 +39,7 @@
 #include "Page.h"
 #include "RenderBoxModelObject.h"
 #include "RenderInline.h"
+#include "RenderLayer.h"
 #include "RenderObject.h"
 
 namespace WebCore {
@@ -134,16 +135,16 @@ inline void addHighlightRect(Path& path, const LayoutRect& rect, const LayoutRec
             contains(next, rect.maxX()) ? squared : rounded);
 }
 
-Path pathForRenderer(RenderObject* o)
+Path absolutePathForRenderer(RenderObject* const o)
 {
     ASSERT(o);
-    Path path;
 
     Vector<IntRect> rects;
-    o->addFocusRingRects(rects, /* acc. offset */ ownerFrameToMainFrameOffset(o));
+    LayoutPoint frameOffset = ownerFrameToMainFrameOffset(o);
+    o->addFocusRingRects(rects, frameOffset);
 
     if (rects.isEmpty())
-        return path;
+        return Path();
 
     // The basic idea is to allow up to three different boxes in order to highlight
     // text with line breaks more nicer than using a bounding box.
@@ -184,12 +185,51 @@ Path pathForRenderer(RenderObject* o)
             drawableRects.append(rects.last());
     }
 
+    // Clip the overflow rects if needed, before the ring path is formed to
+    // ensure rounded highlight rects. This clipping has the problem with nested
+    // divs with transforms, which could be resolved by proper Path::intersecting.
+    for (int i = drawableRects.size() - 1; i >= 0; --i) {
+        LayoutRect& ringRect = drawableRects.at(i);
+        LayoutPoint ringRectLocation = ringRect.location();
+
+        ringRect.moveBy(-frameOffset);
+
+        RenderLayer* layer = o->enclosingLayer();
+        RenderObject* currentRenderer = o;
+
+        // Check ancestor layers for overflow clip and intersect them.
+        while (layer) {
+            RenderObject* layerRenderer = layer->renderer();
+
+            if (layerRenderer->hasOverflowClip() && layerRenderer != currentRenderer) {
+                ringRect.move(currentRenderer->offsetFromAncestorContainer(layerRenderer));
+                currentRenderer = layerRenderer;
+
+                ASSERT(layerRenderer->isBox());
+                ringRect.intersect(toRenderBox(layerRenderer)->borderBoxRect());
+
+                if (ringRect.isEmpty())
+                    break;
+            }
+            layer = layer->parent();
+        }
+
+        if (ringRect.isEmpty()) {
+            drawableRects.remove(i);
+            continue;
+        }
+        // After clipping, reset the original position so that parents' transforms apply correctly.
+        ringRect.setLocation(ringRectLocation);
+    }
+
+    Path path;
     for (size_t i = 0; i < drawableRects.size(); ++i) {
         LayoutRect prev = i ? drawableRects.at(i - 1) : LayoutRect();
         LayoutRect next = i < (drawableRects.size() - 1) ? drawableRects.at(i + 1) : LayoutRect();
         addHighlightRect(path, drawableRects.at(i), prev, next);
     }
 
+    path.transform(localToAbsoluteTransform(o));
     return path;
 }
 
@@ -201,14 +241,10 @@ Path pathForNodeHighlight(const Node* node)
 {
     RenderObject* renderer = node->renderer();
 
-    Path path;
     if (!renderer || (!renderer->isBox() && !renderer->isRenderInline()))
-        return path;
-
-    path = pathForRenderer(renderer);
-    path.transform(localToAbsoluteTransform(renderer));
+        return Path();
 
-    return path;
+    return absolutePathForRenderer(renderer);
 }
 
 } // namespace GestureTapHighlighter
diff --git a/Source/WebCore/page/PageGroup.cpp b/Source/WebCore/page/PageGroup.cpp
index f939c9bfd..45d25f552 100644
--- a/Source/WebCore/page/PageGroup.cpp
+++ b/Source/WebCore/page/PageGroup.cpp
@@ -38,7 +38,7 @@
 #include "StorageNamespace.h"
 
 #if PLATFORM(CHROMIUM)
-#include "PlatformSupport.h"
+#include "VisitedLinks.h"
 #endif
 
 namespace WebCore {
@@ -176,7 +176,7 @@ bool PageGroup::isLinkVisited(LinkHash visitedLinkHash)
 {
 #if PLATFORM(CHROMIUM)
     // Use Chromium's built-in visited link database.
-    return PlatformSupport::isLinkVisited(visitedLinkHash);
+    return VisitedLinks::isLinkVisited(visitedLinkHash);
 #else
     if (!m_visitedLinksPopulated) {
         m_visitedLinksPopulated = true;
diff --git a/Source/WebCore/page/TouchAdjustment.cpp b/Source/WebCore/page/TouchAdjustment.cpp
index 587003b2f..cd460c0b7 100644
--- a/Source/WebCore/page/TouchAdjustment.cpp
+++ b/Source/WebCore/page/TouchAdjustment.cpp
@@ -231,7 +231,7 @@ float zoomableIntersectionQuotient(const IntPoint& touchHotspot, const IntRect&
 
     // Check the rectangle is meaningful zoom target. It should at least contain the hotspot.
     if (!rect.contains(touchHotspot))
-        return INFINITY;
+        return std::numeric_limits<float>::infinity();
     IntRect intersection = rect;
     intersection.intersect(touchArea);
 
@@ -246,7 +246,7 @@ float zoomableIntersectionQuotient(const IntPoint& touchHotspot, const IntRect&
 bool findNodeWithLowestDistanceMetric(Node*& targetNode, IntPoint& targetPoint, IntRect& targetArea, const IntPoint& touchHotspot, const IntRect& touchArea, SubtargetGeometryList& subtargets, DistanceFunction distanceFunction)
 {
     targetNode = 0;
-    float bestDistanceMetric = INFINITY;
+    float bestDistanceMetric = std::numeric_limits<float>::infinity();
     SubtargetGeometryList::const_iterator it = subtargets.begin();
     const SubtargetGeometryList::const_iterator end = subtargets.end();
     for (; it != end; ++it) {
diff --git a/Source/WebCore/page/animation/AnimationController.cpp b/Source/WebCore/page/animation/AnimationController.cpp
index 0dc3ea771..2307668dd 100644
--- a/Source/WebCore/page/animation/AnimationController.cpp
+++ b/Source/WebCore/page/animation/AnimationController.cpp
@@ -57,6 +57,7 @@ AnimationControllerPrivate::AnimationControllerPrivate(Frame* frame)
     , m_animationsWaitingForStyle()
     , m_animationsWaitingForStartTimeResponse()
     , m_waitingForAsyncStartNotification(false)
+    , m_previousTimeToNextService(0)
 {
 }
 
@@ -118,7 +119,6 @@ double AnimationControllerPrivate::updateAnimations(SetChanged callSetChanged/*
 
 void AnimationControllerPrivate::updateAnimationTimerForRenderer(RenderObject* renderer)
 {
-    static double previousTimeToNextService = 0;
     double timeToNextService = 0;
 
     RefPtr<CompositeAnimation> compAnim = m_compositeAnimations.get(renderer);
@@ -126,13 +126,13 @@ void AnimationControllerPrivate::updateAnimationTimerForRenderer(RenderObject* r
         timeToNextService = compAnim->timeToNextService();
 
     if (m_animationTimer.isActive()) {
-        if (previousTimeToNextService < timeToNextService)
+        if (m_previousTimeToNextService < timeToNextService)
             return;
 
         m_animationTimer.stop();
     }
 
-    previousTimeToNextService = timeToNextService;
+    m_previousTimeToNextService = timeToNextService;
     m_animationTimer.startOneShot(timeToNextService);
 }
 
@@ -144,6 +144,8 @@ void AnimationControllerPrivate::updateAnimationTimer(SetChanged callSetChanged/
     if (!timeToNextService) {
         if (!m_animationTimer.isActive() || m_animationTimer.repeatInterval() == 0)
             m_animationTimer.startRepeating(cAnimationTimerDelay);
+
+        m_previousTimeToNextService = timeToNextService;
         return;
     }
 
@@ -157,6 +159,7 @@ void AnimationControllerPrivate::updateAnimationTimer(SetChanged callSetChanged/
     // Otherwise, we want to start a one-shot timer so we get here again
     if (m_animationTimer.isActive())
         m_animationTimer.stop();
+    m_previousTimeToNextService = timeToNextService;
     m_animationTimer.startOneShot(timeToNextService);
 }
 
diff --git a/Source/WebCore/page/animation/AnimationControllerPrivate.h b/Source/WebCore/page/animation/AnimationControllerPrivate.h
index 8f3ee7f6c..9a336cd32 100644
--- a/Source/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/Source/WebCore/page/animation/AnimationControllerPrivate.h
@@ -142,6 +142,7 @@ private:
     WaitingAnimationsSet m_animationsWaitingForStyle;
     WaitingAnimationsSet m_animationsWaitingForStartTimeResponse;
     bool m_waitingForAsyncStartNotification;
+    double m_previousTimeToNextService;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
index 9cf96153b..d38bbd5b5 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
@@ -105,34 +105,40 @@ bool ScrollingCoordinator::coordinatesScrollingForFrameView(FrameView* frameView
 #endif
 }
 
-static Region computeNonFastScrollableRegion(Frame* mainFrame)
+static Region computeNonFastScrollableRegion(Frame* frame, const IntPoint& frameLocation)
 {
     Region nonFastScrollableRegion;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return nonFastScrollableRegion;
 
-    for (Frame* frame = mainFrame; frame; frame = frame->tree()->traverseNext()) {
-        FrameView* frameView = frame->view();
-        if (!frameView)
-            continue;
+    IntPoint offset = frameLocation;
+    offset.moveBy(frameView->frameRect().location());
 
-        if (const FrameView::ScrollableAreaSet* scrollableAreas = frameView->scrollableAreas()) {
-            for (FrameView::ScrollableAreaSet::const_iterator it = scrollableAreas->begin(), end = scrollableAreas->end(); it != end; ++it) {
-                ScrollableArea* scrollableArea = *it;
-                nonFastScrollableRegion.unite(scrollableArea->scrollableAreaBoundingBox());
-            }
+    if (const FrameView::ScrollableAreaSet* scrollableAreas = frameView->scrollableAreas()) {
+        for (FrameView::ScrollableAreaSet::const_iterator it = scrollableAreas->begin(), end = scrollableAreas->end(); it != end; ++it) {
+            ScrollableArea* scrollableArea = *it;
+            IntRect box = scrollableArea->scrollableAreaBoundingBox();
+            box.moveBy(offset);
+            nonFastScrollableRegion.unite(box);
         }
+    }
 
-        if (const HashSet<RefPtr<Widget> >* children = frameView->children()) {
-            for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(), end = children->end(); it != end; ++it) {
-                if (!(*it)->isPluginViewBase())
-                    continue;
-                
-                PluginViewBase* pluginViewBase = static_cast<PluginViewBase*>((*it).get());
-                if (pluginViewBase->wantsWheelEvents())
-                    nonFastScrollableRegion.unite(pluginViewBase->frameRect());
-            }
+    if (const HashSet<RefPtr<Widget> >* children = frameView->children()) {
+        for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(), end = children->end(); it != end; ++it) {
+            if (!(*it)->isPluginViewBase())
+                continue;
+
+            PluginViewBase* pluginViewBase = static_cast<PluginViewBase*>((*it).get());
+            if (pluginViewBase->wantsWheelEvents())
+                nonFastScrollableRegion.unite(pluginViewBase->frameRect());
         }
     }
 
+    FrameTree* tree = frame->tree();
+    for (Frame* subFrame = tree->firstChild(); subFrame; subFrame = subFrame->tree()->nextSibling())
+        nonFastScrollableRegion.unite(computeNonFastScrollableRegion(subFrame, offset));
+
     return nonFastScrollableRegion;
 }
 
@@ -144,7 +150,7 @@ void ScrollingCoordinator::frameViewLayoutUpdated(FrameView* frameView)
     // Compute the region of the page that we can't do fast scrolling for. This currently includes
     // all scrollable areas, such as subframes, overflow divs and list boxes. We need to do this even if the
     // frame view whose layout was updated is not the main frame.
-    Region nonFastScrollableRegion = computeNonFastScrollableRegion(m_page->mainFrame());
+    Region nonFastScrollableRegion = computeNonFastScrollableRegion(m_page->mainFrame(), IntPoint());
     setNonFastScrollableRegion(nonFastScrollableRegion);
 
     if (!coordinatesScrollingForFrameView(frameView))
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.cpp b/Source/WebCore/page/scrolling/ScrollingTree.cpp
index af84514e0..36e6aaea3 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTree.cpp
@@ -97,13 +97,6 @@ void ScrollingTree::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
     m_rootNode->handleWheelEvent(wheelEvent);
 }
 
-void ScrollingTree::setMainFrameScrollPosition(const IntPoint& scrollPosition)
-{
-    ASSERT(ScrollingThread::isCurrentThread());
-
-    m_rootNode->setScrollPosition(scrollPosition);
-}
-
 static void derefScrollingCoordinator(ScrollingCoordinator* scrollingCoordinator)
 {
     ASSERT(isMainThread());
@@ -128,9 +121,11 @@ void ScrollingTree::commitNewTreeState(PassOwnPtr<ScrollingTreeState> scrollingT
 {
     ASSERT(ScrollingThread::isCurrentThread());
 
-    if (scrollingTreeState->changedProperties() & (ScrollingTreeState::WheelEventHandlerCount | ScrollingTreeState::NonFastScrollableRegion)) {
+    if (scrollingTreeState->changedProperties() & (ScrollingTreeState::WheelEventHandlerCount | ScrollingTreeState::NonFastScrollableRegion | ScrollingTreeState::ScrollLayer)) {
         MutexLocker lock(m_mutex);
 
+        if (scrollingTreeState->changedProperties() & ScrollingTreeState::ScrollLayer)
+            m_mainFrameScrollPosition = IntPoint();
         if (scrollingTreeState->changedProperties() & ScrollingTreeState::WheelEventHandlerCount)
             m_hasWheelEventHandlers = scrollingTreeState->wheelEventHandlerCount();
         if (scrollingTreeState->changedProperties() & ScrollingTreeState::NonFastScrollableRegion)
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.h b/Source/WebCore/page/scrolling/ScrollingTree.h
index 82b7c2405..ef7792637 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.h
+++ b/Source/WebCore/page/scrolling/ScrollingTree.h
@@ -75,8 +75,6 @@ public:
     // Must be called from the scrolling thread. Handles the wheel event.
     void handleWheelEvent(const PlatformWheelEvent&);
 
-    void setMainFrameScrollPosition(const IntPoint&);
-
     void invalidate();
     void commitNewTreeState(PassOwnPtr<ScrollingTreeState>);
 
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
index f056ff9f0..8a1576e7a 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
@@ -45,7 +45,6 @@ private:
     // ScrollingTreeNode member functions.
     virtual void update(ScrollingTreeState*) OVERRIDE;
     virtual void handleWheelEvent(const PlatformWheelEvent&) OVERRIDE;
-    virtual void setScrollPosition(const IntPoint&) OVERRIDE;
 
     // ScrollElasticityController member functions.
     virtual bool allowsHorizontalStretching() OVERRIDE;
@@ -62,6 +61,9 @@ private:
     virtual void stopSnapRubberbandTimer() OVERRIDE;
 
     IntPoint scrollPosition() const;
+    void setScrollPosition(const IntPoint&);
+    void setScrollPositionWithoutContentEdgeConstraints(const IntPoint&);
+
     void setScrollLayerPosition(const IntPoint&);
 
     IntPoint minimumScrollPosition() const;
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
index b87e446d9..a37bf40c1 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
@@ -85,20 +85,6 @@ void ScrollingTreeNodeMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent
     scrollingTree()->handleWheelEventPhase(wheelEvent.phase());
 }
 
-void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& scrollPosition)
-{
-    updateMainFramePinState(scrollPosition);
-
-    if (shouldUpdateScrollLayerPositionOnMainThread()) {
-        m_probableMainThreadScrollPosition = scrollPosition;
-        scrollingTree()->updateMainFrameScrollPositionAndScrollLayerPosition(scrollPosition);
-        return;
-    }
-
-    setScrollLayerPosition(scrollPosition);
-    scrollingTree()->updateMainFrameScrollPosition(scrollPosition);
-}
-
 bool ScrollingTreeNodeMac::allowsHorizontalStretching()
 {
     switch (horizontalScrollElasticity()) {
@@ -240,6 +226,29 @@ IntPoint ScrollingTreeNodeMac::scrollPosition() const
     return IntPoint(-scrollLayerPosition.x + scrollOrigin().x(), -scrollLayerPosition.y + scrollOrigin().y());
 }
 
+void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& scrollPosition)
+{
+    IntPoint newScrollPosition = scrollPosition;
+    newScrollPosition = newScrollPosition.shrunkTo(maximumScrollPosition());
+    newScrollPosition = newScrollPosition.expandedTo(minimumScrollPosition());
+
+    setScrollPositionWithoutContentEdgeConstraints(newScrollPosition);
+}
+
+void ScrollingTreeNodeMac::setScrollPositionWithoutContentEdgeConstraints(const IntPoint& scrollPosition)
+{
+    updateMainFramePinState(scrollPosition);
+
+    if (shouldUpdateScrollLayerPositionOnMainThread()) {
+        m_probableMainThreadScrollPosition = scrollPosition;
+        scrollingTree()->updateMainFrameScrollPositionAndScrollLayerPosition(scrollPosition);
+        return;
+    }
+
+    setScrollLayerPosition(scrollPosition);
+    scrollingTree()->updateMainFrameScrollPosition(scrollPosition);
+}
+
 void ScrollingTreeNodeMac::setScrollLayerPosition(const IntPoint& position)
 {
     ASSERT(!shouldUpdateScrollLayerPositionOnMainThread());
@@ -263,16 +272,12 @@ IntPoint ScrollingTreeNodeMac::maximumScrollPosition() const
 
 void ScrollingTreeNodeMac::scrollBy(const IntSize& offset)
 {
-    IntPoint newScrollPosition = scrollPosition() + offset;
-    newScrollPosition = newScrollPosition.shrunkTo(maximumScrollPosition());
-    newScrollPosition = newScrollPosition.expandedTo(minimumScrollPosition());
-
-    setScrollPosition(newScrollPosition);
+    setScrollPosition(scrollPosition() + offset);
 }
 
 void ScrollingTreeNodeMac::scrollByWithoutContentEdgeConstraints(const IntSize& offset)
 {
-    setScrollPosition(scrollPosition() + offset);
+    setScrollPositionWithoutContentEdgeConstraints(scrollPosition() + offset);
 }
 
 void ScrollingTreeNodeMac::updateMainFramePinState(const IntPoint& scrollPosition)
diff --git a/Source/WebCore/platform/AsyncFileSystem.h b/Source/WebCore/platform/AsyncFileSystem.h
index 6e53a9aa5..c33d6a0f2 100644
--- a/Source/WebCore/platform/AsyncFileSystem.h
+++ b/Source/WebCore/platform/AsyncFileSystem.h
@@ -127,6 +127,8 @@ public:
     // while in remote filesystem case the backend may download the file into a temporary snapshot file and return the metadata of the temporary file.
     // AsyncFileSystemCallbacks::didReadMetadata() is called when the metadata for the snapshot file is successfully returned.
     // AsyncFileSystemCallbacks::didFail() is called otherwise.
+    //
+    // Note: the returned metadata info is cached in the File object for non-regular filesystem types (neither Temporary nor Persistent). The port could return valid metadata if it wants File object to cache metadata (e.g. if the file body is on a remote server), but otherwise should NOT return valid metadata.
     virtual void createSnapshotFileAndReadMetadata(const KURL& path, PassOwnPtr<AsyncFileSystemCallbacks>) = 0;
 
 protected:
diff --git a/Source/WebCore/platform/CalculationValue.h b/Source/WebCore/platform/CalculationValue.h
index 9339b105f..9be00e92d 100755
--- a/Source/WebCore/platform/CalculationValue.h
+++ b/Source/WebCore/platform/CalculationValue.h
@@ -51,20 +51,43 @@ enum CalculationPermittedValueRange {
     CalculationRangeAll,
     CalculationRangeNonNegative
 };
+
+enum CalcExpressionNodeType {
+    CalcExpressionNodeUndefined,
+    CalcExpressionNodeNumber,
+    CalcExpressionNodeLength,
+    CalcExpressionNodeBinaryOperation
+};
         
 class CalcExpressionNode {
 public:
+    CalcExpressionNode()
+        : m_type(CalcExpressionNodeUndefined)
+    {
+    }
+    
     virtual ~CalcExpressionNode()
     {
     }
     
     virtual float evaluate(float maxValue) const = 0;
+    virtual bool operator==(const CalcExpressionNode&) const = 0;
+
+    CalcExpressionNodeType type() const { return m_type; }
+    
+protected:
+    CalcExpressionNodeType m_type;
 };
     
 class CalculationValue : public RefCounted<CalculationValue> {
 public:
     static PassRefPtr<CalculationValue> create(PassOwnPtr<CalcExpressionNode> value, CalculationPermittedValueRange);
     float evaluate(float maxValue) const;
+
+    bool operator==(const CalculationValue& o) const 
+    { 
+        return m_value == o.m_value || *(m_value.get()) == *(o.m_value.get());
+    }
     
 private:
     CalculationValue(PassOwnPtr<CalcExpressionNode> value, CalculationPermittedValueRange range)
@@ -82,8 +105,19 @@ public:
     explicit CalcExpressionNumber(float value)
         : m_value(value)
     {
+        m_type = CalcExpressionNodeNumber;
     }
 
+    bool operator==(const CalcExpressionNumber& o) const
+    {
+        return m_value == o.m_value;
+    }
+
+    virtual bool operator==(const CalcExpressionNode& o) const
+    {
+        return type() == o.type() && *this == static_cast<const CalcExpressionNumber&>(o);
+    }
+    
     virtual float evaluate(float) const 
     {
         return m_value;
@@ -98,8 +132,19 @@ public:
     explicit CalcExpressionLength(Length length)
         : m_length(length)
     {
+        m_type = CalcExpressionNodeLength;
     }
 
+    bool operator==(const CalcExpressionLength& o) const
+    {
+        return m_length == o.m_length;
+    }
+    
+    virtual bool operator==(const CalcExpressionNode& o) const
+    {
+        return type() == o.type() && *this == static_cast<const CalcExpressionLength&>(o);
+    }
+    
     virtual float evaluate(float maxValue) const
     {
         return floatValueForLength(m_length, maxValue);
@@ -116,8 +161,20 @@ public:
         , m_rightSide(rightSide)
         , m_operator(op)
     {
+        m_type = CalcExpressionNodeBinaryOperation;
     }
 
+    bool operator==(const CalcExpressionBinaryOperation& o) const
+    {
+        return m_operator == o.m_operator && *m_leftSide == *o.m_leftSide && *m_rightSide == *o.m_rightSide;
+    }
+
+    virtual bool operator==(const CalcExpressionNode& o) const
+    {
+        return type() == o.type() && *this == static_cast<const CalcExpressionBinaryOperation&>(o);
+    }
+    
+    
     virtual float evaluate(float) const;
 
 private:
diff --git a/Source/WebCore/platform/DragData.cpp b/Source/WebCore/platform/DragData.cpp
index a61feab5a..efb705a46 100644
--- a/Source/WebCore/platform/DragData.cpp
+++ b/Source/WebCore/platform/DragData.cpp
@@ -25,6 +25,8 @@
 
 #include "config.h"
 #include "DragData.h"
+#include "PlatformEvent.h"
+#include "PlatformKeyboardEvent.h"
 
 #if ENABLE(DRAG_SUPPORT)
 namespace WebCore {
@@ -51,6 +53,26 @@ DragData::DragData(const String&, const IntPoint& clientPosition, const IntPoint
 }
 #endif
 
+#if !PLATFORM(CHROMIUM)
+int DragData::modifierKeyState() const
+{
+    bool shiftKey, ctrlKey, altKey, metaKey;
+    shiftKey = ctrlKey = altKey = metaKey = false;
+    PlatformKeyboardEvent::getCurrentModifierState(shiftKey, ctrlKey, altKey, metaKey);
+    int keyState = 0;
+    if (shiftKey)
+        keyState = keyState | PlatformEvent::ShiftKey;
+    if (ctrlKey)
+        keyState = keyState | PlatformEvent::CtrlKey;
+    if (altKey)
+        keyState = keyState | PlatformEvent::AltKey;
+    if (metaKey)
+        keyState = keyState | PlatformEvent::MetaKey;
+    return keyState;
+}
+#endif
+
+
 } // namespace WebCore
 
 #endif // ENABLE(DRAG_SUPPORT)
diff --git a/Source/WebCore/platform/DragData.h b/Source/WebCore/platform/DragData.h
index 823ac553e..e13333e33 100644
--- a/Source/WebCore/platform/DragData.h
+++ b/Source/WebCore/platform/DragData.h
@@ -118,6 +118,7 @@ public:
     bool containsColor() const;
     bool containsFiles() const;
     unsigned numberOfFiles() const;
+    int modifierKeyState() const;
 #if PLATFORM(MAC)
     const String& pasteboardName() { return m_pasteboardName; }
 #endif
diff --git a/Source/WebCore/platform/FractionalLayoutUnit.h b/Source/WebCore/platform/FractionalLayoutUnit.h
index 1899b992f..79d3746f0 100644
--- a/Source/WebCore/platform/FractionalLayoutUnit.h
+++ b/Source/WebCore/platform/FractionalLayoutUnit.h
@@ -36,6 +36,10 @@
 #include <math.h>
 #include <stdlib.h>
 
+#if PLATFORM(QT)
+#include <QDataStream>
+#endif
+
 namespace WebCore {
 
 #ifdef NDEBUG
@@ -66,63 +70,63 @@ public:
     // However due to compiler and platform differences adding those are non-trivial.
     // See https://bugs.webkit.org/show_bug.cgi?id=83848 for details.
     
-    inline FractionalLayoutUnit() : m_value(0) { }
+    FractionalLayoutUnit() : m_value(0) { }
 #if ENABLE(SUBPIXEL_LAYOUT)
-    inline FractionalLayoutUnit(int value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
-    inline FractionalLayoutUnit(unsigned short value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
-    inline FractionalLayoutUnit(unsigned int value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
-    inline FractionalLayoutUnit(float value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
-    inline FractionalLayoutUnit(double value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(int value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(unsigned short value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(unsigned int value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(float value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(double value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value * kFixedPointDenominator; }
 #else
-    inline FractionalLayoutUnit(int value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
-    inline FractionalLayoutUnit(unsigned short value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
-    inline FractionalLayoutUnit(unsigned int value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
-    inline FractionalLayoutUnit(float value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
-    inline FractionalLayoutUnit(double value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
+    FractionalLayoutUnit(int value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
+    FractionalLayoutUnit(unsigned short value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
+    FractionalLayoutUnit(unsigned int value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
+    FractionalLayoutUnit(float value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
+    FractionalLayoutUnit(double value) { REPORT_OVERFLOW(isInBounds(value)); m_value = value; }
 #endif
-    inline FractionalLayoutUnit(const FractionalLayoutUnit& value) { m_value = value.rawValue(); }
+    FractionalLayoutUnit(const FractionalLayoutUnit& value) { m_value = value.rawValue(); }
 
 #if ENABLE(SUBPIXEL_LAYOUT)
-    inline int toInt() const { return m_value / kFixedPointDenominator; }
-    inline float toFloat() const { return static_cast<float>(m_value) / kFixedPointDenominator; }
-    inline double toDouble() const { return static_cast<double>(m_value) / kFixedPointDenominator; }
+    int toInt() const { return m_value / kFixedPointDenominator; }
+    float toFloat() const { return static_cast<float>(m_value) / kFixedPointDenominator; }
+    double toDouble() const { return static_cast<double>(m_value) / kFixedPointDenominator; }
 #else
-    inline int toInt() const { return m_value; }
-    inline float toFloat() const { return static_cast<float>(m_value); }
-    inline double toDouble() const { return static_cast<double>(m_value); }
+    int toInt() const { return m_value; }
+    float toFloat() const { return static_cast<float>(m_value); }
+    double toDouble() const { return static_cast<double>(m_value); }
 #endif
-    inline unsigned toUnsigned() const { REPORT_OVERFLOW(m_value >= 0); return toInt(); }
+    unsigned toUnsigned() const { REPORT_OVERFLOW(m_value >= 0); return toInt(); }
 
-    inline operator int() const { return toInt(); }
-    inline operator unsigned() const { return toUnsigned(); }
-    inline operator float() const { return toFloat(); }
-    inline operator double() const { return toDouble(); }
-    inline operator bool() const { return m_value; }
+    operator int() const { return toInt(); }
+    operator unsigned() const { return toUnsigned(); }
+    operator float() const { return toFloat(); }
+    operator double() const { return toDouble(); }
+    operator bool() const { return m_value; }
 
-    inline FractionalLayoutUnit operator++(int)
+    FractionalLayoutUnit operator++(int)
     {
         m_value += kFixedPointDenominator;
         return *this;
     }
 
-    inline int rawValue() const { return m_value; }
-    inline void setRawValue(int value) { m_value = value; }
-    inline void setRawValue(long long value)
+    int rawValue() const { return m_value; }
+    void setRawValue(int value) { m_value = value; }
+    void setRawValue(long long value)
     {
         REPORT_OVERFLOW(value > std::numeric_limits<int>::min() && value < std::numeric_limits<int>::max());
         m_value = static_cast<int>(value);
     }
 
-    inline FractionalLayoutUnit abs() const
+    FractionalLayoutUnit abs() const
     {
         FractionalLayoutUnit returnValue;
         returnValue.setRawValue(::abs(m_value));
         return returnValue;
     }
 #if OS(DARWIN)
-    inline int wtf_ceil() const
+    int wtf_ceil() const
 #else
-    inline int ceil() const
+    int ceil() const
 #endif
     {
 #if ENABLE(SUBPIXEL_LAYOUT)
@@ -133,7 +137,7 @@ public:
         return m_value;
 #endif
     }
-    inline int round() const
+    int round() const
     {
 #if ENABLE(SUBPIXEL_LAYOUT)
         if (m_value > 0)
@@ -144,7 +148,7 @@ public:
 #endif
     }
 
-    inline int floor() const
+    int floor() const
     {
         return toInt();
     }
@@ -164,15 +168,15 @@ public:
     }
     
 private:
-    inline bool isInBounds(int value)
+    bool isInBounds(int value)
     {
         return ::abs(value) <= std::numeric_limits<int>::max() / kFixedPointDenominator;
     }
-    inline bool isInBounds(unsigned value)
+    bool isInBounds(unsigned value)
     {
         return value <= static_cast<unsigned>(std::numeric_limits<int>::max()) / kFixedPointDenominator;
     }
-    inline bool isInBounds(double value)
+    bool isInBounds(double value)
     {
         return ::fabs(value) <= std::numeric_limits<int>::max() / kFixedPointDenominator;
     }
@@ -590,6 +594,26 @@ inline int snapSizeToPixel(FractionalLayoutUnit size, FractionalLayoutUnit locat
     return (location + size).round() - location.round();
 }
 
+#if PLATFORM(QT)
+inline QDataStream& operator<<(QDataStream& stream, const FractionalLayoutUnit& value)
+{
+    if (kFixedPointDenominator == 1)
+        stream << value.rawValue();
+    else
+        stream << QString::fromLatin1("%1").arg(value.toFloat(), 0, 'f', 2);
+
+    return stream;
+}
+
+inline QDataStream& operator>>(QDataStream& stream, FractionalLayoutUnit& value)
+{
+    float v;
+    stream >> v;
+    value = v;
+    return stream;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // FractionalLayoutUnit_h
diff --git a/Source/WebCore/platform/Length.cpp b/Source/WebCore/platform/Length.cpp
index 5166c0d16..3811d4db6 100644
--- a/Source/WebCore/platform/Length.cpp
+++ b/Source/WebCore/platform/Length.cpp
@@ -232,6 +232,11 @@ float Length::nonNanCalculatedValue(int maxValue) const
     return result;
 }
 
+bool Length::isCalculatedEqual(const Length& o) const
+{
+    return isCalculated() && (calculationValue() == o.calculationValue() || *calculationValue() == *o.calculationValue());
+}
+
 class SameSizeAsLength {
     int32_t value;
     int32_t metaData;
diff --git a/Source/WebCore/platform/Length.h b/Source/WebCore/platform/Length.h
index 0c963dd85..e6cc02d57 100644
--- a/Source/WebCore/platform/Length.h
+++ b/Source/WebCore/platform/Length.h
@@ -49,21 +49,25 @@ public:
     Length(LengthType t)
         : m_intValue(0), m_quirk(false), m_type(t), m_isFloat(false)
     {
+        ASSERT(t != Calculated);
     }
 
     Length(int v, LengthType t, bool q = false)
         : m_intValue(v), m_quirk(q), m_type(t), m_isFloat(false)
     {
+        ASSERT(t != Calculated);
     }
     
     Length(FractionalLayoutUnit v, LengthType t, bool q = false)
         : m_floatValue(v.toFloat()), m_quirk(q), m_type(t), m_isFloat(true)
     {
+        ASSERT(t != Calculated);
     }
     
     Length(float v, LengthType t, bool q = false)
-    : m_floatValue(v), m_quirk(q), m_type(t), m_isFloat(true)
+        : m_floatValue(v), m_quirk(q), m_type(t), m_isFloat(true)
     {
+        ASSERT(t != Calculated);
     }
 
     Length(double v, LengthType t, bool q = false)
@@ -91,7 +95,7 @@ public:
             decrementCalculatedRef();
     }  
     
-    bool operator==(const Length& o) const { return (m_type == o.m_type) && (m_quirk == o.m_quirk) && (isUndefined() || (getFloatValue() == o.getFloatValue())); }
+    bool operator==(const Length& o) const { return (m_type == o.m_type) && (m_quirk == o.m_quirk) && (isUndefined() || (getFloatValue() == o.getFloatValue()) || isCalculatedEqual(o)); }
     bool operator!=(const Length& o) const { return !(*this == o); }
 
     const Length& operator*=(float v)
@@ -212,6 +216,7 @@ public:
     bool isIntrinsicOrAuto() const { return type() == Auto || type() == MinIntrinsic || type() == Intrinsic; }
     bool isSpecified() const { return type() == Fixed || type() == Percent || type() == Calculated || isViewportPercentage(); }
     bool isCalculated() const { return type() == Calculated; }
+    bool isCalculatedEqual(const Length&) const;
 
     Length blend(const Length& from, double progress) const
     {
@@ -221,6 +226,10 @@ public:
 
         if (from.isZero() && isZero())
             return *this;
+
+        // FIXME http://webkit.org/b/86160 - Blending doesn't work with calculated expressions
+        if (type() == Calculated)
+            return *this;
         
         LengthType resultType = type();
         if (isZero())
diff --git a/Source/WebCore/platform/PlatformGestureEvent.h b/Source/WebCore/platform/PlatformGestureEvent.h
index 8c08862c5..ed557c178 100644
--- a/Source/WebCore/platform/PlatformGestureEvent.h
+++ b/Source/WebCore/platform/PlatformGestureEvent.h
@@ -41,31 +41,25 @@ public:
         : PlatformEvent(PlatformEvent::GestureScrollBegin)
         , m_deltaX(0)
         , m_deltaY(0)
-        , m_gammaX(0)
-        , m_gammaY(0)
     {
     }
 
-    PlatformGestureEvent(Type type, const IntPoint& position, const IntPoint& globalPosition, double timestamp, float deltaX, float deltaY, float gammaX, float gammaY, bool shiftKey, bool ctrlKey, bool altKey, bool metaKey)
+    PlatformGestureEvent(Type type, const IntPoint& position, const IntPoint& globalPosition, double timestamp, float deltaX, float deltaY, bool shiftKey, bool ctrlKey, bool altKey, bool metaKey)
         : PlatformEvent(type, shiftKey, ctrlKey, altKey, metaKey, timestamp)
         , m_position(position)
         , m_globalPosition(globalPosition)
         , m_deltaX(deltaX)
         , m_deltaY(deltaY)
-        , m_gammaX(gammaX)
-        , m_gammaY(gammaY)
     {
     }
 
-    PlatformGestureEvent(Type type, const IntPoint& position, const IntPoint& globalPosition, double timestamp, const IntSize& area, const FloatPoint& delta, const FloatPoint& gamma, bool shiftKey, bool ctrlKey, bool altKey, bool metaKey)
+    PlatformGestureEvent(Type type, const IntPoint& position, const IntPoint& globalPosition, double timestamp, const IntSize& area, const FloatPoint& delta, bool shiftKey, bool ctrlKey, bool altKey, bool metaKey)
         : PlatformEvent(type, shiftKey, ctrlKey, altKey, metaKey, timestamp)
         , m_position(position)
         , m_globalPosition(globalPosition)
         , m_area(area)
         , m_deltaX(delta.x())
         , m_deltaY(delta.y())
-        , m_gammaX(gamma.x())
-        , m_gammaY(gamma.y())
     {
     }
 
@@ -76,9 +70,6 @@ public:
 
     float deltaX() const { return m_deltaX; }
     float deltaY() const { return m_deltaY; }
-
-    float gammaX() const { return m_gammaX; }
-    float gammaY() const { return m_gammaY; }
     
 protected:
     IntPoint m_position;
@@ -86,8 +77,6 @@ protected:
     IntSize m_area;
     float m_deltaX;
     float m_deltaY;
-    float m_gammaX;
-    float m_gammaY;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/PlatformWheelEvent.h b/Source/WebCore/platform/PlatformWheelEvent.h
index 084b45553..279e1cf23 100644
--- a/Source/WebCore/platform/PlatformWheelEvent.h
+++ b/Source/WebCore/platform/PlatformWheelEvent.h
@@ -94,6 +94,9 @@ namespace WebCore {
             , m_hasPreciseScrollingDeltas(false)
             , m_phase(PlatformWheelEventPhaseNone)
             , m_momentumPhase(PlatformWheelEventPhaseNone)
+            , m_scrollCount(0)
+            , m_unacceleratedScrollingDeltaX(0)
+            , m_unacceleratedScrollingDeltaY(0)
 #endif
         {
         }
@@ -112,6 +115,9 @@ namespace WebCore {
             , m_hasPreciseScrollingDeltas(false)
             , m_phase(PlatformWheelEventPhaseNone)
             , m_momentumPhase(PlatformWheelEventPhaseNone)
+            , m_scrollCount(0)
+            , m_unacceleratedScrollingDeltaX(0)
+            , m_unacceleratedScrollingDeltaY(0)
 #endif
         {
         }
@@ -153,6 +159,10 @@ namespace WebCore {
         PlatformWheelEventPhase phase() const { return m_phase; }
         PlatformWheelEventPhase momentumPhase() const { return m_momentumPhase; }
         bool hasPreciseScrollingDeltas() const { return m_hasPreciseScrollingDeltas; }
+
+        unsigned scrollCount() const { return m_scrollCount; }
+        float unacceleratedScrollingDeltaX() const { return m_unacceleratedScrollingDeltaX; }
+        float unacceleratedScrollingDeltaY() const { return m_unacceleratedScrollingDeltaY; }
 #endif
 
 #if PLATFORM(WIN)
@@ -181,6 +191,9 @@ namespace WebCore {
         bool m_hasPreciseScrollingDeltas;
         PlatformWheelEventPhase m_phase;
         PlatformWheelEventPhase m_momentumPhase;
+        unsigned m_scrollCount;
+        float m_unacceleratedScrollingDeltaX;
+        float m_unacceleratedScrollingDeltaY;
 #endif
     };
 
diff --git a/Source/WebCore/platform/PrerenderHandle.h b/Source/WebCore/platform/PrerenderHandle.h
new file mode 100644
index 000000000..04fdafcf4
--- /dev/null
+++ b/Source/WebCore/platform/PrerenderHandle.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef PrerenderHandle_h
+#define PrerenderHandle_h
+
+#if ENABLE(LINK_PRERENDER)
+
+#include "ReferrerPolicy.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class KURL;
+class Prerender;
+
+class PrerenderHandle : public RefCounted<PrerenderHandle> {
+    WTF_MAKE_NONCOPYABLE(PrerenderHandle);
+public:
+    static PassRefPtr<PrerenderHandle> create(const KURL&, const String& referrer, ReferrerPolicy);
+    ~PrerenderHandle();
+
+    Prerender* prerender();
+
+    // FIXME: one day there will be events here, and we will be a PrerenderClient.
+
+    // A prerender link element is added when it is inserted into a document.
+    void add();
+
+    // A prerender is abandoned when it's navigated away from. This is is a weaker signal
+    // than cancel(), since the launcher hasn't indicated that the prerender isn't wanted,
+    // and we may end up using it after, for instance, a short redirect chain.
+    void abandon();
+
+    // A prerender is canceled when it is removed from a document.
+    void cancel();
+
+    // A prerender is suspended along with the DOM containing its linkloader & prerenderer.
+    void suspend();
+    void resume();
+
+    const KURL& url() const;
+    const String& referrer() const;
+    ReferrerPolicy referrerPolicy() const;
+
+private:
+    PrerenderHandle(const KURL&, const String& referrer, ReferrerPolicy);
+    RefPtr<Prerender> m_prerender;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(LINK_PRERENDER)
+
+#endif // PrerenderHandle_h
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index b982d4dce..a8fe5abe0 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -371,6 +371,12 @@ void ScrollView::scrollTo(const IntSize& newOffset)
         return;
 
     repaintFixedElementsAfterScrolling();
+#if USE(TILED_BACKING_STORE)
+    if (delegatesScrolling()) {
+        hostWindow()->delegatedScrollRequested(IntPoint(newOffset));
+        return;
+    }
+#endif
     scrollContents(scrollDelta);
     updateFixedElementsAfterScrolling();
 }
@@ -453,7 +459,7 @@ static const unsigned cMaxUpdateScrollbarsPass = 2;
 
 void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 {
-    if (m_inUpdateScrollbars || prohibitsScrolling() || delegatesScrolling() || platformWidget())
+    if (m_inUpdateScrollbars || prohibitsScrolling() || platformWidget())
         return;
 
     // If we came in here with the view already needing a layout, then go ahead and do that
diff --git a/Source/WebCore/platform/ScrollView.h b/Source/WebCore/platform/ScrollView.h
index ec03125cd..07ffb3f21 100644
--- a/Source/WebCore/platform/ScrollView.h
+++ b/Source/WebCore/platform/ScrollView.h
@@ -313,6 +313,9 @@ protected:
     virtual bool isVerticalDocument() const { return true; }
     virtual bool isFlippedDocument() const { return false; }
 
+    // Called to update the scrollbars to accurately reflect the state of the view.
+    void updateScrollbars(const IntSize& desiredOffset);
+
 private:
     RefPtr<Scrollbar> m_horizontalScrollbar;
     RefPtr<Scrollbar> m_verticalScrollbar;
@@ -355,8 +358,6 @@ private:
     void init();
     void destroy();
 
-    // Called to update the scrollbars to accurately reflect the state of the view.
-    void updateScrollbars(const IntSize& desiredOffset);
     IntRect rectToCopyOnScroll() const;
 
     // Called when the scroll position within this view changes.  FrameView overrides this to generate repaint invalidations.
diff --git a/Source/WebCore/platform/SharedBufferChunkReader.cpp b/Source/WebCore/platform/SharedBufferChunkReader.cpp
index ed1bd90ef..08feb3280 100644
--- a/Source/WebCore/platform/SharedBufferChunkReader.cpp
+++ b/Source/WebCore/platform/SharedBufferChunkReader.cpp
@@ -118,7 +118,7 @@ String SharedBufferChunkReader::nextChunkAsUTF8StringWithLatin1Fallback(bool inc
     if (!nextChunk(data, includeSeparator))
         return String();
 
-    return data.size() ? String::fromUTF8WithLatin1Fallback(data.data(), data.size()) : String("");
+    return data.size() ? String::fromUTF8WithLatin1Fallback(data.data(), data.size()) : emptyString();
 }
 
 size_t SharedBufferChunkReader::peek(Vector<char>& data, size_t requestedSize)
diff --git a/Source/WebCore/platform/VisitedLinks.cpp b/Source/WebCore/platform/VisitedLinks.cpp
new file mode 100644
index 000000000..a25f308fc
--- /dev/null
+++ b/Source/WebCore/platform/VisitedLinks.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "VisitedLinks.h"
+
+namespace WebCore {
+
+bool VisitedLinks::isLinkVisited(LinkHash)
+{
+    return false;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/VisitedLinks.h b/Source/WebCore/platform/VisitedLinks.h
new file mode 100644
index 000000000..e52aa4271
--- /dev/null
+++ b/Source/WebCore/platform/VisitedLinks.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef VisitedLinks_h
+#define VisitedLinks_h
+
+#include "LinkHash.h"
+
+namespace WebCore {
+
+class VisitedLinks {
+public:
+    static bool isLinkVisited(LinkHash);
+};
+
+} // namespace WebCore
+
+#endif // VisitedLinks_h
diff --git a/Source/WebCore/platform/blackberry/AsyncFileSystemBlackBerry.cpp b/Source/WebCore/platform/blackberry/AsyncFileSystemBlackBerry.cpp
index 71601ec7a..862c783b8 100644
--- a/Source/WebCore/platform/blackberry/AsyncFileSystemBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/AsyncFileSystemBlackBerry.cpp
@@ -40,7 +40,7 @@ PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create()
     return adoptPtr(new AsyncFileSystemBlackBerry());
 }
 
-void AsyncFileSystem::openFileSystem(const KURL& basePath, const String& storageIdentifier, bool, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void AsyncFileSystem::openFileSystem(const String& basePath, const String& storageIdentifier, bool, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
     UNUSED_PARAM(basePath);
     UNUSED_PARAM(storageIdentifier);
diff --git a/Source/WebCore/platform/blackberry/ContextMenuBlackBerry.cpp b/Source/WebCore/platform/blackberry/ContextMenuBlackBerry.cpp
index acb2a5ebd..1878138fb 100644
--- a/Source/WebCore/platform/blackberry/ContextMenuBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/ContextMenuBlackBerry.cpp
@@ -43,4 +43,10 @@ void ContextMenu::setPlatformDescription(void*)
     notImplemented();
 }
 
+unsigned ContextMenu::itemCount() const
+{
+    notImplemented();
+    return 0;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieManager.cpp b/Source/WebCore/platform/blackberry/CookieManager.cpp
index dd72e6794..6a99d2d9a 100644
--- a/Source/WebCore/platform/blackberry/CookieManager.cpp
+++ b/Source/WebCore/platform/blackberry/CookieManager.cpp
@@ -138,61 +138,9 @@ void CookieManager::setCookies(const KURL& url, const String& value)
     Vector<ParsedCookie*> cookies = parser.parse(value);
 
     for (size_t i = 0; i < cookies.size(); ++i) {
-        ParsedCookie* cookie = cookies[i];
-        if (!shouldRejectForSecurityReason(cookie, url)) {
-            BackingStoreRemovalPolicy treatment = m_privateMode ? DoNotRemoveFromBackingStore : RemoveFromBackingStore;
-            checkAndTreatCookie(cookie, treatment);
-        } else
-            delete cookie;
-    }
-}
-
-bool CookieManager::shouldRejectForSecurityReason(const ParsedCookie* cookie, const KURL& url)
-{
-    // We have to disable the following check because sites like Facebook and
-    // Gmail currently do not follow the spec.
-#if 0
-    // Check if path attribute is a prefix of the request URI.
-    if (!url.path().startsWith(cookie->path())) {
-        LOG_ERROR("Cookie %s is rejected because its path does not math the URL %s\n", cookie->toString().utf8().data(), url.string().utf8().data());
-        return true;
-    }
-#endif
-
-    // ignore domain security if protocol doesn't have domains
-    if (shouldIgnoreDomain(cookie->protocol()))
-        return false;
-
-    // Reject Cookie if domain is empty
-    if (!cookie->domain().length())
-        return true;
-
-    // If an explicitly specified value does not start with a dot, the user agent supplies. (RFC 2965 3.2.2)
-    // Domain: Defaults to the effective request-host. There is no dot at the beginning of request-host. (RFC 2965 3.3.1)
-    if (cookie->domain()[0] == '.') {
-        // Check if the domain contains an embedded dot.
-        size_t dotPosition = cookie->domain().find(".", 1);
-        if (dotPosition == notFound || dotPosition == cookie->domain().length()) {
-            LOG_ERROR("Cookie %s is rejected because its domain does not contain an embedded dot.\n", cookie->toString().utf8().data());
-            return true;
-        }
+        BackingStoreRemovalPolicy treatment = m_privateMode ? DoNotRemoveFromBackingStore : RemoveFromBackingStore;
+        checkAndTreatCookie(cookies[i], treatment);
     }
-
-    // The request host should domain match the Domain attribute.
-    // Domain string starts with a dot, so a.b.com should domain match .a.b.com.
-    // add a "." at beginning of host name, because it can handle many cases such as
-    // a.b.com matches b.com, a.b.com matches .B.com and a.b.com matches .A.b.Com
-    // and so on.
-    String hostDomainName = url.host();
-    hostDomainName = hostDomainName.startsWith('.') ? hostDomainName : "." + hostDomainName;
-    if (!hostDomainName.endsWith(cookie->domain(), false)) {
-        LOG_ERROR("Cookie %s is rejected because its domain does not domain match the URL %s\n", cookie->toString().utf8().data(), url.string().utf8().data());
-        return true;
-    }
-    // We should check for an embedded dot in the portion of string in the host not in the domain
-    // but to match firefox behaviour we do not.
-
-    return false;
 }
 
 String CookieManager::getCookie(const KURL& url, CookieFilter filter) const
diff --git a/Source/WebCore/platform/blackberry/CookieManager.h b/Source/WebCore/platform/blackberry/CookieManager.h
index 904551eba..0614e7d33 100644
--- a/Source/WebCore/platform/blackberry/CookieManager.h
+++ b/Source/WebCore/platform/blackberry/CookieManager.h
@@ -119,8 +119,6 @@ private:
 
     void checkAndTreatCookie(ParsedCookie*, BackingStoreRemovalPolicy);
 
-    bool shouldRejectForSecurityReason(const ParsedCookie*, const KURL&);
-
     void addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore);
 
     CookieMap* findOrCreateCookieMap(CookieMap* protocolMap, const String& domain, bool findOnly);
diff --git a/Source/WebCore/platform/blackberry/CookieParser.cpp b/Source/WebCore/platform/blackberry/CookieParser.cpp
index e089da095..91babc2a1 100644
--- a/Source/WebCore/platform/blackberry/CookieParser.cpp
+++ b/Source/WebCore/platform/blackberry/CookieParser.cpp
@@ -230,6 +230,15 @@ ParsedCookie* CookieParser::parseOneCookie(const String& cookie, unsigned start,
                 // The path attribute may or may not include percent-encoded characters. Fortunately
                 // if there are no percent-encoded characters, decoding the url is a no-op.
                 res->setPath(decodeURLEscapeSequences(parsedValue));
+
+                // We have to disable the following check because sites like Facebook and
+                // Gmail currently do not follow the spec.
+#if 0
+                // Check if path attribute is a prefix of the request URI.
+                if (!m_defaultCookieURL.path().startsWith(res->path()))
+                    LOG_AND_DELETE("Invalid cookie %s (path): it does not math the URL", cookie.ascii().data());
+#endif
+
             } else
                 LOG_AND_DELETE("Invalid cookie %s (path)", cookie.ascii().data());
             break;
@@ -240,9 +249,28 @@ ParsedCookie* CookieParser::parseOneCookie(const String& cookie, unsigned start,
             if (length >= 6 && cookie.find("omain", tokenStartSvg + 1, false)) {
                 if (parsedValue.length() > 1 && parsedValue[0] == '"' && parsedValue[parsedValue.length() - 1] == '"')
                     parsedValue = parsedValue.substring(1, parsedValue.length() - 2);
+
+                // Check if the domain contains an embedded dot.
+                size_t dotPosition = parsedValue.find(".", 1);
+                if (dotPosition == notFound || dotPosition == parsedValue.length())
+                    LOG_AND_DELETE("Invalid cookie %s (domain): it does not contain an embedded dot", cookie.ascii().data());
+
                 // If the domain does not start with a dot, add one for security checks,
                 // For example: ab.c.com dose not domain match b.c.com;
                 String realDomain = parsedValue[0] == '.' ? parsedValue : "." + parsedValue;
+
+                // The request host should domain match the Domain attribute.
+                // Domain string starts with a dot, so a.b.com should domain match .a.b.com.
+                // add a "." at beginning of host name, because it can handle many cases such as
+                // a.b.com matches b.com, a.b.com matches .B.com and a.b.com matches .A.b.Com
+                // and so on.
+                String hostDomainName = m_defaultCookieURL.host();
+                hostDomainName = hostDomainName.startsWith('.') ? hostDomainName : "." + hostDomainName;
+                if (!hostDomainName.endsWith(realDomain, false))
+                    LOG_AND_DELETE("Invalid cookie %s (domain): it does not domain match the host");
+                // We should check for an embedded dot in the portion of string in the host not in the domain
+                // but to match firefox behaviour we do not.
+
                 res->setDomain(realDomain);
             } else
                 LOG_AND_DELETE("Invalid cookie %s (domain)", cookie.ascii().data());
diff --git a/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp b/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
index 5ccc2aa39..8996eb6e7 100644
--- a/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
@@ -20,12 +20,25 @@
 #include "PlatformScreen.h"
 
 #include "FloatRect.h"
+#include "NotImplemented.h"
 #include "Widget.h"
 
 #include <BlackBerryPlatformScreen.h>
 
 namespace WebCore {
 
+int screenHorizontalDPI(Widget*)
+{
+    notImplemented();
+    return 0;
+}
+
+int screenVerticalDPI(Widget*)
+{
+    notImplemented();
+    return 0;
+}
+
 bool screenIsMonochrome(Widget*)
 {
     return false;
diff --git a/Source/WebCore/platform/cf/RunLoopCF.cpp b/Source/WebCore/platform/cf/RunLoopCF.cpp
new file mode 100644
index 000000000..0b3177cc0
--- /dev/null
+++ b/Source/WebCore/platform/cf/RunLoopCF.cpp
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) 2010, 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RunLoop.h"
+
+#include "AutodrainedPool.h"
+#include <CoreFoundation/CoreFoundation.h>
+#include <dispatch/dispatch.h>
+
+namespace WebCore {
+    
+static RunLoop* s_mainRunLoop;
+
+void RunLoop::initializeMainRunLoop()
+{
+    static dispatch_once_t onceToken;
+    dispatch_once(&onceToken, ^{
+        s_mainRunLoop = new RunLoop(CFRunLoopGetMain());
+    });
+}
+
+RunLoop* RunLoop::current()
+{
+    if (pthread_main_np())
+        return RunLoop::main();
+    
+    DEFINE_STATIC_LOCAL(WTF::ThreadSpecific<RunLoop>, runLoopData, ());
+    return &*runLoopData;
+}
+
+RunLoop* RunLoop::main()
+{
+    ASSERT(s_mainRunLoop);
+    return s_mainRunLoop;
+}
+
+void RunLoop::performWork(void* context)
+{
+    // Wrap main thread in an Autorelease pool. Sending messages can call 
+    // into objc code and accumulate memory.  
+    if (current() == main()) {
+        AutodrainedPool pool;
+        static_cast<RunLoop*>(context)->performWork();
+    } else
+        static_cast<RunLoop*>(context)->performWork();
+}
+
+RunLoop::RunLoop()
+    : m_runLoop(CFRunLoopGetCurrent())
+    , m_nestingLevel(0)
+{
+    CFRunLoopSourceContext context = { 0, this, 0, 0, 0, 0, 0, 0, 0, performWork };
+    m_runLoopSource = CFRunLoopSourceCreate(kCFAllocatorDefault, 0, &context);
+    CFRunLoopAddSource(m_runLoop, m_runLoopSource, kCFRunLoopCommonModes);
+}
+
+RunLoop::RunLoop(CFRunLoopRef runLoop)
+    : m_runLoop(runLoop)
+    , m_nestingLevel(0)
+{
+    CFRunLoopSourceContext context = { 0, this, 0, 0, 0, 0, 0, 0, 0, performWork };
+    m_runLoopSource = CFRunLoopSourceCreate(kCFAllocatorDefault, 0, &context);
+    CFRunLoopAddSource(m_runLoop, m_runLoopSource, kCFRunLoopCommonModes);
+}
+
+RunLoop::~RunLoop()
+{
+    // FIXME: Tear down the work item queue here.
+    CFRunLoopSourceInvalidate(m_runLoopSource);
+    CFRelease(m_runLoopSource);
+}
+
+void RunLoop::runForDuration(double duration)
+{
+    CFRunLoopRunInMode(kCFRunLoopDefaultMode, duration, true);
+}
+
+void RunLoop::wakeUp()
+{
+    CFRunLoopSourceSignal(m_runLoopSource);
+    CFRunLoopWakeUp(m_runLoop);
+}
+
+#if !PLATFORM(MAC) || PLATFORM(IOS)
+void RunLoop::run()
+{
+    current()->m_nestingLevel++;
+    
+    {
+        AutodrainedPool pool;
+        CFRunLoopRun();
+    }
+    
+    current()->m_nestingLevel--;
+}
+
+void RunLoop::stop()
+{
+    ASSERT(m_runLoop == CFRunLoopGetCurrent());
+    CFRunLoopStop(m_runLoop);
+}
+#endif
+
+// RunLoop::Timer
+
+void RunLoop::TimerBase::timerFired(CFRunLoopTimerRef, void* context)
+{
+    TimerBase* timer = static_cast<TimerBase*>(context);
+    
+    // Wrap main thread in an Autorelease pool. The timer can call 
+    // into objc code and accumulate memory outside of the main event loop.
+    if (current() == main()) {
+        AutodrainedPool pool;
+        timer->fired();
+    } else
+        timer->fired();
+}
+
+RunLoop::TimerBase::TimerBase(RunLoop* runLoop)
+    : m_runLoop(runLoop)
+    , m_timer(0)
+{
+}
+
+RunLoop::TimerBase::~TimerBase()
+{
+    stop();
+}
+
+void RunLoop::TimerBase::start(double nextFireInterval, bool repeat)
+{
+    if (m_timer)
+        stop();
+    
+    CFRunLoopTimerContext context = { 0, this, 0, 0, 0 };
+    CFTimeInterval repeatInterval = repeat ? nextFireInterval : 0;
+    m_timer = CFRunLoopTimerCreate(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent() + nextFireInterval, repeatInterval, 0, 0, timerFired, &context);
+    CFRunLoopAddTimer(m_runLoop->m_runLoop, m_timer, kCFRunLoopCommonModes);
+}
+
+void RunLoop::TimerBase::stop()
+{
+    if (!m_timer)
+        return;
+    
+    CFRunLoopTimerInvalidate(m_timer);
+    CFRelease(m_timer);
+    m_timer = 0;
+}
+
+bool RunLoop::TimerBase::isActive() const
+{
+    return m_timer && CFRunLoopTimerIsValid(m_timer);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
index e656f44b2..876ec4379 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
@@ -213,12 +213,14 @@ void ChromiumDataObject::addSharedBuffer(const String& name, PassRefPtr<SharedBu
 }
 
 ChromiumDataObject::ChromiumDataObject()
+    : m_modifierKeyState(0)
 {
 }
 
 ChromiumDataObject::ChromiumDataObject(const ChromiumDataObject& other)
     : RefCounted<ChromiumDataObject>()
     , m_itemList(other.m_itemList)
+    , m_modifierKeyState(0)
 {
 }
 
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.h b/Source/WebCore/platform/chromium/ChromiumDataObject.h
index 1a5d7898a..1efb4dfec 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.h
@@ -86,6 +86,9 @@ public:
     // Used to handle files (images) being dragged out.
     void addSharedBuffer(const String& name, PassRefPtr<SharedBuffer>);
 
+    int modifierKeyState() const { return m_modifierKeyState; }
+    void setModifierKeyState(int modifierKeyState) { m_modifierKeyState = modifierKeyState; }
+
 private:
     ChromiumDataObject();
     explicit ChromiumDataObject(const ChromiumDataObject&);
@@ -95,6 +98,9 @@ private:
     void internalAddFileItem(PassRefPtr<ChromiumDataObjectItem>);
 
     Vector<RefPtr<ChromiumDataObjectItem> > m_itemList;
+
+    // State of Shift/Ctrl/Alt/Meta keys.
+    int m_modifierKeyState;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/DragDataChromium.cpp b/Source/WebCore/platform/chromium/DragDataChromium.cpp
index 009a3a08a..a04a30f2f 100644
--- a/Source/WebCore/platform/chromium/DragDataChromium.cpp
+++ b/Source/WebCore/platform/chromium/DragDataChromium.cpp
@@ -75,6 +75,11 @@ unsigned DragData::numberOfFiles() const
     return m_platformDragData->filenames().size();
 }
 
+int DragData::modifierKeyState() const
+{
+    return m_platformDragData->modifierKeyState();
+}
+
 void DragData::asFilenames(Vector<String>& result) const
 {
     const Vector<String>& filenames = m_platformDragData->filenames();
diff --git a/Source/WebCore/platform/chromium/DragImageRef.h b/Source/WebCore/platform/chromium/DragImageRef.h
index a2398e469..7a6aca889 100644
--- a/Source/WebCore/platform/chromium/DragImageRef.h
+++ b/Source/WebCore/platform/chromium/DragImageRef.h
@@ -29,19 +29,11 @@
 #ifndef DragImageRef_h
 #define DragImageRef_h
 
-#if USE(CG)
-typedef struct CGImage* CGImageRef;
-#else
 class SkBitmap;
-#endif
 
 namespace WebCore {
 
-#if USE(CG)
-typedef CGImageRef DragImageRef;
-#else
 typedef SkBitmap* DragImageRef;
-#endif
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/chromium/KeyCodeConversionAndroid.cpp b/Source/WebCore/platform/chromium/KeyCodeConversionAndroid.cpp
index e0579510d..5cf928a88 100644
--- a/Source/WebCore/platform/chromium/KeyCodeConversionAndroid.cpp
+++ b/Source/WebCore/platform/chromium/KeyCodeConversionAndroid.cpp
@@ -33,6 +33,8 @@
 
 #include <android/keycodes.h>
 
+namespace WebCore {
+
 // The Android NDK does not provide values for these yet:
 enum {
     AKEYCODE_ESCAPE          = 111,
@@ -80,8 +82,6 @@ enum {
     AKEYCODE_CHANNEL_DOWN    = 167,
 };
 
-namespace WebCore {
-
 int windowsKeyCodeForKeyEvent(unsigned int keyCode)
 {
     // Does not provide all key codes, and does not handle all keys.
diff --git a/Source/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp b/Source/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
index ee2d5617e..f764c3db9 100644
--- a/Source/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
+++ b/Source/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
@@ -104,7 +104,7 @@ bool MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(const String& mimeTyp
 {
     if (mimeType == "image/jpeg" || mimeType == "image/png")
         return true;
-#if USE(WEBP) && USE(SKIA)
+#if USE(WEBP)
     if (mimeType == "image/webp")
         return true;
 #endif
diff --git a/Source/WebCore/platform/chromium/PlatformSupport.h b/Source/WebCore/platform/chromium/PlatformSupport.h
index f44fd42b8..bd253328a 100644
--- a/Source/WebCore/platform/chromium/PlatformSupport.h
+++ b/Source/WebCore/platform/chromium/PlatformSupport.h
@@ -368,7 +368,6 @@ public:
     // Visited links ------------------------------------------------------
     static LinkHash visitedLinkHash(const UChar* url, unsigned length);
     static LinkHash visitedLinkHash(const KURL& base, const AtomicString& attributeURL);
-    static bool isLinkVisited(LinkHash);
 
     static void didStartWorkerRunLoop(WorkerRunLoop*);
     static void didStopWorkerRunLoop(WorkerRunLoop*);
diff --git a/Source/WebCore/platform/chromium/Prerender.cpp b/Source/WebCore/platform/chromium/Prerender.cpp
new file mode 100644
index 000000000..933a8aa71
--- /dev/null
+++ b/Source/WebCore/platform/chromium/Prerender.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "Prerender.h"
+
+#include <public/Platform.h>
+#include <public/WebPrerender.h>
+#include <public/WebPrerenderingSupport.h>
+#include <public/WebReferrerPolicy.h>
+#include <public/WebString.h>
+#include <public/WebURL.h>
+
+#if ENABLE(LINK_PRERENDER)
+
+namespace WebCore {
+
+Prerender::Prerender(const KURL& url, const String& referrer, ReferrerPolicy policy)
+    : m_url(url)
+    , m_referrer(referrer)
+    , m_referrerPolicy(policy)
+#ifndef NDEBUG
+    , m_state(Inactive)
+#endif
+{
+}
+
+Prerender::~Prerender()
+{
+}
+
+void Prerender::setState(State state)
+{
+#ifdef NDEBUG
+    UNUSED_PARAM(state);
+#else
+    m_state = state;
+#endif
+}
+
+void Prerender::add()
+{
+    ASSERT(m_state == Inactive);
+    WebKit::WebPrerenderingSupport* platform = WebKit::WebPrerenderingSupport::current();
+    if (!platform)
+        return;
+    WebKit::WebPrerender webPrerender(this);
+    platform->add(webPrerender);
+    setState(Active);
+}
+
+void Prerender::cancel()
+{
+    ASSERT(WebKit::WebPrerenderingSupport::current());
+    WebKit::WebPrerenderingSupport* platform = WebKit::WebPrerenderingSupport::current();
+    if (!platform)
+        return;
+    ASSERT(m_state == Active);
+    WebKit::WebPrerender webPrerender(this);
+    platform->cancel(webPrerender);
+    setState(Inactive);
+}
+
+void Prerender::abandon()
+{
+    WebKit::WebPrerenderingSupport* platform = WebKit::WebPrerenderingSupport::current();
+    if (!platform)
+        return;
+    // FIXME: Assert on the state as Inactive here. It is currently common to call abandon() on an Inactive
+    // prerender, as the Prerenderer doesn't keep track of which prerenders are active, and so any page that
+    // ever had a now-canceled Prerender will get this bogus stop() call.
+    WebKit::WebPrerender webPrerender(this);
+    platform->abandon(webPrerender);
+    setState(Inactive);
+}
+
+void Prerender::suspend()
+{
+    abandon();
+}
+
+void Prerender::resume()
+{
+    add();
+}
+
+}
+
+#endif // ENABLE(LINK_PRERENDER)
diff --git a/Source/WebCore/platform/chromium/Prerender.h b/Source/WebCore/platform/chromium/Prerender.h
new file mode 100644
index 000000000..9465b22ca
--- /dev/null
+++ b/Source/WebCore/platform/chromium/Prerender.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef Prerender_h
+#define Prerender_h
+
+#include "KURL.h"
+#include "ReferrerPolicy.h"
+#include <public/WebSize.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE(LINK_PRERENDER)
+
+namespace WebCore {
+
+class Prerender : public RefCounted<Prerender> {
+    WTF_MAKE_NONCOPYABLE(Prerender);
+public:
+    class ExtraData : public RefCounted<ExtraData> {
+    public:
+        virtual ~ExtraData() { }
+    };
+
+    Prerender(const KURL&, const String& referrer, ReferrerPolicy);
+    ~Prerender();
+
+    void add();
+    void cancel();
+    void abandon();
+    void suspend();
+    void resume();
+
+    const KURL& url() const { return m_url; }
+    const String& referrer() const { return m_referrer; }
+    ReferrerPolicy referrerPolicy() const { return m_referrerPolicy; }
+
+    void setExtraData(PassRefPtr<ExtraData> extraData) { m_extraData = extraData; }
+    ExtraData* extraData() { return m_extraData.get(); }
+
+private:
+    enum State {
+        Inactive,
+        Active,
+    };
+
+    void setState(State);
+
+    const KURL m_url;
+    const String m_referrer;
+    const ReferrerPolicy m_referrerPolicy;
+
+    RefPtr<ExtraData> m_extraData;
+
+#ifndef NDEBUG
+    State m_state;
+#endif
+};
+
+}
+
+#endif // ENABLE(LINK_PRERENDER)
+
+#endif // Prerender_h
diff --git a/Source/WebCore/platform/chromium/PrerenderHandle.cpp b/Source/WebCore/platform/chromium/PrerenderHandle.cpp
new file mode 100644
index 000000000..97cec7979
--- /dev/null
+++ b/Source/WebCore/platform/chromium/PrerenderHandle.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "PrerenderHandle.h"
+
+#if ENABLE(LINK_PRERENDER)
+
+#include "KURL.h"
+#include "Prerender.h"
+#include "ReferrerPolicy.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+PassRefPtr<PrerenderHandle> PrerenderHandle::create(const KURL& url, const String& referrer, ReferrerPolicy policy)
+{
+    return adoptRef(new PrerenderHandle(url, referrer, policy));
+}
+
+PrerenderHandle::PrerenderHandle(const KURL& url, const String& referrer, ReferrerPolicy policy)
+    : m_prerender(adoptRef(new Prerender(url, referrer, policy)))
+{
+}
+
+PrerenderHandle::~PrerenderHandle()
+{
+}
+
+Prerender* PrerenderHandle::prerender()
+{
+    return m_prerender.get();
+}
+
+void PrerenderHandle::add()
+{
+    prerender()->add();
+}
+
+void PrerenderHandle::cancel()
+{
+    prerender()->cancel();
+}
+
+void PrerenderHandle::abandon()
+{
+    prerender()->abandon();
+}
+
+void PrerenderHandle::suspend()
+{
+    prerender()->suspend();
+}
+
+void PrerenderHandle::resume()
+{
+    prerender()->resume();
+}
+
+const KURL& PrerenderHandle::url() const
+{
+    return m_prerender->url();
+}
+
+const String& PrerenderHandle::referrer() const
+{
+    return m_prerender->url();
+}
+
+ReferrerPolicy PrerenderHandle::referrerPolicy() const
+{
+    return m_prerender->referrerPolicy();
+}
+
+}
+
+#endif // ENABLE(LINK_PRERENDER)
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
index acfbc1d97..75e4a29c8 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
@@ -32,15 +32,12 @@
 #include "ImageBuffer.h"
 #include "LocalCurrentGraphicsContext.h"
 #include "NSScrollerImpDetails.h"
+#include "PlatformContextSkia.h"
 #include "PlatformSupport.h"
 #include "ScrollAnimatorMac.h"
 #include "ScrollView.h"
-#include <Carbon/Carbon.h>
-
-#if USE(SKIA)
-#include "PlatformContextSkia.h"
 #include "skia/ext/skia_utils_mac.h"
-#endif
+#include <Carbon/Carbon.h>
 
 namespace WebCore {
 
@@ -121,11 +118,7 @@ bool ScrollbarThemeChromiumMac::paint(ScrollbarThemeClient* scrollbar, GraphicsC
                 value = 0;
         }
 
-#if !USE(SKIA)
-        setIsCurrentlyDrawingIntoLayer(context->isCALayerContext());
-#else
         setIsCurrentlyDrawingIntoLayer(false);
-#endif
 
         CGFloat oldKnobAlpha = 0;
         CGFloat oldTrackAlpha = 0;
@@ -201,12 +194,8 @@ bool ScrollbarThemeChromiumMac::paint(ScrollbarThemeClient* scrollbar, GraphicsC
         trackInfo.enableState = kThemeTrackNothingToScroll;
     trackInfo.trackInfo.scrollbar.pressState = scrollbarPartToHIPressedState(scrollbar->pressedPart());
 
-#if USE(SKIA)
     SkCanvas* canvas = context->platformContext()->canvas();
     CGAffineTransform currentCTM = gfx::SkMatrixToCGAffineTransform(canvas->getTotalMatrix());
-#else
-    CGAffineTransform currentCTM = CGContextGetCTM(context->platformContext());
-#endif
 
     // The Aqua scrollbar is buggy when rotated and scaled.  We will just draw into a bitmap if we detect a scale or rotation.
     bool canDrawDirectly = currentCTM.a == 1.0f && currentCTM.b == 0.0f && currentCTM.c == 0.0f && (currentCTM.d == 1.0f || currentCTM.d == -1.0f);
@@ -227,12 +216,8 @@ bool ScrollbarThemeChromiumMac::paint(ScrollbarThemeClient* scrollbar, GraphicsC
     }
 
     // Draw thumbless.
-#if USE(SKIA)
     gfx::SkiaBitLocker bitLocker(drawingContext->platformContext()->canvas());
     CGContextRef cgContext = bitLocker.cgContext();
-#else
-    CGContextRef cgContext = drawingContext->platformContext();
-#endif
     HIThemeDrawTrack(&trackInfo, 0, cgContext, kHIThemeOrientationNormal);
 
     IntRect tickmarkTrackRect = trackRect(scrollbar, false);
diff --git a/Source/WebCore/platform/chromium/ThemeChromiumMac.mm b/Source/WebCore/platform/chromium/ThemeChromiumMac.mm
index 69cb74a4c..e718d054a 100644
--- a/Source/WebCore/platform/chromium/ThemeChromiumMac.mm
+++ b/Source/WebCore/platform/chromium/ThemeChromiumMac.mm
@@ -33,13 +33,10 @@
 #import "ScrollView.h"
 #import "WebCoreSystemInterface.h"
 #import <Carbon/Carbon.h>
-#include <wtf/StdLibExtras.h>
 #import <objc/runtime.h>
-
-#if USE(SKIA)
 #include "PlatformContextSkia.h"
 #include "skia/ext/skia_utils_mac.h"
-#endif
+#include <wtf/StdLibExtras.h>
 
 using namespace std;
 
@@ -641,12 +638,8 @@ static void paintStepper(ControlStates states, GraphicsContext* context, const I
         int heightDiff = clampToInteger(bounds.size.height - backgroundBounds.size.height);
         backgroundBounds.origin.y = bounds.origin.y + (heightDiff / 2) + 1;
     }
-#if USE(SKIA)
     gfx::SkiaBitLocker bitLocker(context->platformContext()->canvas());
     CGContextRef cgContext = bitLocker.cgContext();
-#else
-    CGContextRef cgContext = context->platformContext();
-#endif
     HIThemeDrawButton(&backgroundBounds, &drawInfo, cgContext, kHIThemeOrientationNormal, 0);
     context->restore();
 }
diff --git a/Source/WebCore/platform/chromium/VisitedLinksChromium.cpp b/Source/WebCore/platform/chromium/VisitedLinksChromium.cpp
new file mode 100644
index 000000000..48583702f
--- /dev/null
+++ b/Source/WebCore/platform/chromium/VisitedLinksChromium.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "VisitedLinks.h"
+
+#include <public/Platform.h>
+
+namespace WebCore {
+
+bool VisitedLinks::isLinkVisited(LinkHash visitedLinkHash)
+{
+    return WebKit::Platform::current()->isLinkVisited(visitedLinkHash);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/support/WebFilterOperations.cpp b/Source/WebCore/platform/chromium/support/WebFilterOperations.cpp
index d60d9287a..1e5c85f19 100644
--- a/Source/WebCore/platform/chromium/support/WebFilterOperations.cpp
+++ b/Source/WebCore/platform/chromium/support/WebFilterOperations.cpp
@@ -35,11 +35,16 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void WebFilterOperations::initialize()
+void WebFilterOperations::reset()
 {
     m_private.reset(new FilterOperations());
 }
 
+void WebFilterOperations::destroy()
+{
+    m_private.reset(0);
+}
+
 void WebFilterOperations::append(const WebFilterOperation& filter)
 {
     switch (filter.type) {
@@ -66,11 +71,6 @@ void WebFilterOperations::append(const WebFilterOperation& filter)
     }
 }
 
-void WebFilterOperations::clear()
-{
-    m_private->operations().clear();
-}
-
 const FilterOperations& WebFilterOperations::toFilterOperations() const
 {
     return *m_private.get();
diff --git a/Source/WebCore/platform/chromium/support/WebHTTPLoadInfo.cpp b/Source/WebCore/platform/chromium/support/WebHTTPLoadInfo.cpp
index d7d57f212..7762fd8c4 100644
--- a/Source/WebCore/platform/chromium/support/WebHTTPLoadInfo.cpp
+++ b/Source/WebCore/platform/chromium/support/WebHTTPLoadInfo.cpp
@@ -104,8 +104,9 @@ void WebHTTPLoadInfo::setEncodedDataLength(long long encodedDataLength)
 static void addHeader(HTTPHeaderMap* map, const WebString& name, const WebString& value)
 {
     HTTPHeaderMap::AddResult result = map->add(name, value);
+    // It is important that values are separated by '\n', not comma, otherwise Set-Cookie header is not parseable.
     if (!result.isNewEntry)
-        result.iterator->second += ", " + String(value);
+        result.iterator->second += "\n" + String(value);
 }
 
 void WebHTTPLoadInfo::addRequestHeader(const WebString& name, const WebString& value)
diff --git a/Source/WebCore/platform/chromium/support/WebPrerender.cpp b/Source/WebCore/platform/chromium/support/WebPrerender.cpp
new file mode 100644
index 000000000..8327fbd70
--- /dev/null
+++ b/Source/WebCore/platform/chromium/support/WebPrerender.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include <public/WebPrerender.h>
+#include <wtf/PassRefPtr.h>
+
+#if ENABLE(LINK_PRERENDER)
+
+#include "Prerender.h"
+
+namespace WebKit {
+
+namespace {
+
+class ExtraDataContainer : public WebCore::Prerender::ExtraData {
+public:
+    static PassRefPtr<ExtraDataContainer> create(WebPrerender::ExtraData* extraData) { return adoptRef(new ExtraDataContainer(extraData)); }
+
+    virtual ~ExtraDataContainer() { }
+
+    WebPrerender::ExtraData* extraData() const { return m_extraData.get(); }
+
+private:
+    explicit ExtraDataContainer(WebPrerender::ExtraData* extraData)
+        : m_extraData(adoptPtr(extraData))
+    {
+    }
+
+    OwnPtr<WebPrerender::ExtraData> m_extraData;
+};
+
+} // anon namespace
+
+WebPrerender::WebPrerender(PassRefPtr<WebCore::Prerender> prerender)
+    : m_private(prerender)
+{
+}
+
+WebPrerender::~WebPrerender()
+{
+    m_private.reset();
+}
+
+WebURL WebPrerender::url() const
+{
+    return WebURL(m_private->url());
+}
+
+WebString WebPrerender::referrer() const
+{
+    return m_private->referrer();
+}
+
+WebReferrerPolicy WebPrerender::referrerPolicy() const
+{
+    return static_cast<WebReferrerPolicy>(m_private->referrerPolicy());
+}
+
+void WebPrerender::setExtraData(WebPrerender::ExtraData* extraData)
+{
+    m_private->setExtraData(ExtraDataContainer::create(extraData));
+}
+
+const WebPrerender::ExtraData* WebPrerender::extraData() const
+{
+    RefPtr<WebCore::Prerender::ExtraData> webcoreExtraData = m_private->extraData();
+    if (!webcoreExtraData)
+        return 0;
+    return static_cast<ExtraDataContainer*>(webcoreExtraData.get())->extraData();
+}
+
+} // namespace WebKit
+
+#endif // ENABLED(LINK_PRERENDER)
diff --git a/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp b/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp
new file mode 100644
index 000000000..bc86a5e2e
--- /dev/null
+++ b/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp
@@ -0,0 +1,461 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include <public/WebTransformationMatrix.h>
+
+#include "TransformationMatrix.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// FIXME: The overhead of allocating a new TransformationMatrix in these constructors needs to go away as soon
+//        as possible.
+
+WebTransformationMatrix::WebTransformationMatrix()
+    : m_private(new TransformationMatrix())
+{
+}
+
+WebTransformationMatrix::WebTransformationMatrix(double a, double b, double c, double d, double e, double f)
+    : m_private(new TransformationMatrix(a, b, c, d, e, f))
+{
+}
+
+WebTransformationMatrix::WebTransformationMatrix(const WebTransformationMatrix& t)
+    : m_private(new TransformationMatrix(*t.m_private.get()))
+{
+}
+
+WebTransformationMatrix::WebTransformationMatrix(const TransformationMatrix& t)
+    : m_private(new TransformationMatrix(t))
+{
+}
+
+void WebTransformationMatrix::reset()
+{
+    m_private.reset(0);
+}
+
+WebTransformationMatrix& WebTransformationMatrix::operator=(const WebTransformationMatrix& t)
+{
+    *m_private.get() = *t.m_private.get();
+    return *this;
+}
+
+bool WebTransformationMatrix::operator==(const WebTransformationMatrix& t) const
+{
+    bool isEqual = (*m_private.get() == *t.m_private.get());
+    return isEqual;
+}
+
+WebTransformationMatrix WebTransformationMatrix::operator*(const WebTransformationMatrix& t) const
+{
+    WebTransformationMatrix result = *this;
+    result.multiply(t);
+    return result;
+}
+
+WebTransformationMatrix WebTransformationMatrix::inverse() const
+{
+    WebTransformationMatrix result;
+    *result.m_private.get() = m_private->inverse();
+    return result;
+}
+
+WebTransformationMatrix WebTransformationMatrix::to2dTransform() const
+{
+    WebTransformationMatrix result;
+    *result.m_private.get() = m_private->to2dTransform();
+    return result;
+}
+
+void WebTransformationMatrix::multiply(const WebTransformationMatrix& t)
+{
+    m_private->multiply(*t.m_private.get());
+}
+
+void WebTransformationMatrix::makeIdentity()
+{
+    m_private->makeIdentity();
+}
+
+void WebTransformationMatrix::translate(double tx, double ty)
+{
+    m_private->translate(tx, ty);
+}
+
+void WebTransformationMatrix::translate3d(double tx, double ty, double tz)
+{
+    m_private->translate3d(tx, ty, tz);
+}
+
+void WebTransformationMatrix::translateRight3d(double tx, double ty, double tz)
+{
+    m_private->translateRight3d(tx, ty, tz);
+}
+
+void WebTransformationMatrix::scale(double s)
+{
+    m_private->scale(s);
+}
+
+void WebTransformationMatrix::scaleNonUniform(double sx, double sy)
+{
+    m_private->scaleNonUniform(sx, sy);
+}
+
+void WebTransformationMatrix::scale3d(double sx, double sy, double sz)
+{
+    m_private->scale3d(sx, sy, sz);
+}
+
+void WebTransformationMatrix::rotate(double angle)
+{
+    m_private->rotate(angle);
+}
+
+void WebTransformationMatrix::rotate3d(double rx, double ry, double rz)
+{
+    m_private->rotate3d(rx, ry, rz);
+}
+
+void WebTransformationMatrix::rotate3d(double x, double y, double z, double angle)
+{
+    m_private->rotate3d(x, y, z, angle);
+}
+
+void WebTransformationMatrix::skewX(double angle)
+{
+    m_private->skewX(angle);
+}
+
+void WebTransformationMatrix::skewY(double angle)
+{
+    m_private->skewY(angle);
+}
+
+void WebTransformationMatrix::applyPerspective(double p)
+{
+    m_private->applyPerspective(p);
+}
+
+void WebTransformationMatrix::blend(const WebTransformationMatrix& from, double progress)
+{
+    m_private->blend(*from.m_private.get(), progress);
+}
+
+bool WebTransformationMatrix::hasPerspective() const
+{
+    return m_private->hasPerspective();
+}
+
+bool WebTransformationMatrix::isInvertible() const
+{
+    return m_private->isInvertible();
+}
+
+bool WebTransformationMatrix::isBackFaceVisible() const
+{
+    return m_private->isBackFaceVisible();
+}
+
+bool WebTransformationMatrix::isIdentity() const
+{
+    return m_private->isIdentity();
+}
+
+bool WebTransformationMatrix::isIdentityOrTranslation() const
+{
+    return m_private->isIdentityOrTranslation();
+}
+
+bool WebTransformationMatrix::isIntegerTranslation() const
+{
+    return m_private->isIntegerTranslation();
+}
+
+double WebTransformationMatrix::m11() const
+{
+    return m_private->m11();
+}
+
+void WebTransformationMatrix::setM11(double f)
+{
+    m_private->setM11(f);
+}
+
+double WebTransformationMatrix::m12() const
+{
+    return m_private->m12();
+}
+
+void WebTransformationMatrix::setM12(double f)
+{
+    m_private->setM12(f);
+}
+
+double WebTransformationMatrix::m13() const
+{
+    return m_private->m13();
+}
+
+void WebTransformationMatrix::setM13(double f)
+{
+    m_private->setM13(f);
+}
+
+double WebTransformationMatrix::m14() const
+{
+    return m_private->m14();
+}
+
+void WebTransformationMatrix::setM14(double f)
+{
+    m_private->setM14(f);
+}
+
+double WebTransformationMatrix::m21() const
+{
+    return m_private->m21();
+}
+
+void WebTransformationMatrix::setM21(double f)
+{
+    m_private->setM21(f);
+}
+
+double WebTransformationMatrix::m22() const
+{
+    return m_private->m22();
+}
+
+void WebTransformationMatrix::setM22(double f)
+{
+    m_private->setM22(f);
+}
+
+double WebTransformationMatrix::m23() const
+{
+    return m_private->m23();
+}
+
+void WebTransformationMatrix::setM23(double f)
+{
+    m_private->setM23(f);
+}
+
+double WebTransformationMatrix::m24() const
+{
+    return m_private->m24();
+}
+
+void WebTransformationMatrix::setM24(double f)
+{
+    m_private->setM24(f);
+}
+
+double WebTransformationMatrix::m31() const
+{
+    return m_private->m31();
+}
+
+void WebTransformationMatrix::setM31(double f)
+{
+    m_private->setM31(f);
+}
+
+double WebTransformationMatrix::m32() const
+{
+    return m_private->m32();
+}
+
+void WebTransformationMatrix::setM32(double f)
+{
+    m_private->setM32(f);
+}
+
+double WebTransformationMatrix::m33() const
+{
+    return m_private->m33();
+}
+
+void WebTransformationMatrix::setM33(double f)
+{
+    m_private->setM33(f);
+}
+
+double WebTransformationMatrix::m34() const
+{
+    return m_private->m34();
+}
+
+void WebTransformationMatrix::setM34(double f)
+{
+    m_private->setM34(f);
+}
+
+double WebTransformationMatrix::m41() const
+{
+    return m_private->m41();
+}
+
+void WebTransformationMatrix::setM41(double f)
+{
+    m_private->setM41(f);
+}
+
+double WebTransformationMatrix::m42() const
+{
+    return m_private->m42();
+}
+
+void WebTransformationMatrix::setM42(double f)
+{
+    m_private->setM42(f);
+}
+
+double WebTransformationMatrix::m43() const
+{
+    return m_private->m43();
+}
+
+void WebTransformationMatrix::setM43(double f)
+{
+    m_private->setM43(f);
+}
+
+double WebTransformationMatrix::m44() const
+{
+    return m_private->m44();
+}
+
+void WebTransformationMatrix::setM44(double f)
+{
+    m_private->setM44(f);
+}
+
+double WebTransformationMatrix::a() const
+{
+    return m_private->a();
+}
+
+void WebTransformationMatrix::setA(double a)
+{
+    m_private->setA(a);
+}
+
+double WebTransformationMatrix::b() const
+{
+    return m_private->b();
+}
+
+void WebTransformationMatrix::setB(double b)
+{
+    m_private->setB(b);
+}
+
+double WebTransformationMatrix::c() const
+{
+    return m_private->c();
+}
+
+void WebTransformationMatrix::setC(double c)
+{
+    m_private->setC(c);
+}
+
+double WebTransformationMatrix::d() const
+{
+    return m_private->d();
+}
+
+void WebTransformationMatrix::setD(double d)
+{
+    m_private->setD(d);
+}
+
+double WebTransformationMatrix::e() const
+{
+    return m_private->e();
+}
+
+void WebTransformationMatrix::setE(double e)
+{
+    m_private->setE(e);
+}
+
+double WebTransformationMatrix::f() const
+{
+    return m_private->f();
+}
+
+void WebTransformationMatrix::setF(double f)
+{
+    m_private->setF(f);
+}
+
+TransformationMatrix& WebTransformationMatrix::toWebCoreTransform() const
+{
+    return *m_private.get();
+}
+
+FloatRect WebTransformationMatrix::mapRect(const FloatRect& rect) const
+{
+    return m_private->mapRect(rect);
+}
+
+IntRect WebTransformationMatrix::mapRect(const IntRect& rect) const
+{
+    return m_private->mapRect(rect);
+}
+
+FloatPoint3D WebTransformationMatrix::mapPoint(const FloatPoint3D& p) const
+{
+    return m_private->mapPoint(p);
+}
+
+FloatPoint WebTransformationMatrix::mapPoint(const FloatPoint& p) const
+{
+    return m_private->mapPoint(p);
+}
+
+IntPoint WebTransformationMatrix::mapPoint(const IntPoint& p) const
+{
+    return m_private->mapPoint(p);
+}
+
+FloatQuad WebTransformationMatrix::mapQuad(const FloatQuad& quad) const
+{
+    return m_private->mapQuad(quad);
+}
+
+FloatPoint WebTransformationMatrix::projectPoint(const FloatPoint& p, bool* clamped) const
+{
+    return m_private->projectPoint(p, clamped);
+}
+
+} // namespace WebKit
diff --git a/Source/WebCore/platform/chromium/support/WebURLResponse.cpp b/Source/WebCore/platform/chromium/support/WebURLResponse.cpp
index 05658050d..1f9b96860 100644
--- a/Source/WebCore/platform/chromium/support/WebURLResponse.cpp
+++ b/Source/WebCore/platform/chromium/support/WebURLResponse.cpp
@@ -211,6 +211,16 @@ void WebURLResponse::setSuggestedFileName(const WebString& suggestedFileName)
     m_private->m_resourceResponse->setSuggestedFilename(suggestedFileName);
 }
 
+WebURLResponse::HTTPVersion WebURLResponse::httpVersion() const
+{
+    return static_cast<HTTPVersion>(m_private->m_resourceResponse->httpVersion());
+}
+
+void WebURLResponse::setHTTPVersion(HTTPVersion version)
+{
+    m_private->m_resourceResponse->setHTTPVersion(static_cast<ResourceResponse::HTTPVersion>(version));
+}
+
 int WebURLResponse::httpStatusCode() const
 {
     return m_private->m_resourceResponse->httpStatusCode();
diff --git a/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp b/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
index 9e8eb102a..58c058f75 100644
--- a/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
+++ b/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
@@ -50,6 +50,12 @@ static WindowsKeyMap& windowsKeyMap()
     return windowsKeyMap;
 }
 
+static inline void addCharactersToKeyMap(const char from, const char to)
+{
+    for (char c = from; c <= to; c++)
+        keyMap().set(String(&c, 1), String::format("U+%04X", c));
+}
+
 static void createKeyMap()
 {
     for (unsigned int i = 1; i < 25; i++) {
@@ -78,6 +84,7 @@ static void createKeyMap()
     keyMap().set("ISO_Left_Tab", "U+0009");
     keyMap().set("BackSpace", "U+0008");
     keyMap().set("space", "U+0020");
+    keyMap().set("Print", "PrintScreen");
     // Keypad location
     keyMap().set("KP_Left", "Left");
     keyMap().set("KP_Right", "Right");
@@ -89,6 +96,17 @@ static void createKeyMap()
     keyMap().set("KP_End", "End");
     keyMap().set("KP_Insert", "Insert");
     keyMap().set("KP_Delete", "U+007F");
+ 
+    addCharactersToKeyMap('a', 'z');
+    addCharactersToKeyMap('A', 'Z');
+    addCharactersToKeyMap('0', '9');
+}
+
+static inline void addCharactersToWinKeyMap(const char from, const char to, const int baseCode)
+{
+    int i = 0;
+    for (char c = from; c <= to; c++, i++)
+        windowsKeyMap().set(String(&c, 1), baseCode + i);
 }
 
 static void createWindowsKeyMap()
@@ -120,7 +138,7 @@ static void createWindowsKeyMap()
     windowsKeyMap().set("Left", VK_LEFT);
     windowsKeyMap().set("Up", VK_UP);
     windowsKeyMap().set("Down", VK_DOWN);
-    windowsKeyMap().set("Print", VK_PRINT);
+    windowsKeyMap().set("Print", VK_SNAPSHOT);
     windowsKeyMap().set("Insert", VK_INSERT);
     windowsKeyMap().set("Delete", VK_DELETE);
 
@@ -155,17 +173,11 @@ static void createWindowsKeyMap()
     windowsKeyMap().set("KP_Delete", VK_DELETE);
 
     // Set alphabet to the windowsKeyMap.
-    const char* alphabet = "abcdefghijklmnopqrstuvwxyz";
-    for (unsigned int i = 0; i < 26; i++) {
-        String key(alphabet + i, 1);
-        windowsKeyMap().set(key, VK_A + i);
-    }
+    addCharactersToWinKeyMap('a', 'z', VK_A);
+    addCharactersToWinKeyMap('A', 'Z', VK_A);
 
     // Set digits to the windowsKeyMap.
-    for (unsigned int i = 0; i < 10; i++) {
-        String key = String::number(i);
-        windowsKeyMap().set(key, VK_0 + i);
-    }
+    addCharactersToWinKeyMap('0', '9', VK_0);
 
     // Set shifted digits to the windowsKeyMap.
     windowsKeyMap().set("exclam", VK_1);
@@ -209,6 +221,8 @@ String singleCharacterString(const String& keyName)
         return String("\x8");
     if (keyName == "Tab")
         return String("\t");
+    if (keyName == "Print")
+        return String("");
     return keyName;
 }
 
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index 5851a6041..45879d2e6 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -276,7 +276,7 @@ void RenderThemeEfl::cacheThemePartFlush()
     end = m_partCache.end();
     for (; itr != end; itr++) {
         struct ThemePartCacheEntry *entry = *itr;
-        cairo_surface_finish(entry->surface);
+        cairo_surface_destroy(entry->surface);
         evas_object_del(entry->o);
         ecore_evas_free(entry->ee);
         delete entry;
@@ -421,49 +421,6 @@ static void renderThemeEflColorClassFocusRing(void* data, Evas_Object* object, c
     that->setFocusRingColor(fr, fg, fb, fa);
 }
 
-static void renderThemeEflColorClassButtonText(void* data, Evas_Object* object, const char* signal, const char* source)
-{
-    RenderThemeEfl* that = static_cast<RenderThemeEfl *>(data);
-    int fr, fg, fb, fa, br, bg, bb, ba;
-
-    if (!edje_object_color_class_get(object, source, &fr, &fg, &fb, &fa, &br, &bg, &bb, &ba, 0, 0, 0, 0))
-        return;
-
-    that->setButtonTextColor(fr, fg, fb, fa, br, bg, bb, ba);
-}
-
-static void renderThemeEflColorClassComboText(void* data, Evas_Object* object, const char* signal, const char* source)
-{
-    RenderThemeEfl* that = static_cast<RenderThemeEfl *>(data);
-    int fr, fg, fb, fa, br, bg, bb, ba;
-
-    if (!edje_object_color_class_get(object, source, &fr, &fg, &fb, &fa, &br, &bg, &bb, &ba, 0, 0, 0, 0))
-        return;
-
-    that->setComboTextColor(fr, fg, fb, fa, br, bg, bb, ba);
-}
-
-static void renderThemeEflColorClassEntryText(void* data, Evas_Object* object, const char* signal, const char* source)
-{
-    RenderThemeEfl* that = static_cast<RenderThemeEfl *>(data);
-    int fr, fg, fb, fa, br, bg, bb, ba;
-
-    if (!edje_object_color_class_get(object, source, &fr, &fg, &fb, &fa, &br, &bg, &bb, &ba, 0, 0, 0, 0))
-        return;
-
-    that->setEntryTextColor(fr, fg, fb, fa, br, bg, bb, ba);
-}
-
-static void renderThemeEflColorClassSearchText(void* data, Evas_Object* object, const char* signal, const char* source)
-{
-    RenderThemeEfl* that = static_cast<RenderThemeEfl *>(data);
-    int fr, fg, fb, fa, br, bg, bb, ba;
-    if (!edje_object_color_class_get(object, source, &fr, &fg, &fb, &fa, &br, &bg, &bb, &ba, 0, 0, 0, 0))
-        return;
-
-    that->setSearchTextColor(fr, fg, fb, fa, br, bg, bb, ba);
-}
-
 void RenderThemeEfl::createCanvas()
 {
     ASSERT(!m_canvas);
@@ -500,10 +457,6 @@ void RenderThemeEfl::createEdje()
             CONNECT("selection/inactive",
                     renderThemeEflColorClassSelectionInactive);
             CONNECT("focus_ring", renderThemeEflColorClassFocusRing);
-            CONNECT("button/text", renderThemeEflColorClassButtonText);
-            CONNECT("combo/text", renderThemeEflColorClassComboText);
-            CONNECT("entry/text", renderThemeEflColorClassEntryText);
-            CONNECT("search/text", renderThemeEflColorClassSearchText);
 #undef CONNECT
         }
     }
@@ -534,22 +487,6 @@ void RenderThemeEfl::applyEdjeColors()
         // it to use page themes as much as possible.
         RenderTheme::setCustomFocusRingColor(m_focusRingColor);
     }
-    if (COLOR_GET("button/text")) {
-        m_buttonTextForegroundColor = Color(fr, fg, fb, fa);
-        m_buttonTextBackgroundColor = Color(br, bg, bb, ba);
-    }
-    if (COLOR_GET("combo/text")) {
-        m_comboTextForegroundColor = Color(fr, fg, fb, fa);
-        m_comboTextBackgroundColor = Color(br, bg, bb, ba);
-    }
-    if (COLOR_GET("entry/text")) {
-        m_entryTextForegroundColor = Color(fr, fg, fb, fa);
-        m_entryTextBackgroundColor = Color(br, bg, bb, ba);
-    }
-    if (COLOR_GET("search/text")) {
-        m_searchTextForegroundColor = Color(fr, fg, fb, fa);
-        m_searchTextBackgroundColor = Color(br, bg, bb, ba);
-    }
 #undef COLOR_GET
     platformColorsDidChange();
 }
@@ -713,14 +650,6 @@ RenderThemeEfl::RenderThemeEfl(Page* page)
     , m_inactiveSelectionBackgroundColor(0, 0, 128)
     , m_inactiveSelectionForegroundColor(200, 200, 200)
     , m_focusRingColor(32, 32, 224, 224)
-    , m_buttonTextBackgroundColor(0, 0, 0, 0)
-    , m_buttonTextForegroundColor(Color::black)
-    , m_comboTextBackgroundColor(0, 0, 0, 0)
-    , m_comboTextForegroundColor(Color::black)
-    , m_entryTextBackgroundColor(0, 0, 0, 0)
-    , m_entryTextForegroundColor(Color::black)
-    , m_searchTextBackgroundColor(0, 0, 0, 0)
-    , m_searchTextForegroundColor(Color::black)
     , m_sliderThumbColor(Color::darkGray)
 #if ENABLE(VIDEO)
     , m_mediaPanelColor(220, 220, 195) // light tannish color.
@@ -768,34 +697,6 @@ void RenderThemeEfl::setFocusRingColor(int r, int g, int b, int a)
     platformColorsDidChange();
 }
 
-void RenderThemeEfl::setButtonTextColor(int foreR, int foreG, int foreB, int foreA, int backR, int backG, int backB, int backA)
-{
-    m_buttonTextForegroundColor = Color(foreR, foreG, foreB, foreA);
-    m_buttonTextBackgroundColor = Color(backR, backG, backB, backA);
-    platformColorsDidChange();
-}
-
-void RenderThemeEfl::setComboTextColor(int foreR, int foreG, int foreB, int foreA, int backR, int backG, int backB, int backA)
-{
-    m_comboTextForegroundColor = Color(foreR, foreG, foreB, foreA);
-    m_comboTextBackgroundColor = Color(backR, backG, backB, backA);
-    platformColorsDidChange();
-}
-
-void RenderThemeEfl::setEntryTextColor(int foreR, int foreG, int foreB, int foreA, int backR, int backG, int backB, int backA)
-{
-    m_entryTextForegroundColor = Color(foreR, foreG, foreB, foreA);
-    m_entryTextBackgroundColor = Color(backR, backG, backB, backA);
-    platformColorsDidChange();
-}
-
-void RenderThemeEfl::setSearchTextColor(int foreR, int foreG, int foreB, int foreA, int backR, int backG, int backB, int backA)
-{
-    m_searchTextForegroundColor = Color(foreR, foreG, foreB, foreA);
-    m_searchTextBackgroundColor = Color(backR, backG, backB, backA);
-    platformColorsDidChange();
-}
-
 static bool supportsFocus(ControlPart appearance)
 {
     switch (appearance) {
@@ -943,8 +844,6 @@ void RenderThemeEfl::adjustButtonStyle(StyleResolver* styleResolver, RenderStyle
         style->resetBorder();
         style->setWhiteSpace(PRE);
         style->setHeight(Length(Auto));
-        style->setColor(m_buttonTextForegroundColor);
-        style->setBackgroundColor(m_buttonTextBackgroundColor);
     }
 }
 
@@ -962,8 +861,6 @@ void RenderThemeEfl::adjustMenuListStyle(StyleResolver* styleResolver, RenderSty
     adjustSizeConstraints(style, ComboBox);
     style->resetBorder();
     style->setWhiteSpace(PRE);
-    style->setColor(m_comboTextForegroundColor);
-    style->setBackgroundColor(m_comboTextBackgroundColor);
 }
 
 bool RenderThemeEfl::paintMenuList(RenderObject* object, const PaintInfo& info, const IntRect& rect)
@@ -989,9 +886,6 @@ void RenderThemeEfl::adjustTextFieldStyle(StyleResolver* styleResolver, RenderSt
     }
     adjustSizeConstraints(style, TextField);
     style->resetBorder();
-    style->setWhiteSpace(PRE);
-    style->setColor(m_entryTextForegroundColor);
-    style->setBackgroundColor(m_entryTextBackgroundColor);
 }
 
 bool RenderThemeEfl::paintTextField(RenderObject* object, const PaintInfo& info, const IntRect& rect)
@@ -1082,8 +976,6 @@ void RenderThemeEfl::adjustSearchFieldStyle(StyleResolver* styleResolver, Render
     adjustSizeConstraints(style, SearchField);
     style->resetBorder();
     style->setWhiteSpace(PRE);
-    style->setColor(m_searchTextForegroundColor);
-    style->setBackgroundColor(m_searchTextBackgroundColor);
 }
 
 bool RenderThemeEfl::paintSearchField(RenderObject* object, const PaintInfo& info, const IntRect& rect)
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.h b/Source/WebCore/platform/efl/RenderThemeEfl.h
index d15ee0bce..6f82cabcd 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.h
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.h
@@ -212,14 +212,6 @@ private:
     Color m_inactiveSelectionBackgroundColor;
     Color m_inactiveSelectionForegroundColor;
     Color m_focusRingColor;
-    Color m_buttonTextBackgroundColor;
-    Color m_buttonTextForegroundColor;
-    Color m_comboTextBackgroundColor;
-    Color m_comboTextForegroundColor;
-    Color m_entryTextBackgroundColor;
-    Color m_entryTextForegroundColor;
-    Color m_searchTextBackgroundColor;
-    Color m_searchTextForegroundColor;
     Color m_sliderThumbColor;
 
 #if ENABLE(VIDEO)
diff --git a/Source/WebCore/platform/graphics/BitmapImage.cpp b/Source/WebCore/platform/graphics/BitmapImage.cpp
index 55a98c96f..448241b81 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.cpp
+++ b/Source/WebCore/platform/graphics/BitmapImage.cpp
@@ -64,7 +64,6 @@ BitmapImage::BitmapImage(ImageObserver* observer)
     , m_hasUniformFrameSize(true)
     , m_haveFrameCount(false)
 {
-    initPlatformData();
 }
 
 BitmapImage::~BitmapImage()
diff --git a/Source/WebCore/platform/graphics/BitmapImage.h b/Source/WebCore/platform/graphics/BitmapImage.h
index 00f0c5e40..afb981627 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.h
+++ b/Source/WebCore/platform/graphics/BitmapImage.h
@@ -254,7 +254,6 @@ protected:
     bool internalAdvanceAnimation(bool skippingFrames);
 
     // Handle platform-specific data
-    void initPlatformData();
     void invalidatePlatformData();
     
     // Checks to see if the image is a 1x1 solid color.  We optimize these images and just do a fill rect instead.
diff --git a/Source/WebCore/platform/graphics/DisplayRefreshMonitor.cpp b/Source/WebCore/platform/graphics/DisplayRefreshMonitor.cpp
index 366aca326..30d8d3d41 100644
--- a/Source/WebCore/platform/graphics/DisplayRefreshMonitor.cpp
+++ b/Source/WebCore/platform/graphics/DisplayRefreshMonitor.cpp
@@ -57,6 +57,7 @@ DisplayRefreshMonitor::DisplayRefreshMonitor(PlatformDisplayID displayID)
     , m_active(true)
     , m_scheduled(false)
     , m_previousFrameDone(true)
+    , m_unscheduledFireCount(0)
     , m_displayID(displayID)
 #if PLATFORM(MAC)
     , m_displayLink(0)
@@ -67,28 +68,56 @@ DisplayRefreshMonitor::DisplayRefreshMonitor(PlatformDisplayID displayID)
 {
 }
 
-void DisplayRefreshMonitor::refreshDisplayOnMainThread(void* data)
+void DisplayRefreshMonitor::handleDisplayRefreshedNotificationOnMainThread(void* data)
 {
     DisplayRefreshMonitor* monitor = static_cast<DisplayRefreshMonitor*>(data);
-    monitor->notifyClients();
+    monitor->displayDidRefresh();
 }
 
-void DisplayRefreshMonitor::notifyClients()
+void DisplayRefreshMonitor::addClient(DisplayRefreshMonitorClient* client)
+{
+    m_clients.add(client);
+}
+
+bool DisplayRefreshMonitor::removeClient(DisplayRefreshMonitorClient* client)
+{
+    DisplayRefreshMonitorClientSet::iterator it = m_clients.find(client);
+    if (it != m_clients.end()) {
+        m_clients.remove(it);
+        return true;
+    }
+    return false;
+}
+
+void DisplayRefreshMonitor::displayDidRefresh()
 {
     double timestamp;
     {
         MutexLocker lock(m_mutex);
+         if (!m_scheduled)
+            ++m_unscheduledFireCount;
+        else
+            m_unscheduledFireCount = 0;
+
         m_scheduled = false;
         timestamp = m_timestamp;
     }
 
-    for (size_t i = 0; i < m_clients.size(); ++i)
-        m_clients[i]->fireDisplayRefreshIfNeeded(timestamp);
+    // The call back can cause all our clients to be unregistered, so we need to protect
+    // against deletion until the end of the method.
+    RefPtr<DisplayRefreshMonitor> protector(this);
+    
+    Vector<DisplayRefreshMonitorClient*> clients;
+    copyToVector(m_clients, clients);
+    for (size_t i = 0; i < clients.size(); ++i)
+        clients[i]->fireDisplayRefreshIfNeeded(timestamp);
 
     {
         MutexLocker lock(m_mutex);
         m_previousFrameDone = true;
     }
+    
+    DisplayRefreshMonitorManager::sharedManager()->displayDidRefresh(this);
 }
 
 DisplayRefreshMonitorManager* DisplayRefreshMonitorManager::sharedManager()
@@ -97,13 +126,18 @@ DisplayRefreshMonitorManager* DisplayRefreshMonitorManager::sharedManager()
     return &manager;
 }
 
-size_t DisplayRefreshMonitorManager::findMonitor(PlatformDisplayID displayID) const
+DisplayRefreshMonitor* DisplayRefreshMonitorManager::ensureMonitorForClient(DisplayRefreshMonitorClient* client)
 {
-    for (size_t i = 0; i < m_monitors.size(); ++i)
-        if (m_monitors[i]->displayID() == displayID)
-            return i;
-            
-    return notFound;
+    DisplayRefreshMonitorMap::iterator it = m_monitors.find(client->m_displayID);
+    if (it == m_monitors.end()) {
+        RefPtr<DisplayRefreshMonitor> monitor = DisplayRefreshMonitor::create(client->m_displayID);
+        monitor->addClient(client);
+        DisplayRefreshMonitor* result = monitor.get();
+        m_monitors.add(client->m_displayID, monitor.release());
+        return result;
+    }
+
+    return it->second.get();
 }
 
 void DisplayRefreshMonitorManager::registerClient(DisplayRefreshMonitorClient* client)
@@ -111,33 +145,22 @@ void DisplayRefreshMonitorManager::registerClient(DisplayRefreshMonitorClient* c
     if (!client->m_displayIDIsSet)
         return;
         
-    size_t index = findMonitor(client->m_displayID);
-    DisplayRefreshMonitor* monitor;
-    
-    if (index == notFound) {
-        monitor = new DisplayRefreshMonitor(client->m_displayID);
-        m_monitors.append(monitor);
-    } else
-        monitor = m_monitors[index];
-        
-    monitor->addClient(client);
+    ensureMonitorForClient(client);
 }
 
 void DisplayRefreshMonitorManager::unregisterClient(DisplayRefreshMonitorClient* client)
 {
     if (!client->m_displayIDIsSet)
         return;
-        
-    size_t index = findMonitor(client->m_displayID);
-    if (index == notFound)
+
+    DisplayRefreshMonitorMap::iterator it = m_monitors.find(client->m_displayID);
+    if (it == m_monitors.end())
         return;
     
-    DisplayRefreshMonitor* monitor = m_monitors[index];
+    DisplayRefreshMonitor* monitor = it->second.get();
     if (monitor->removeClient(client)) {
-        if (!monitor->hasClients()) {
-            m_monitors.remove(index);
-            delete monitor;
-        }
+        if (!monitor->hasClients())
+            m_monitors.remove(it);
     }
 }
 
@@ -146,11 +169,19 @@ bool DisplayRefreshMonitorManager::scheduleAnimation(DisplayRefreshMonitorClient
     if (!client->m_displayIDIsSet)
         return false;
         
-    size_t i = findMonitor(client->m_displayID);
-    ASSERT(i != notFound);
+    DisplayRefreshMonitor* monitor = ensureMonitorForClient(client);
 
     client->m_scheduled = true;
-    return m_monitors[i]->requestRefreshCallback();
+    return monitor->requestRefreshCallback();
+}
+
+void DisplayRefreshMonitorManager::displayDidRefresh(DisplayRefreshMonitor* monitor)
+{
+    if (monitor->shouldBeTerminated()) {
+        DisplayRefreshMonitorMap::iterator it = m_monitors.find(monitor->displayID());
+        ASSERT(it != m_monitors.end());
+        m_monitors.remove(it);
+    }
 }
 
 void DisplayRefreshMonitorManager::windowScreenDidChange(PlatformDisplayID displayID, DisplayRefreshMonitorClient* client)
diff --git a/Source/WebCore/platform/graphics/DisplayRefreshMonitor.h b/Source/WebCore/platform/graphics/DisplayRefreshMonitor.h
index ca6cebdfd..e13d69dfd 100644
--- a/Source/WebCore/platform/graphics/DisplayRefreshMonitor.h
+++ b/Source/WebCore/platform/graphics/DisplayRefreshMonitor.h
@@ -29,8 +29,11 @@
 #if USE(REQUEST_ANIMATION_FRAME_DISPLAY_MONITOR)
 
 #include "PlatformScreen.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
-#include <wtf/Vector.h>
 #if PLATFORM(BLACKBERRY)
 #include <BlackBerryPlatformAnimation.h>
 #endif
@@ -86,9 +89,13 @@ private:
 // Monitor for display refresh messages for a given screen
 //
 
-class DisplayRefreshMonitor {
+class DisplayRefreshMonitor : public RefCounted<DisplayRefreshMonitor> {
 public:
-    DisplayRefreshMonitor(PlatformDisplayID);
+    static PassRefPtr<DisplayRefreshMonitor> create(PlatformDisplayID displayID)
+    {
+        return adoptRef(new DisplayRefreshMonitor(displayID));
+    }
+    
     ~DisplayRefreshMonitor();
     
     // Return true if callback request was scheduled, false if it couldn't be
@@ -97,30 +104,33 @@ public:
     void windowScreenDidChange(PlatformDisplayID);
     
     bool hasClients() const { return m_clients.size(); }
-    void addClient(DisplayRefreshMonitorClient* client) { m_clients.append(client); }
-    bool removeClient(DisplayRefreshMonitorClient* client)
-    {
-        size_t i = m_clients.find(client);
-        if (i == notFound)
-            return false;
-        m_clients.remove(i);
-        return true;
-    }
+    void addClient(DisplayRefreshMonitorClient*);
+    bool removeClient(DisplayRefreshMonitorClient*);
     
     PlatformDisplayID displayID() const { return m_displayID; }
 
+    bool shouldBeTerminated() const
+    {
+        const int maxInactiveFireCount = 10;
+        return !m_scheduled && m_unscheduledFireCount > maxInactiveFireCount;
+    }
+    
 private:
-    void notifyClients();
-    static void refreshDisplayOnMainThread(void* data);
+    DisplayRefreshMonitor(PlatformDisplayID);
+
+    void displayDidRefresh();
+    static void handleDisplayRefreshedNotificationOnMainThread(void* data);
 
     double m_timestamp;
     bool m_active;
     bool m_scheduled;
     bool m_previousFrameDone;
+    int m_unscheduledFireCount; // Number of times the display link has fired with no clients.
     PlatformDisplayID m_displayID;
-    DisplayRefreshMonitorManager* m_manager;
     Mutex m_mutex;
-    Vector<DisplayRefreshMonitorClient*> m_clients;
+    
+    typedef HashSet<DisplayRefreshMonitorClient*> DisplayRefreshMonitorClientSet;
+    DisplayRefreshMonitorClientSet m_clients;
 #if PLATFORM(BLACKBERRY)
 public:
     void displayLinkFired();
@@ -154,11 +164,15 @@ public:
     void windowScreenDidChange(PlatformDisplayID, DisplayRefreshMonitorClient*);
 
 private:
+    friend class DisplayRefreshMonitor;
+    void displayDidRefresh(DisplayRefreshMonitor*);
+    
     DisplayRefreshMonitorManager() { }
+    DisplayRefreshMonitor* ensureMonitorForClient(DisplayRefreshMonitorClient*);
 
-    size_t findMonitor(PlatformDisplayID) const;
-    
-    Vector<DisplayRefreshMonitor*> m_monitors;
+    // We know nothing about the values of PlatformDisplayIDs, so use UnsignedWithZeroKeyHashTraits.
+    typedef HashMap<uint64_t, RefPtr<DisplayRefreshMonitor>, WTF::IntHash<uint64_t>, WTF::UnsignedWithZeroKeyHashTraits<uint64_t> > DisplayRefreshMonitorMap;
+    DisplayRefreshMonitorMap m_monitors;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/Font.cpp b/Source/WebCore/platform/graphics/Font.cpp
index de74a2b9b..2994698a5 100644
--- a/Source/WebCore/platform/graphics/Font.cpp
+++ b/Source/WebCore/platform/graphics/Font.cpp
@@ -93,7 +93,7 @@ Font::Font(const Font& other)
     , m_letterSpacing(other.m_letterSpacing)
     , m_wordSpacing(other.m_wordSpacing)
     , m_isPlatformFont(other.m_isPlatformFont)
-    , m_needsTranscoding(fontTranscoder().needsTranscoding(other.m_fontDescription))
+    , m_needsTranscoding(other.m_needsTranscoding)
 {
 }
 
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutPoint.h b/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
index 55eea5f1a..26550b96b 100644
--- a/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
+++ b/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
@@ -35,6 +35,14 @@
 #include "FractionalLayoutSize.h"
 #include <wtf/MathExtras.h>
 
+#if PLATFORM(QT)
+#include <qglobal.h>
+QT_BEGIN_NAMESPACE
+class QPoint;
+class QPointF;
+QT_END_NAMESPACE
+#endif
+
 namespace WebCore {
 
 class FractionalLayoutPoint {
@@ -82,6 +90,12 @@ public:
         return FractionalLayoutPoint(m_y, m_x);
     }
 
+#if PLATFORM(QT)
+    explicit FractionalLayoutPoint(const QPoint&);
+    explicit FractionalLayoutPoint(const QPointF&);
+    operator QPointF() const;
+#endif
+
 private:
     FractionalLayoutUnit m_x, m_y;
 };
@@ -153,12 +167,16 @@ inline IntPoint roundedIntPoint(const FractionalLayoutPoint& point)
     return IntPoint(point.x().round(), point.y().round());
 }
 
+inline IntPoint roundedIntPoint(const FractionalLayoutSize& size)
+{
+    return IntPoint(size.width().round(), size.height().round());
+}
+
 inline IntPoint ceiledIntPoint(const FractionalLayoutPoint& point)
 {
     return IntPoint(point.x().ceil(), point.y().ceil());
 }
 
-
 } // namespace WebCore
 
 #endif // FractionalLayoutPoint_h
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutRect.h b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
index ed5212d9e..d91be931a 100644
--- a/Source/WebCore/platform/graphics/FractionalLayoutRect.h
+++ b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
@@ -35,6 +35,14 @@
 #include "IntRect.h"
 #include <wtf/Vector.h>
 
+#if PLATFORM(QT)
+#include <qglobal.h>
+QT_BEGIN_NAMESPACE
+class QRect;
+class QRectF;
+QT_END_NAMESPACE
+#endif
+
 namespace WebCore {
 
 class FloatRect;
@@ -153,6 +161,12 @@ public:
 
     static FractionalLayoutRect infiniteRect() {return FractionalLayoutRect(FractionalLayoutUnit::min() / 2, FractionalLayoutUnit::min() / 2, FractionalLayoutUnit::max(), FractionalLayoutUnit::max()); }
 
+#if PLATFORM(QT)
+    explicit FractionalLayoutRect(const QRect&);
+    explicit FractionalLayoutRect(const QRectF&);
+    operator QRectF() const;
+#endif
+
 private:
     FractionalLayoutPoint m_location;
     FractionalLayoutSize m_size;
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutSize.h b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
index c2f0ae89a..49bd9fdc7 100644
--- a/Source/WebCore/platform/graphics/FractionalLayoutSize.h
+++ b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
@@ -35,6 +35,14 @@
 #include "FractionalLayoutUnit.h"
 #include "IntSize.h"
 
+#if PLATFORM(QT)
+#include <qglobal.h>
+QT_BEGIN_NAMESPACE
+class QSize;
+class QSizeF;
+QT_END_NAMESPACE
+#endif
+
 namespace WebCore {
 
 class FractionalLayoutPoint;
@@ -92,6 +100,12 @@ public:
         return FractionalLayoutSize(m_height, m_width);
     }
 
+#if PLATFORM(QT)
+    explicit FractionalLayoutSize(const QSize&);
+    explicit FractionalLayoutSize(const QSizeF&);
+    operator QSizeF() const;
+#endif
+
 private:
     FractionalLayoutUnit m_width, m_height;
 };
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.cpp b/Source/WebCore/platform/graphics/GraphicsContext.cpp
index 26b1bb753..6402b48cc 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsContext.cpp
@@ -482,8 +482,12 @@ void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const
 
     if (useLowQualityScale) {
         previousInterpolationQuality = imageInterpolationQuality();
+#if PLATFORM(CHROMIUM)
+        setImageInterpolationQuality(InterpolationLow);
+#else
         // FIXME (49002): Should be InterpolationLow
         setImageInterpolationQuality(InterpolationNone);
+#endif
     }
 
     if (image->isBitmapImage())
@@ -572,8 +576,12 @@ void GraphicsContext::drawImageBuffer(ImageBuffer* image, ColorSpace styleColorS
 
     if (useLowQualityScale) {
         InterpolationQuality previousInterpolationQuality = imageInterpolationQuality();
+#if PLATFORM(CHROMIUM)
+        setImageInterpolationQuality(InterpolationLow);
+#else
         // FIXME (49002): Should be InterpolationLow
         setImageInterpolationQuality(InterpolationNone);
+#endif
         image->draw(this, styleColorSpace, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), op, useLowQualityScale);
         setImageInterpolationQuality(previousInterpolationQuality);
     } else
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.cpp b/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
index c1b36f604..f01556b24 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
@@ -200,8 +200,13 @@ bool GraphicsContext3D::extractImageData(ImageData* imageData,
         return false;
     int width = imageData->width();
     int height = imageData->height();
-    int dataBytes = width * height * 4;
-    data.resize(dataBytes);
+
+    unsigned int packedSize;
+    // Output data is tightly packed (alignment == 1).
+    if (computeImageSizeInBytes(format, type, width, height, 1, &packedSize, 0) != GraphicsContext3D::NO_ERROR)
+        return false;
+    data.resize(packedSize);
+
     if (!packPixels(imageData->data()->data(),
                     SourceFormatRGBA8,
                     width,
@@ -704,6 +709,32 @@ void unpackOneRowOfA16BigToRGBA8(const uint16_t* source, uint8_t* destination, u
     }
 }
 
+void unpackOneRowOfRGBA8ToRGBA32F(const uint8_t* source, float* destination, unsigned int pixelsPerRow)
+{
+    const float scaleFactor = 1.0f / 255.0f;
+    for (unsigned int i = 0; i < pixelsPerRow; ++i) {
+        destination[0] = source[0] * scaleFactor;
+        destination[1] = source[1] * scaleFactor;
+        destination[2] = source[2] * scaleFactor;
+        destination[3] = source[3] * scaleFactor;
+        source += 4;
+        destination += 4;
+    }
+}
+
+void unpackOneRowOfBGRA8ToRGBA32F(const uint8_t* source, float* destination, unsigned int pixelsPerRow)
+{
+    const float scaleFactor = 1.0f / 255.0f;
+    for (unsigned int i = 0; i < pixelsPerRow; ++i) {
+        destination[0] = source[2] * scaleFactor;
+        destination[1] = source[1] * scaleFactor;
+        destination[2] = source[0] * scaleFactor;
+        destination[3] = source[3] * scaleFactor;
+        source += 4;
+        destination += 4;
+    }
+}
+
 void unpackOneRowOfRGB32FToRGBA32F(const float* source, float* destination, unsigned int pixelsPerRow)
 {
     for (unsigned int i = 0; i < pixelsPerRow; ++i) {
@@ -1062,6 +1093,31 @@ void packOneRowOfRGBA32FToRGB32FPremultiply(const float* source, float* destinat
     }
 }
 
+void packOneRowOfRGBA32FToRGB32FUnmultiply(const float* source, float* destination, unsigned int pixelsPerRow)
+{
+    for (unsigned int i = 0; i < pixelsPerRow; ++i) {
+        float scaleFactor = source[3] ? 1.0f / source[3] : 1.0f;
+        destination[0] = source[0] * scaleFactor;
+        destination[1] = source[1] * scaleFactor;
+        destination[2] = source[2] * scaleFactor;
+        source += 4;
+        destination += 3;
+    }
+}
+
+// Used only during RGBA8 or BGRA8 -> floating-point uploads.
+void packOneRowOfRGBA32FToRGBA32F(const float* source, float* destination, unsigned int pixelsPerRow)
+{
+    for (unsigned int i = 0; i < pixelsPerRow; ++i) {
+        destination[0] = source[0];
+        destination[1] = source[1];
+        destination[2] = source[2];
+        destination[3] = source[3];
+        source += 4;
+        destination += 4;
+    }
+}
+
 void packOneRowOfRGBA32FToRGBA32FPremultiply(const float* source, float* destination, unsigned int pixelsPerRow)
 {
     for (unsigned int i = 0; i < pixelsPerRow; ++i) {
@@ -1075,6 +1131,19 @@ void packOneRowOfRGBA32FToRGBA32FPremultiply(const float* source, float* destina
     }
 }
 
+void packOneRowOfRGBA32FToRGBA32FUnmultiply(const float* source, float* destination, unsigned int pixelsPerRow)
+{
+    for (unsigned int i = 0; i < pixelsPerRow; ++i) {
+        float scaleFactor = source[3] ? 1.0f / source[3] : 1.0f;
+        destination[0] = source[0] * scaleFactor;
+        destination[1] = source[1] * scaleFactor;
+        destination[2] = source[2] * scaleFactor;
+        destination[3] = source[3];
+        source += 4;
+        destination += 4;
+    }
+}
+
 void packOneRowOfRGBA32FToA32F(const float* source, float* destination, unsigned int pixelsPerRow)
 {
     for (unsigned int i = 0; i < pixelsPerRow; ++i) {
@@ -1103,6 +1172,15 @@ void packOneRowOfRGBA32FToR32FPremultiply(const float* source, float* destinatio
     }
 }
 
+void packOneRowOfRGBA32FToR32FUnmultiply(const float* source, float* destination, unsigned int pixelsPerRow)
+{
+    for (unsigned int i = 0; i < pixelsPerRow; ++i) {
+        float scaleFactor = source[3] ? 1.0f / source[3] : 1.0f;
+        destination[0] = source[0] * scaleFactor;
+        source += 4;
+        destination += 1;
+    }
+}
 
 void packOneRowOfRGBA32FToRA32F(const float* source, float* destination, unsigned int pixelsPerRow)
 {
@@ -1119,7 +1197,18 @@ void packOneRowOfRGBA32FToRA32FPremultiply(const float* source, float* destinati
     for (unsigned int i = 0; i < pixelsPerRow; ++i) {
         float scaleFactor = source[3];
         destination[0] = source[0] * scaleFactor;
-        destination[1] = scaleFactor;
+        destination[1] = source[3];
+        source += 4;
+        destination += 2;
+    }
+}
+
+void packOneRowOfRGBA32FToRA32FUnmultiply(const float* source, float* destination, unsigned int pixelsPerRow)
+{
+    for (unsigned int i = 0; i < pixelsPerRow; ++i) {
+        float scaleFactor = source[3] ? 1.0f / source[3] : 1.0f;
+        destination[0] = source[0] * scaleFactor;
+        destination[1] = source[3];
         source += 4;
         destination += 2;
     }
@@ -1367,6 +1456,16 @@ static void doFloatingPointPacking(const void* sourceData,
 {
     switch (sourceDataFormat) {
     case GraphicsContext3D::SourceFormatRGBA8: {
+        unsigned int sourceElementsPerRow = computeSourceElementsPerRow<uint8_t>(width, 4, sourceUnpackAlignment);
+        doUnpackingAndPacking<uint8_t, float, float>(static_cast<const uint8_t*>(sourceData), unpackOneRowOfRGBA8ToRGBA32F, width, height, sourceElementsPerRow, destinationData, rowPackingFunc, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::SourceFormatBGRA8: {
+        unsigned int sourceElementsPerRow = computeSourceElementsPerRow<uint8_t>(width, 4, sourceUnpackAlignment);
+        doUnpackingAndPacking<uint8_t, float, float>(static_cast<const uint8_t*>(sourceData), unpackOneRowOfBGRA8ToRGBA32F, width, height, sourceElementsPerRow, destinationData, rowPackingFunc, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::SourceFormatRGBA32F: {
         unsigned int sourceElementsPerRow = computeSourceElementsPerRow<float>(width, 4, sourceUnpackAlignment);
         const float* source = static_cast<const float*>(sourceData);
         const float* endPointer = source + height * sourceElementsPerRow;
@@ -1403,6 +1502,23 @@ static void doFloatingPointPacking(const void* sourceData,
     }
 }
 
+
+#if !ASSERT_DISABLED
+static bool isFloatingPointSource(GraphicsContext3D::SourceDataFormat format)
+{
+    switch (format) {
+    case GraphicsContext3D::SourceFormatRGBA32F:
+    case GraphicsContext3D::SourceFormatRGB32F:
+    case GraphicsContext3D::SourceFormatRA32F:
+    case GraphicsContext3D::SourceFormatR32F:
+    case GraphicsContext3D::SourceFormatA32F:
+        return true;
+    default:
+        return false;
+    }
+}
+#endif
+
 bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
                                    GraphicsContext3D::SourceDataFormat sourceDataFormat,
                                    unsigned int width,
@@ -1539,16 +1655,21 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
     }
     case FLOAT: {
         // OpenGL ES, and therefore WebGL, require that the format and
-        // internalformat be identical, which implies that the source and
-        // destination formats will both be floating-point in this branch -- at
-        // least, until WebKit supports floating-point image formats natively.
-        ASSERT(sourceDataFormat == SourceFormatRGBA32F || sourceDataFormat == SourceFormatRGB32F
-               || sourceDataFormat == SourceFormatRA32F || sourceDataFormat == SourceFormatR32F
-               || sourceDataFormat == SourceFormatA32F);
-        // Because WebKit doesn't use floating-point color channels for anything
-        // internally, there's no chance we have to do a (lossy) unmultiply
-        // operation.
-        ASSERT(alphaOp == AlphaDoNothing || alphaOp == AlphaDoPremultiply);
+        // internalformat be identical. This means that whenever the
+        // developer supplies an ArrayBufferView on this code path,
+        // the source data will be in a floating-point format.
+        //
+        // The only time the source data will not be floating-point is
+        // when uploading a DOM element or ImageData as a
+        // floating-point texture. Only RGBA8 and BGRA8 are handled in
+        // this case.
+        ASSERT(isFloatingPointSource(sourceDataFormat)
+               || sourceDataFormat == SourceFormatRGBA8
+               || sourceDataFormat == SourceFormatBGRA8);
+        // When uploading a canvas into a floating-point texture,
+        // unmultiplication may be necessary.
+        ASSERT((alphaOp == AlphaDoNothing || alphaOp == AlphaDoPremultiply)
+               || !isFloatingPointSource(sourceDataFormat));
         // For the source formats with an even number of channels (RGBA32F,
         // RA32F) it is guaranteed that the pixel data is tightly packed because
         // unpack alignment <= sizeof(float) * number of channels.
@@ -1570,14 +1691,25 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
             case AlphaDoPremultiply:
                 doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToRGB32FPremultiply, 3);
                 break;
-            default:
-                ASSERT_NOT_REACHED();
+            case AlphaDoUnmultiply:
+                doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToRGB32FUnmultiply, 3);
+                break;
             }
             break;
         case RGBA:
-            // AlphaDoNothing is handled above with fast path.
-            ASSERT(alphaOp == AlphaDoPremultiply);
-            doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToRGBA32FPremultiply, 4);
+            // AlphaDoNothing for RGBA32F -> RGBA is handled above with fast path.
+            ASSERT(alphaOp != AlphaDoNothing || sourceDataFormat != SourceFormatRGBA32F);
+            switch (alphaOp) {
+            case AlphaDoNothing:
+                doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToRGBA32F, 4);
+                break;
+            case AlphaDoPremultiply:
+                doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToRGBA32FPremultiply, 4);
+                break;
+            case AlphaDoUnmultiply:
+                doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToRGBA32FUnmultiply, 4);
+                break;
+            }
             break;
         case ALPHA:
             // From the desktop OpenGL conversion rules (OpenGL 2.1
@@ -1596,8 +1728,9 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
             case AlphaDoPremultiply:
                 doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToR32FPremultiply, 1);
                 break;
-            default:
-                ASSERT_NOT_REACHED();
+            case AlphaDoUnmultiply:
+                doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToR32FUnmultiply, 1);
+                break;
             }
             break;
         case LUMINANCE_ALPHA:
@@ -1611,8 +1744,9 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
             case AlphaDoPremultiply:
                 doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToRA32FPremultiply, 2);
                 break;
-            default:
-                ASSERT_NOT_REACHED();
+            case AlphaDoUnmultiply:
+                doFloatingPointPacking(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, packOneRowOfRGBA32FToRA32FUnmultiply, 2);
+                break;
             }
             break;
         }
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index 2ab07ab93..692da56a5 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -92,7 +92,6 @@ const Platform3DObject NullPlatform3DObject = 0;
 #endif
 
 namespace WebCore {
-class CanvasRenderingContext;
 class DrawingBuffer;
 class Extensions3D;
 #if PLATFORM(MAC) || PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(EFL)
@@ -807,9 +806,9 @@ public:
     void markLayerComposited();
     bool layerComposited() const;
 
-    void paintRenderingResultsToCanvas(CanvasRenderingContext*, DrawingBuffer*);
+    void paintRenderingResultsToCanvas(ImageBuffer*, DrawingBuffer*);
     PassRefPtr<ImageData> paintRenderingResultsToImageData(DrawingBuffer*);
-    bool paintCompositedResultsToCanvas(CanvasRenderingContext*);
+    bool paintCompositedResultsToCanvas(ImageBuffer*);
 
     // Support for buffer creation and deletion
     Platform3DObject createBuffer();
diff --git a/Source/WebCore/platform/graphics/ImageSource.h b/Source/WebCore/platform/graphics/ImageSource.h
index 307737f20..6d01c8605 100644
--- a/Source/WebCore/platform/graphics/ImageSource.h
+++ b/Source/WebCore/platform/graphics/ImageSource.h
@@ -63,12 +63,7 @@ class IntSize;
 class SharedBuffer;
 
 #if USE(CG)
-#if USE(WEBKIT_IMAGE_DECODERS)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
-#else
 typedef CGImageSourceRef NativeImageSourcePtr;
-#endif
 typedef CGImageRef NativeImagePtr;
 #elif PLATFORM(OPENVG)
 class ImageDecoder;
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index d873ec5ec..253d9a2f4 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -325,6 +325,7 @@ MediaPlayer::MediaPlayer(MediaPlayerClient* client)
     , m_preservesPitch(true)
     , m_privateBrowsing(false)
     , m_shouldPrepareToRender(false)
+    , m_contentMIMETypeWasInferredFromExtension(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_playerProxy(0)
 #endif
@@ -347,44 +348,45 @@ MediaPlayer::~MediaPlayer()
 
 bool MediaPlayer::load(const KURL& url, const ContentType& contentType, const String& keySystem)
 {
-    String type = contentType.type().lower();
-    String typeCodecs = contentType.parameter(codecs());
-    String urlString = url.string();
+    m_contentMIMEType = contentType.type().lower();
+    m_contentTypeCodecs = contentType.parameter(codecs());
+    m_url = url.string();
+    m_keySystem = keySystem.lower();
+    m_contentMIMETypeWasInferredFromExtension = false;
 
     // If the MIME type is missing or is not meaningful, try to figure it out from the URL.
-    if (type.isEmpty() || type == applicationOctetStream() || type == textPlain()) {
-        if (protocolIs(urlString, "data"))
-            type = mimeTypeFromDataURL(urlString);
+    if (m_contentMIMEType.isEmpty() || m_contentMIMEType == applicationOctetStream() || m_contentMIMEType == textPlain()) {
+        if (protocolIs(m_url, "data"))
+            m_contentMIMEType = mimeTypeFromDataURL(m_url);
         else {
             String lastPathComponent = url.lastPathComponent();
             size_t pos = lastPathComponent.reverseFind('.');
             if (pos != notFound) {
                 String extension = lastPathComponent.substring(pos + 1);
                 String mediaType = MIMETypeRegistry::getMediaMIMETypeForExtension(extension);
-                if (!mediaType.isEmpty())
-                    type = mediaType;
+                if (!mediaType.isEmpty()) {
+                    m_contentMIMEType = mediaType;
+                    m_contentMIMETypeWasInferredFromExtension = true;
+                }
             }
         }
     }
 
-    m_url = urlString;
-    m_contentMIMEType = type;
-    m_contentTypeCodecs = typeCodecs;
-    m_keySystem = keySystem.lower();
     loadWithNextMediaEngine(0);
     return m_currentMediaEngine;
 }
 
 void MediaPlayer::loadWithNextMediaEngine(MediaPlayerFactory* current)
 {
-    MediaPlayerFactory* engine;
+    MediaPlayerFactory* engine = 0;
 
-    // If no MIME type is specified, just use the next engine.
-    if (m_contentMIMEType.isEmpty())
-        engine = nextMediaEngine(current);
-    else
+    if (!m_contentMIMEType.isEmpty())
         engine = bestMediaEngineForTypeAndCodecs(m_contentMIMEType, m_contentTypeCodecs, m_keySystem, current);
 
+    // If no MIME type is specified or the type was inferred from the file extension, just use the next engine.
+    if (!engine && (m_contentMIMEType.isEmpty() || m_contentMIMETypeWasInferredFromExtension))
+        engine = nextMediaEngine(current);
+
     // Don't delete and recreate the player unless it comes from a different engine.
     if (!engine) {
         LOG(Media, "MediaPlayer::loadWithNextMediaEngine - no media engine found for type \"%s\"", m_contentMIMEType.utf8().data());
@@ -710,7 +712,7 @@ void MediaPlayer::paintCurrentFrameInContext(GraphicsContext* p, const IntRect&
     m_private->paintCurrentFrameInContext(p, r);
 }
 
-MediaPlayer::SupportsType MediaPlayer::supportsType(const ContentType& contentType, const String& keySystem)
+MediaPlayer::SupportsType MediaPlayer::supportsType(const ContentType& contentType, const String& keySystem, const MediaPlayerSupportsTypeClient* client)
 {
     String type = contentType.type().lower();
     // The codecs string is not lower-cased because MP4 values are case sensitive
@@ -727,6 +729,21 @@ MediaPlayer::SupportsType MediaPlayer::supportsType(const ContentType& contentTy
     if (!engine)
         return IsNotSupported;
 
+#if PLATFORM(MAC)
+    // YouTube will ask if the HTMLMediaElement canPlayType video/webm, then
+    // video/x-flv, then finally video/mp4, and will then load a URL of the first type
+    // in that list which returns "probably". When Perian is installed,
+    // MediaPlayerPrivateQTKit claims to support both video/webm and video/x-flv, but
+    // due to a bug in Perian, loading media in these formats will sometimes fail on
+    // slow connections. <https://bugs.webkit.org/show_bug.cgi?id=86409>
+    if (client && client->mediaPlayerNeedsSiteSpecificHacks()) {
+        String host = client->mediaPlayerDocumentHost();
+        if ((host.endsWith(".youtube.com", false) || equalIgnoringCase("youtube.com", host))
+            && (contentType.type().startsWith("video/webm", false) || contentType.type().startsWith("video/x-flv", false)))
+            return IsNotSupported;
+    }
+#endif
+
 #if ENABLE(ENCRYPTED_MEDIA)
     return engine->supportsTypeAndCodecs(type, typeCodecs, system);
 #else
@@ -770,9 +787,9 @@ void MediaPlayer::setControls(bool controls)
 #endif
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO) || USE(NATIVE_FULLSCREEN_VIDEO)
-bool MediaPlayer::enterFullscreen() const
+void MediaPlayer::enterFullscreen()
 {
-    return m_private->enterFullscreen();
+    m_private->enterFullscreen();
 }
 
 void MediaPlayer::exitFullscreen()
@@ -781,6 +798,13 @@ void MediaPlayer::exitFullscreen()
 }
 #endif
 
+#if USE(NATIVE_FULLSCREEN_VIDEO)
+bool MediaPlayer::canEnterFullscreen() const
+{
+    return m_private->canEnterFullscreen();
+}
+#endif
+
 #if USE(ACCELERATED_COMPOSITING)
 void MediaPlayer::acceleratedRenderingStateChanged()
 {
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index 00ca06450..044d15370 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -180,6 +180,14 @@ public:
     virtual String mediaPlayerUserAgent() const { return String(); }
 };
 
+class MediaPlayerSupportsTypeClient {
+public:
+    virtual ~MediaPlayerSupportsTypeClient() { }
+
+    virtual bool mediaPlayerNeedsSiteSpecificHacks() const { return false; }
+    virtual String mediaPlayerDocumentHost() const { return String(); }
+};
+
 class MediaPlayer {
     WTF_MAKE_NONCOPYABLE(MediaPlayer); WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -192,7 +200,7 @@ public:
 
     // Media engine support.
     enum SupportsType { IsNotSupported, IsSupported, MayBeSupported };
-    static MediaPlayer::SupportsType supportsType(const ContentType&, const String& keySystem);
+    static MediaPlayer::SupportsType supportsType(const ContentType&, const String& keySystem, const MediaPlayerSupportsTypeClient*);
     static void getSupportedTypes(HashSet<String>&);
     static bool isAvailable();
     static void getSitesInMediaCache(Vector<String>&);
@@ -327,10 +335,14 @@ public:
 #endif
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO) || USE(NATIVE_FULLSCREEN_VIDEO)
-    bool enterFullscreen() const;
+    void enterFullscreen();
     void exitFullscreen();
 #endif
 
+#if USE(NATIVE_FULLSCREEN_VIDEO)
+    bool canEnterFullscreen() const;
+#endif
+
 #if USE(ACCELERATED_COMPOSITING)
     // whether accelerated rendering is supported by the media engine for the current media.
     bool supportsAcceleratedRendering() const;
@@ -395,6 +407,7 @@ private:
     bool m_preservesPitch;
     bool m_privateBrowsing;
     bool m_shouldPrepareToRender;
+    bool m_contentMIMETypeWasInferredFromExtension;
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     WebMediaPlayerProxy* m_playerProxy;    // not owned or used, passed to m_private
 #endif
diff --git a/Source/WebCore/platform/graphics/MediaPlayerPrivate.h b/Source/WebCore/platform/graphics/MediaPlayerPrivate.h
index 175d7c5bc..c3a3dfa6a 100644
--- a/Source/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/Source/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -118,10 +118,14 @@ public:
 #endif
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO) || USE(NATIVE_FULLSCREEN_VIDEO)
-    virtual bool enterFullscreen() const { return false; }
+    virtual void enterFullscreen() const { }
     virtual void exitFullscreen() { }
 #endif
 
+#if USE(NATIVE_FULLSCREEN_VIDEO)
+    virtual bool canEnterFullscreen() const { return false; }
+#endif
+
 #if USE(ACCELERATED_COMPOSITING)
     // whether accelerated rendering is supported by the media engine for the current media.
     virtual bool supportsAcceleratedRendering() const { return false; }
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.cpp b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
index 8484da971..b485dcf17 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -84,16 +84,20 @@ void TiledBackingStore::coverWithTilesIfNeeded(const FloatPoint& trajectoryVecto
 
 void TiledBackingStore::invalidate(const IntRect& contentsDirtyRect)
 {
-    IntRect dirtyRect(intersection(mapFromContents(contentsDirtyRect), m_keepRect));
+    IntRect dirtyRect(mapFromContents(contentsDirtyRect));
 
-    Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.location());
-    Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(dirtyRect));
+    // Only iterate on the part of the rect that we know we might have tiles.
+    IntRect coveredDirtyRect = intersection(dirtyRect, m_keepRect);
+    Tile::Coordinate topLeft = tileCoordinateForPoint(coveredDirtyRect.location());
+    Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(coveredDirtyRect));
 
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
         for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
             RefPtr<Tile> currentTile = tileAt(Tile::Coordinate(xCoordinate, yCoordinate));
             if (!currentTile)
                 continue;
+            // Pass the full rect to each tile as coveredDirtyRect might not
+            // contain them completely and we don't want partial tile redraws.
             currentTile->invalidate(dirtyRect);
         }
     }
diff --git a/Source/WebCore/platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp
index f704e2a8b..459268d8e 100644
--- a/Source/WebCore/platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp
@@ -40,7 +40,7 @@ void DisplayAnimationClient::animationFrameChanged()
 DisplayRefreshMonitor::~DisplayRefreshMonitor()
 {
     stopAnimationClient();
-    cancelCallOnMainThread(DisplayRefreshMonitor::refreshDisplayOnMainThread, this);
+    cancelCallOnMainThread(DisplayRefreshMonitor::handleDisplayRefreshedNotificationOnMainThread, this);
 }
 
 void DisplayRefreshMonitor::startAnimationClient()
@@ -83,7 +83,7 @@ void DisplayRefreshMonitor::displayLinkFired()
 
     m_timestamp = currentTime();
 
-    callOnMainThread(refreshDisplayOnMainThread, this);
+    callOnMainThread(handleDisplayRefreshedNotificationOnMainThread, this);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
index 30de0d3f7..dc9a534af 100644
--- a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
@@ -722,6 +722,14 @@ bool MediaPlayerPrivate::isFullscreen() const
     return m_fullscreenWebPageClient;
 }
 
+bool MediaPlayerPrivate::isElementPaused() const
+{
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+    if (!element || element->paused())
+        return true;
+    return false;
+}
+
 bool MediaPlayerPrivate::isTabVisible() const
 {
     if (frameView() && frameView()->hostWindow())
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
index 186d77c30..bcc5473a6 100644
--- a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
@@ -132,6 +132,7 @@ public:
 #endif
 
     virtual bool isFullscreen() const;
+    virtual bool isElementPaused() const;
     virtual bool isTabVisible() const;
     virtual int showErrorDialog(BlackBerry::Platform::MMRPlayer::Error);
     virtual BlackBerry::Platform::Graphics::Window* platformWindow();
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index 6d89f545d..083fb7a26 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -1412,9 +1412,10 @@ void GraphicsLayerCA::ensureStructuralLayer(StructuralLayerPurpose purpose, floa
     updateTransform();
     updateChildrenTransform();
     updateBackfaceVisibility();
-    
 #if ENABLE(CSS_FILTERS)
-    updateFilters();
+    // Filters cause flattening, so we should never have a layer for preserve-3d.
+    if (purpose != StructuralLayerForPreserves3D)
+        updateFilters();
 #endif
     
     // Set properties of m_layer to their default values, since these are expressed on on the structural layer.
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
index 8c90f986c..666ea3946 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
@@ -86,7 +86,8 @@ void TileCache::tileCacheLayerBoundsChanged()
 
 void TileCache::setNeedsDisplay()
 {
-    setNeedsDisplayInRect(IntRect(0, 0, std::numeric_limits<int>::max(), std::numeric_limits<int>::max()));
+    for (TileMap::const_iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it)
+        [it->second.get() setNeedsDisplay];
 }
 
 void TileCache::setNeedsDisplayInRect(const IntRect& rect)
diff --git a/Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp b/Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp
index 979dfed1b..e9fa5be8d 100644
--- a/Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp
@@ -58,8 +58,6 @@ BitmapImage::BitmapImage(NativeImageCairo* nativeImage, ImageObserver* observer)
     , m_sizeAvailable(true)
     , m_haveFrameCount(true)
 {
-    initPlatformData();
-
     cairo_surface_t* surface = nativeImage->surface();
     int width = cairo_image_surface_get_width(surface);
     int height = cairo_image_surface_get_height(surface);
diff --git a/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
index 114c7e171..4c590a63b 100644
--- a/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
@@ -98,7 +98,7 @@ unsigned DrawingBuffer::frontColorBuffer() const
     return colorBuffer();
 }
 
-void DrawingBuffer::paintCompositedResultsToCanvas(CanvasRenderingContext* context)
+void DrawingBuffer::paintCompositedResultsToCanvas(ImageBuffer*)
 {
 }
 #endif
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
index 8d3969214..0fa2745e0 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
@@ -185,7 +185,12 @@ bool GraphicsContext3D::getImageData(Image* image, unsigned int format, unsigned
             ++srcUnpackAlignment;
     }
 
-    outputVector.resize(width * height * 4);
+    unsigned int packedSize;
+    // Output data is tightly packed (alignment == 1).
+    if (computeImageSizeInBytes(format, type, width, height, 1, &packedSize, 0) != GraphicsContext3D::NO_ERROR)
+        return false;
+    outputVector.resize(packedSize);
+
     return packPixels(cairo_image_surface_get_data(imageSurface.get()), SourceFormatBGRA8,
                       width, height, srcUnpackAlignment, format, type, alphaOp, outputVector.data());
 }
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
index 57abe71a3..e044b8d9a 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
@@ -240,7 +240,13 @@ bool GraphicsContext3D::getImageData(Image* image,
     if (!pixelData)
         return false;
     const UInt8* rgba = CFDataGetBytePtr(pixelData.get());
-    outputVector.resize(width * height * 4);
+
+    unsigned int packedSize;
+    // Output data is tightly packed (alignment == 1).
+    if (computeImageSizeInBytes(format, type, width, height, 1, &packedSize, 0) != GraphicsContext3D::NO_ERROR)
+        return false;
+    outputVector.resize(packedSize);
+
     unsigned int srcUnpackAlignment = 0;
     size_t bytesPerRow = CGImageGetBytesPerRow(cgImage);
     unsigned int padding = bytesPerRow - bitsPerPixel / 8 * width;
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index a6c94e5fc..70d590dd6 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -37,7 +37,7 @@
 #include "Path.h"
 #include "Pattern.h"
 #include "ShadowBlur.h"
-
+#include "Timer.h"
 #include <CoreGraphics/CoreGraphics.h>
 #include <wtf/MathExtras.h>
 #include <wtf/OwnArrayPtr.h>
@@ -73,8 +73,142 @@ extern "C" {
 
 using namespace std;
 
+// FIXME: The following using declaration should be in <wtf/HashFunctions.h>.
+using WTF::intHash;
+
+// FIXME: The following using declaration should be in <wtf/HashTraits.h>.
+using WTF::GenericHashTraits;
+
+#define CACHE_SUBIMAGES 1
+
 namespace WebCore {
-    
+
+#if !CACHE_SUBIMAGES
+
+static inline RetainPtr<CGImageRef> subimage(CGImageRef image, const FloatRect& rect)
+{
+    return adoptCF(CGImageCreateWithImageInRect(image, rect));
+}
+
+#else // CACHE_SUBIMAGES
+
+static const double subimageCacheClearDelay = 1;
+static const int maxSubimageCacheSize = 300;
+
+struct SubimageCacheEntry {
+    RetainPtr<CGImageRef> image;
+    FloatRect rect;
+    RetainPtr<CGImageRef> subimage;
+};
+
+struct SubimageCacheEntryTraits : GenericHashTraits<SubimageCacheEntry> {
+    typedef HashTraits<RetainPtr<CGImageRef> > ImageTraits;
+
+    static const bool emptyValueIsZero = true;
+
+    static const bool hasIsEmptyValueFunction = true;
+    static bool isEmptyValue(const SubimageCacheEntry& value) { return !value.image; }
+
+    static void constructDeletedValue(SubimageCacheEntry& slot) { ImageTraits::constructDeletedValue(slot.image); }
+    static bool isDeletedValue(const SubimageCacheEntry& value) { return ImageTraits::isDeletedValue(value.image); }
+};
+
+struct SubimageCacheHash {
+    static unsigned hash(CGImageRef image, const FloatRect& rect)
+    {
+        return intHash((static_cast<uint64_t>(PtrHash<CGImageRef>::hash(image)) << 32)
+            | (static_cast<unsigned>(rect.x()) << 16) | static_cast<unsigned>(rect.y()));
+    }
+    static unsigned hash(const SubimageCacheEntry& key)
+    {
+        return hash(key.image.get(), key.rect);
+    }
+    static bool equal(const SubimageCacheEntry& a, const SubimageCacheEntry& b)
+    {
+        return a.image == b.image && a.rect == b.rect;
+    }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+typedef HashSet<SubimageCacheEntry, SubimageCacheHash, SubimageCacheEntryTraits> SubimageCache;
+
+class SubimageCacheTimer : private TimerBase {
+public:
+    SubimageCacheTimer() : m_shouldRestartWhenTimerFires(false) { }
+    void restart();
+private:
+    virtual void fired() OVERRIDE;
+    bool m_shouldRestartWhenTimerFires;
+};
+
+struct SubimageCacheWithTimer {
+    SubimageCache cache;
+    SubimageCacheTimer timer;
+};
+
+static SubimageCacheWithTimer& subimageCache()
+{
+    static SubimageCacheWithTimer& cache = *new SubimageCacheWithTimer;
+    return cache;
+}
+
+inline void SubimageCacheTimer::restart()
+{
+    // Setting this boolean is much more efficient than calling startOneShot
+    // again, which might result in rescheduling the system timer and that
+    // can be quite expensive.
+    if (isActive()) {
+        m_shouldRestartWhenTimerFires = true;
+        return;
+    }
+    startOneShot(subimageCacheClearDelay);
+}
+
+void SubimageCacheTimer::fired()
+{
+    if (m_shouldRestartWhenTimerFires) {
+        m_shouldRestartWhenTimerFires = false;
+        startOneShot(subimageCacheClearDelay);
+        return;
+    }
+    subimageCache().cache.clear();
+}
+
+struct SubimageRequest {
+    CGImageRef image;
+    const FloatRect& rect;
+    SubimageRequest(CGImageRef image, const FloatRect& rect) : image(image), rect(rect) { }
+};
+
+struct SubimageCacheAdder {
+    static unsigned hash(const SubimageRequest& value)
+    {
+        return SubimageCacheHash::hash(value.image, value.rect);
+    }
+    static bool equal(const SubimageCacheEntry& a, const SubimageRequest& b)
+    {
+        return a.image == b.image && a.rect == b.rect;
+    }
+    static void translate(SubimageCacheEntry& entry, const SubimageRequest& request, unsigned /*hashCode*/)
+    {
+        entry.image = request.image;
+        entry.rect = request.rect;
+        entry.subimage = adoptCF(CGImageCreateWithImageInRect(request.image, request.rect));
+    }
+};
+
+static RetainPtr<CGImageRef> subimage(CGImageRef image, const FloatRect& rect)
+{
+    SubimageCacheWithTimer& cache = subimageCache();
+    cache.timer.restart();
+    if (cache.cache.size() == maxSubimageCacheSize)
+        cache.cache.remove(cache.cache.begin());
+    ASSERT(cache.cache.size() < maxSubimageCacheSize);
+    return cache.cache.add<SubimageRequest, SubimageCacheAdder>(SubimageRequest(image, rect)).iterator->subimage;
+}
+
+#endif // CACHE_SUBIMAGES
+
 static CGColorSpaceRef createLinearSRGBColorSpace()
 {
     // If we fail to load the linearized sRGB ICC profile, fall back to DeviceRGB.
@@ -212,7 +346,7 @@ void GraphicsContext::drawNativeImage(NativeImagePtr imagePtr, const FloatSize&
             subimageRect.setHeight(ceilf(subimageRect.height() + topPadding));
             adjustedDestRect.setHeight(subimageRect.height() / yScale);
 
-            image.adoptCF(CGImageCreateWithImageInRect(image.get(), subimageRect));
+            image = subimage(image.get(), subimageRect);
             if (currHeight < srcRect.maxY()) {
                 ASSERT(CGImageGetHeight(image.get()) == currHeight - CGRectIntegral(srcRect).origin.y);
                 adjustedDestRect.setHeight(CGImageGetHeight(image.get()) / yScale);
diff --git a/Source/WebCore/platform/graphics/cg/ImageCG.cpp b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
index 559ba1f8e..34a9c07bc 100644
--- a/Source/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -86,8 +86,6 @@ BitmapImage::BitmapImage(CGImageRef cgImage, ImageObserver* observer)
     , m_sizeAvailable(true)
     , m_haveFrameCount(true)
 {
-    initPlatformData();
-    
     CGFloat width = CGImageGetWidth(cgImage);
     CGFloat height = CGImageGetHeight(cgImage);
     m_decodedSize = width * height * 4;
@@ -194,7 +192,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
 {
     startAnimation();
 
-    RetainPtr<CGImageRef> image = frameAtIndex(m_currentFrame);
+    CGImageRef image = frameAtIndex(m_currentFrame);
     if (!image) // If it's too early we won't have an image yet.
         return;
     
@@ -209,7 +207,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
     if (shouldRespectImageOrientation == RespectImageOrientation)
         orientation = frameOrientationAtIndex(m_currentFrame);
 
-    ctxt->drawNativeImage(image.get(), selfSize, styleColorSpace, destRect, srcRect, compositeOp, orientation);
+    ctxt->drawNativeImage(image, selfSize, styleColorSpace, destRect, srcRect, compositeOp, orientation);
 
     if (imageObserver())
         imageObserver()->didDraw(this);
diff --git a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
index e33dc27eb..88d3804fa 100644
--- a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
@@ -206,7 +206,7 @@ Platform3DObject DrawingBuffer::framebuffer() const
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-void DrawingBuffer::paintCompositedResultsToCanvas(CanvasRenderingContext* context)
+void DrawingBuffer::paintCompositedResultsToCanvas(ImageBuffer* imageBuffer)
 {
     if (!m_context->makeContextCurrent() || m_context->getExtensions()->getGraphicsResetStatusARB() != GraphicsContext3D::NO_ERROR)
         return;
@@ -224,7 +224,7 @@ void DrawingBuffer::paintCompositedResultsToCanvas(CanvasRenderingContext* conte
     m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, frontColorBuffer(), 0);
 
     Extensions3DChromium* extensions = static_cast<Extensions3DChromium*>(m_context->getExtensions());
-    extensions->paintFramebufferToCanvas(framebuffer, framebufferSize.width(), framebufferSize.height(), !m_context->getContextAttributes().premultipliedAlpha, context->canvas()->buffer());
+    extensions->paintFramebufferToCanvas(framebuffer, framebufferSize.width(), framebufferSize.height(), !m_context->getContextAttributes().premultipliedAlpha, imageBuffer);
     m_context->deleteFramebuffer(framebuffer);
 
     m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, previousFramebuffer);
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index 9ef31b25b..9aa27cc33 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -55,14 +55,22 @@
 #include "LayerChromium.h"
 #include "LinkHighlight.h"
 #include "PlatformString.h"
+#include "SkMatrix44.h"
 #include "SystemTime.h"
 
+#include <public/WebFloatPoint.h>
+#include <public/WebFloatRect.h>
+#include <public/WebSize.h>
+#include <public/WebTransformationMatrix.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/StringExtras.h>
 #include <wtf/text/CString.h>
 
 using namespace std;
 
+using WebKit::WebContentLayer;
+using WebKit::WebLayer;
+
 namespace WebCore {
 
 PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
@@ -77,7 +85,7 @@ GraphicsLayerChromium::GraphicsLayerChromium(GraphicsLayerClient* client)
     , m_inSetChildren(false)
     , m_pageScaleChanged(false)
 {
-    m_layer = ContentLayerChromium::create(this);
+    m_layer = WebContentLayer(ContentLayerChromium::create(this));
 
     updateDebugIndicators();
 }
@@ -90,22 +98,20 @@ GraphicsLayerChromium::~GraphicsLayerChromium()
 
 void GraphicsLayerChromium::willBeDestroyed()
 {
-    if (m_layer) {
-        m_layer->clearDelegate();
-        m_layer->clearRenderSurface();
-        // Primary layer may have at one point been m_layer. Be sure to reset
-        // the delegate, just in case.
-        m_layer->setLayerAnimationDelegate(0);
+    if (!m_layer.isNull()) {
+        m_layer.clearClient();
+        m_layer.unwrap<LayerChromium>()->clearRenderSurface();
+        m_layer.unwrap<LayerChromium>()->setLayerAnimationDelegate(0);
     }
 
-    if (m_contentsLayer)
-        m_contentsLayer->clearRenderSurface();
+    if (!m_contentsLayer.isNull()) {
+        m_contentsLayer.unwrap<LayerChromium>()->clearRenderSurface();
+        m_contentsLayer.unwrap<LayerChromium>()->setLayerAnimationDelegate(0);
+    }
 
-    if (m_transformLayer) {
-        m_transformLayer->clearRenderSurface();
-        // Primary layer may have switched from m_layer to m_transformLayer.
-        // Be sure to reset the delegate, just in case.
-        m_transformLayer->setLayerAnimationDelegate(0);
+    if (!m_transformLayer.isNull()) {
+        m_transformLayer.unwrap<LayerChromium>()->clearRenderSurface();
+        m_transformLayer.unwrap<LayerChromium>()->setLayerAnimationDelegate(0);
     }
 
     if (m_linkHighlight)
@@ -117,19 +123,19 @@ void GraphicsLayerChromium::willBeDestroyed()
 void GraphicsLayerChromium::setName(const String& inName)
 {
     m_nameBase = inName;
-    String name = String::format("GraphicsLayerChromium(%p) GraphicsLayer(%p) ", m_layer.get(), this) + inName;
+    String name = String::format("GraphicsLayerChromium(%p) GraphicsLayer(%p) ", m_layer.unwrap<LayerChromium>(), this) + inName;
     GraphicsLayer::setName(name);
     updateNames();
 }
 
 void GraphicsLayerChromium::updateNames()
 {
-    if (m_layer)
-        m_layer->setDebugName("Layer for " + m_nameBase);
-    if (m_transformLayer)
-        m_transformLayer->setDebugName("TransformLayer for " + m_nameBase);
-    if (m_contentsLayer)
-        m_contentsLayer->setDebugName("ContentsLayer for " + m_nameBase);
+    if (!m_layer.isNull())
+        m_layer.unwrap<LayerChromium>()->setDebugName("Layer for " + m_nameBase);
+    if (!m_transformLayer.isNull())
+        m_transformLayer.unwrap<LayerChromium>()->setDebugName("TransformLayer for " + m_nameBase);
+    if (!m_contentsLayer.isNull())
+        m_contentsLayer.unwrap<LayerChromium>()->setDebugName("ContentsLayer for " + m_nameBase);
     if (m_linkHighlight)
         m_linkHighlight->contentLayer()->setDebugName("LinkHighlight for " + m_nameBase);
 }
@@ -183,7 +189,7 @@ bool GraphicsLayerChromium::replaceChild(GraphicsLayer* oldChild, GraphicsLayer*
 void GraphicsLayerChromium::removeFromParent()
 {
     GraphicsLayer::removeFromParent();
-    layerForParent()->removeFromParent();
+    layerForParent().removeFromParent();
 }
 
 void GraphicsLayerChromium::setPosition(const FloatPoint& point)
@@ -213,14 +219,14 @@ void GraphicsLayerChromium::setSize(const FloatSize& size)
     GraphicsLayer::setSize(clampedSize);
     updateLayerSize();
 
-    if (m_pageScaleChanged && m_layer)
-        m_layer->setNeedsDisplay();
+    if (m_pageScaleChanged && !m_layer.isNull())
+        m_layer.invalidate();
     m_pageScaleChanged = false;
 }
 
 void GraphicsLayerChromium::setTransform(const TransformationMatrix& transform)
 {
-    // Call this method first to assign contents scale to LayerChromium so the painter can apply the scale transform.
+    // Call this method first to assign contents scale to our layer so the painter can apply the scale transform.
     updateContentsScale();
 
     GraphicsLayer::setTransform(transform);
@@ -251,7 +257,7 @@ void GraphicsLayerChromium::setMasksToBounds(bool masksToBounds)
 void GraphicsLayerChromium::setDrawsContent(bool drawsContent)
 {
     // Note carefully this early-exit is only correct because we also properly initialize
-    // LayerChromium::isDrawable() whenever m_contentsLayer is set to a new layer in setupContentsLayer().
+    // LayerChromium::m_isDrawable whenever m_contentsLayer is set to a new layer in setupContentsLayer().
     if (drawsContent == m_drawsContent)
         return;
 
@@ -262,7 +268,7 @@ void GraphicsLayerChromium::setDrawsContent(bool drawsContent)
 void GraphicsLayerChromium::setContentsVisible(bool contentsVisible)
 {
     // Note carefully this early-exit is only correct because we also properly initialize
-    // LayerChromium::isDrawable() whenever m_contentsLayer is set to a new layer in setupContentsLayer().
+    // LayerChromium::m_isDrawable whenever m_contentsLayer is set to a new layer in setupContentsLayer().
     if (contentsVisible == m_contentsVisible)
         return;
 
@@ -272,7 +278,7 @@ void GraphicsLayerChromium::setContentsVisible(bool contentsVisible)
 
 void GraphicsLayerChromium::setBackgroundColor(const Color& color)
 {
-    GraphicsLayer::setBackgroundColor(color);
+    GraphicsLayer::setBackgroundColor(color.rgb());
 
     m_contentsLayerHasBackgroundColor = true;
     updateLayerBackgroundColor();
@@ -281,18 +287,18 @@ void GraphicsLayerChromium::setBackgroundColor(const Color& color)
 void GraphicsLayerChromium::clearBackgroundColor()
 {
     GraphicsLayer::clearBackgroundColor();
-    m_contentsLayer->setBackgroundColor(static_cast<RGBA32>(0));
+    m_contentsLayer.setBackgroundColor(static_cast<RGBA32>(0));
 }
 
 void GraphicsLayerChromium::setContentsOpaque(bool opaque)
 {
     GraphicsLayer::setContentsOpaque(opaque);
-    m_layer->setOpaque(m_contentsOpaque);
+    m_layer.setOpaque(m_contentsOpaque);
 }
 
 bool GraphicsLayerChromium::setFilters(const FilterOperations& filters)
 {
-    m_layer->setFilters(filters);
+    m_layer.unwrap<LayerChromium>()->setFilters(filters);
     return GraphicsLayer::setFilters(filters);
 }
 
@@ -304,47 +310,47 @@ void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
     GraphicsLayer::setMaskLayer(maskLayer);
 
     LayerChromium* maskLayerChromium = m_maskLayer ? m_maskLayer->platformLayer() : 0;
-    m_layer->setMaskLayer(maskLayerChromium);
+    m_layer.unwrap<LayerChromium>()->setMaskLayer(maskLayerChromium);
 }
 
 void GraphicsLayerChromium::setBackfaceVisibility(bool visible)
 {
     GraphicsLayer::setBackfaceVisibility(visible);
-    m_layer->setDoubleSided(m_backfaceVisibility);
+    m_layer.setDoubleSided(m_backfaceVisibility);
 }
 
 void GraphicsLayerChromium::setOpacity(float opacity)
 {
     float clampedOpacity = max(min(opacity, 1.0f), 0.0f);
     GraphicsLayer::setOpacity(clampedOpacity);
-    primaryLayer()->setOpacity(opacity);
+    primaryLayer().setOpacity(opacity);
 }
 
 void GraphicsLayerChromium::setReplicatedByLayer(GraphicsLayer* layer)
 {
     GraphicsLayerChromium* layerChromium = static_cast<GraphicsLayerChromium*>(layer);
     GraphicsLayer::setReplicatedByLayer(layer);
-    LayerChromium* replicaLayer = layerChromium ? layerChromium->primaryLayer() : 0;
-    primaryLayer()->setReplicaLayer(replicaLayer);
+    LayerChromium* replicaLayer = layerChromium ? layerChromium->primaryLayer().unwrap<LayerChromium>() : 0;
+    primaryLayer().unwrap<LayerChromium>()->setReplicaLayer(replicaLayer);
 }
 
 
 void GraphicsLayerChromium::setContentsNeedsDisplay()
 {
-    if (m_contentsLayer)
-        m_contentsLayer->setNeedsDisplay();
+    if (!m_contentsLayer.isNull())
+        m_contentsLayer.invalidate();
 }
 
 void GraphicsLayerChromium::setNeedsDisplay()
 {
     if (drawsContent())
-        m_layer->setNeedsDisplay();
+        m_layer.invalidate();
 }
 
 void GraphicsLayerChromium::setNeedsDisplayInRect(const FloatRect& rect)
 {
     if (drawsContent())
-        m_layer->setNeedsDisplayRect(rect);
+        m_layer.invalidateRect(rect);
 }
 
 void GraphicsLayerChromium::setContentsRect(const IntRect& rect)
@@ -360,22 +366,22 @@ void GraphicsLayerChromium::setContentsToImage(Image* image)
 {
     bool childrenChanged = false;
     if (image) {
-        if (!m_contentsLayer.get() || m_contentsLayerPurpose != ContentsLayerForImage) {
+        if (m_contentsLayer.isNull() || m_contentsLayerPurpose != ContentsLayerForImage) {
             RefPtr<ImageLayerChromium> imageLayer = ImageLayerChromium::create();
             setupContentsLayer(imageLayer.get());
             m_contentsLayerPurpose = ContentsLayerForImage;
             childrenChanged = true;
         }
-        ImageLayerChromium* imageLayer = static_cast<ImageLayerChromium*>(m_contentsLayer.get());
+        ImageLayerChromium* imageLayer = static_cast<ImageLayerChromium*>(m_contentsLayer.unwrap<LayerChromium>());
         imageLayer->setContents(image);
         imageLayer->setOpaque(image->isBitmapImage() && !image->currentFrameHasAlpha());
         updateContentsRect();
     } else {
-        if (m_contentsLayer) {
+        if (!m_contentsLayer.isNull()) {
             childrenChanged = true;
 
             // The old contents layer will be removed via updateChildList.
-            m_contentsLayer = 0;
+            m_contentsLayer.reset();
         }
     }
 
@@ -387,18 +393,18 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
 {
     bool childrenChanged = false;
     if (platformLayer) {
-        if (m_contentsLayer.get() != platformLayer) {
+        if (m_contentsLayer.unwrap<LayerChromium>() != platformLayer) {
             setupContentsLayer(platformLayer);
             m_contentsLayerPurpose = ContentsLayerForCanvas;
             childrenChanged = true;
         }
         updateContentsRect();
     } else {
-        if (m_contentsLayer) {
+        if (!m_contentsLayer.isNull()) {
             childrenChanged = true;
 
             // The old contents layer will be removed via updateChildList.
-            m_contentsLayer = 0;
+            m_contentsLayer.reset();
         }
     }
 
@@ -408,18 +414,18 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
 
 bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
 {
-    primaryLayer()->setLayerAnimationDelegate(this);
-    return primaryLayer()->addAnimation(values, boxSize, animation, mapAnimationNameToId(animationName), AnimationIdVendor::getNextGroupId(), timeOffset);
+    primaryLayer().unwrap<LayerChromium>()->setLayerAnimationDelegate(this);
+    return primaryLayer().unwrap<LayerChromium>()->addAnimation(values, boxSize, animation, mapAnimationNameToId(animationName), AnimationIdVendor::getNextGroupId(), timeOffset);
 }
 
 void GraphicsLayerChromium::pauseAnimation(const String& animationName, double timeOffset)
 {
-    primaryLayer()->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
+    primaryLayer().unwrap<LayerChromium>()->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
 }
 
 void GraphicsLayerChromium::removeAnimation(const String& animationName)
 {
-    primaryLayer()->removeAnimation(mapAnimationNameToId(animationName));
+    primaryLayer().unwrap<LayerChromium>()->removeAnimation(mapAnimationNameToId(animationName));
 }
 
 void GraphicsLayerChromium::suspendAnimations(double wallClockTime)
@@ -427,12 +433,12 @@ void GraphicsLayerChromium::suspendAnimations(double wallClockTime)
     // |wallClockTime| is in the wrong time base. Need to convert here.
     // FIXME: find a more reliable way to do this.
     double monotonicTime = wallClockTime + monotonicallyIncreasingTime() - currentTime();
-    primaryLayer()->suspendAnimations(monotonicTime);
+    primaryLayer().unwrap<LayerChromium>()->suspendAnimations(monotonicTime);
 }
 
 void GraphicsLayerChromium::resumeAnimations()
 {
-    primaryLayer()->resumeAnimations(monotonicallyIncreasingTime());
+    primaryLayer().unwrap<LayerChromium>()->resumeAnimations(monotonicallyIncreasingTime());
 }
 
 void GraphicsLayerChromium::addLinkHighlight(const Path& path)
@@ -453,18 +459,18 @@ void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
 {
     bool childrenChanged = false;
     if (layer) {
-        if (!m_contentsLayer.get() || m_contentsLayerPurpose != ContentsLayerForVideo) {
+        if (m_contentsLayer.isNull() || m_contentsLayerPurpose != ContentsLayerForVideo) {
             setupContentsLayer(layer);
             m_contentsLayerPurpose = ContentsLayerForVideo;
             childrenChanged = true;
         }
         updateContentsRect();
     } else {
-        if (m_contentsLayer) {
+        if (!m_contentsLayer.isNull()) {
             childrenChanged = true;
 
             // The old contents layer will be removed via updateChildList.
-            m_contentsLayer = 0;
+            m_contentsLayer.reset();
         }
     }
 
@@ -472,37 +478,37 @@ void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
         updateChildList();
 }
 
-PlatformLayer* GraphicsLayerChromium::hostLayerForChildren() const
+WebLayer GraphicsLayerChromium::hostLayerForChildren() const
 {
-    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+    return m_transformLayer.isNull() ? m_layer :  m_transformLayer;
 }
 
-PlatformLayer* GraphicsLayerChromium::layerForParent() const
+WebLayer GraphicsLayerChromium::layerForParent() const
 {
-    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+    return m_transformLayer.isNull() ? m_layer :  m_transformLayer;
 }
 
 PlatformLayer* GraphicsLayerChromium::platformLayer() const
 {
-    return primaryLayer();
+    return primaryLayer().unwrap<LayerChromium>();
 }
 
 void GraphicsLayerChromium::setDebugBackgroundColor(const Color& color)
 {
     if (color.isValid())
-        m_layer->setBackgroundColor(color);
+        m_layer.setBackgroundColor(color.rgb());
     else
-        m_layer->setBackgroundColor(static_cast<RGBA32>(0));
+        m_layer.setBackgroundColor(static_cast<RGBA32>(0));
 }
 
 void GraphicsLayerChromium::setDebugBorder(const Color& color, float borderWidth)
 {
     if (color.isValid()) {
-        m_layer->setDebugBorderColor(color);
-        m_layer->setDebugBorderWidth(borderWidth);
+        m_layer.setDebugBorderColor(color.rgb());
+        m_layer.setDebugBorderWidth(borderWidth);
     } else {
-        m_layer->setDebugBorderColor(static_cast<RGBA32>(0));
-        m_layer->setDebugBorderWidth(0);
+        m_layer.setDebugBorderColor(static_cast<RGBA32>(0));
+        m_layer.setDebugBorderWidth(0);
     }
 }
 
@@ -510,14 +516,14 @@ void GraphicsLayerChromium::updateChildList()
 {
     Vector<RefPtr<LayerChromium> > newChildren;
 
-    if (m_transformLayer) {
+    if (!m_transformLayer.isNull()) {
         // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
-        newChildren.append(m_layer.get());
-    } else if (m_contentsLayer) {
+        newChildren.append(m_layer.unwrap<LayerChromium>());
+    } else if (!m_contentsLayer.isNull()) {
         // FIXME: add the contents layer in the correct order with negative z-order children.
         // This does not cause visible rendering issues because currently contents layers are only used
         // for replaced elements that don't have children.
-        newChildren.append(m_contentsLayer.get());
+        newChildren.append(m_contentsLayer.unwrap<LayerChromium>());
     }
 
     const Vector<GraphicsLayer*>& childLayers = children();
@@ -525,7 +531,7 @@ void GraphicsLayerChromium::updateChildList()
     for (size_t i = 0; i < numChildren; ++i) {
         GraphicsLayerChromium* curChild = static_cast<GraphicsLayerChromium*>(childLayers[i]);
 
-        LayerChromium* childLayer = curChild->layerForParent();
+        LayerChromium* childLayer = curChild->layerForParent().unwrap<LayerChromium>();
         newChildren.append(childLayer);
     }
 
@@ -535,17 +541,17 @@ void GraphicsLayerChromium::updateChildList()
     for (size_t i = 0; i < newChildren.size(); ++i)
         newChildren[i]->removeFromParent();
 
-    if (m_transformLayer) {
-        m_transformLayer->setChildren(newChildren);
+    if (!m_transformLayer.isNull()) {
+        m_transformLayer.unwrap<LayerChromium>()->setChildren(newChildren);
 
-        if (m_contentsLayer) {
+        if (!m_contentsLayer.isNull()) {
             // If we have a transform layer, then the contents layer is parented in the
             // primary layer (which is itself a child of the transform layer).
-            m_layer->removeAllChildren();
-            m_layer->addChild(m_contentsLayer);
+            m_layer.removeAllChildren();
+            m_layer.addChild(m_contentsLayer);
         }
     } else
-        m_layer->setChildren(newChildren);
+        m_layer.unwrap<LayerChromium>()->setChildren(newChildren);
 }
 
 void GraphicsLayerChromium::updateLayerPosition()
@@ -554,20 +560,20 @@ void GraphicsLayerChromium::updateLayerPosition()
     FloatPoint layerPosition(m_position.x() + m_anchorPoint.x() * m_size.width(),
                              m_position.y() + m_anchorPoint.y() * m_size.height());
 
-    primaryLayer()->setPosition(layerPosition);
+    primaryLayer().setPosition(layerPosition);
 }
 
 void GraphicsLayerChromium::updateLayerSize()
 {
     IntSize layerSize(m_size.width(), m_size.height());
-    if (m_transformLayer) {
-        m_transformLayer->setBounds(layerSize);
+    if (!m_transformLayer.isNull()) {
+        m_transformLayer.setBounds(layerSize);
         // The anchor of the contents layer is always at 0.5, 0.5, so the position is center-relative.
         FloatPoint centerPoint(m_size.width() / 2, m_size.height() / 2);
-        m_layer->setPosition(centerPoint);
+        m_layer.setPosition(centerPoint);
     }
 
-    m_layer->setBounds(layerSize);
+    m_layer.setBounds(layerSize);
 
     // Note that we don't resize m_contentsLayer. It's up the caller to do that.
 
@@ -578,35 +584,36 @@ void GraphicsLayerChromium::updateLayerSize()
 
 void GraphicsLayerChromium::updateAnchorPoint()
 {
-    primaryLayer()->setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
-    primaryLayer()->setAnchorPointZ(m_anchorPoint.z());
+    primaryLayer().setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
+    primaryLayer().setAnchorPointZ(m_anchorPoint.z());
 
     updateLayerPosition();
 }
 
 void GraphicsLayerChromium::updateTransform()
 {
-    primaryLayer()->setTransform(m_transform);
+    primaryLayer().setTransform(WebKit::WebTransformationMatrix(m_transform));
 }
 
 void GraphicsLayerChromium::updateChildrenTransform()
 {
-    primaryLayer()->setSublayerTransform(m_childrenTransform);
+    primaryLayer().setSublayerTransform(WebKit::WebTransformationMatrix(m_childrenTransform));
 }
 
 void GraphicsLayerChromium::updateMasksToBounds()
 {
-    m_layer->setMasksToBounds(m_masksToBounds);
+    m_layer.setMasksToBounds(m_masksToBounds);
     updateDebugIndicators();
 }
 
 void GraphicsLayerChromium::updateLayerPreserves3D()
 {
-    if (m_preserves3D && !m_transformLayer) {
+    if (m_preserves3D && m_transformLayer.isNull()) {
         // Create the transform layer.
-        m_transformLayer = LayerChromium::create();
-        m_transformLayer->setPreserves3D(true);
-        m_transformLayer->setLayerAnimationDelegate(this);
+        m_transformLayer = WebLayer::create();
+        m_transformLayer.setPreserves3D(true);
+        m_transformLayer.unwrap<LayerChromium>()->setLayerAnimationDelegate(this);
+        m_transformLayer.unwrap<LayerChromium>()->setLayerAnimationController(m_layer.unwrap<LayerChromium>()->releaseLayerAnimationController());
 
         // Copy the position from this layer.
         updateLayerPosition();
@@ -615,32 +622,34 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         updateTransform();
         updateChildrenTransform();
 
-        m_layer->setPosition(FloatPoint(m_size.width() / 2.0f, m_size.height() / 2.0f));
+        m_layer.setPosition(FloatPoint(m_size.width() / 2.0f, m_size.height() / 2.0f));
 
-        m_layer->setAnchorPoint(FloatPoint(0.5f, 0.5f));
-        TransformationMatrix identity;
-        m_layer->setTransform(identity);
+        m_layer.setAnchorPoint(FloatPoint(0.5f, 0.5f));
+        m_layer.setTransform(SkMatrix44());
 
         // Set the old layer to opacity of 1. Further down we will set the opacity on the transform layer.
-        m_layer->setOpacity(1);
+        m_layer.setOpacity(1);
 
-        m_layer->setContentsScale(contentsScale());
+        m_layer.setContentsScale(contentsScale());
 
         // Move this layer to be a child of the transform layer.
-        if (m_layer->parent())
-            m_layer->parent()->replaceChild(m_layer.get(), m_transformLayer.get());
-        m_transformLayer->addChild(m_layer.get());
+        if (!m_layer.parent().isNull())
+            m_layer.parent().replaceChild(m_layer, m_transformLayer);
+        m_transformLayer.addChild(m_layer);
 
         updateChildList();
-    } else if (!m_preserves3D && m_transformLayer) {
+    } else if (!m_preserves3D && !m_transformLayer.isNull()) {
         // Relace the transformLayer in the parent with this layer.
-        m_layer->removeFromParent();
-        if (m_transformLayer->parent())
-            m_transformLayer->parent()->replaceChild(m_transformLayer.get(), m_layer.get());
+        m_layer.removeFromParent();
+        if (!m_transformLayer.parent().isNull())
+            m_transformLayer.parent().replaceChild(m_transformLayer, m_layer);
+
+        m_layer.unwrap<LayerChromium>()->setLayerAnimationDelegate(this);
+        m_layer.unwrap<LayerChromium>()->setLayerAnimationController(m_transformLayer.unwrap<LayerChromium>()->releaseLayerAnimationController());
 
         // Release the transform layer.
-        m_transformLayer->setLayerAnimationDelegate(0);
-        m_transformLayer = 0;
+        m_transformLayer.unwrap<LayerChromium>()->setLayerAnimationDelegate(0);
+        m_transformLayer.reset();
 
         updateLayerPosition();
         updateLayerSize();
@@ -651,8 +660,8 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         updateChildList();
     }
 
-    m_layer->setPreserves3D(m_preserves3D);
-    primaryLayer()->setOpacity(m_opacity);
+    m_layer.setPreserves3D(m_preserves3D);
+    primaryLayer().setOpacity(m_opacity);
     updateNames();
 }
 
@@ -663,27 +672,27 @@ void GraphicsLayerChromium::updateLayerIsDrawable()
     // flags are combined here. m_contentsLayer shouldn't receive the drawsContent flag
     // so it is only given contentsVisible.
 
-    m_layer->setIsDrawable(m_drawsContent && m_contentsVisible);
+    m_layer.setDrawsContent(m_drawsContent && m_contentsVisible);
 
-    if (m_contentsLayer)
-        m_contentsLayer->setIsDrawable(m_contentsVisible);
+    if (!m_contentsLayer.isNull())
+        m_contentsLayer.setDrawsContent(m_contentsVisible);
 
     if (m_drawsContent)
-        m_layer->setNeedsDisplay();
+        m_layer.invalidate();
 
     updateDebugIndicators();
 }
 
 void GraphicsLayerChromium::updateLayerBackgroundColor()
 {
-    if (!m_contentsLayer)
+    if (m_contentsLayer.isNull())
         return;
 
     // We never create the contents layer just for background color yet.
     if (m_backgroundColorSet)
-        m_contentsLayer->setBackgroundColor(m_backgroundColor);
+        m_contentsLayer.setBackgroundColor(m_backgroundColor.rgb());
     else
-        m_contentsLayer->setBackgroundColor(static_cast<RGBA32>(0));
+        m_contentsLayer.setBackgroundColor(static_cast<RGBA32>(0));
 }
 
 void GraphicsLayerChromium::updateContentsVideo()
@@ -693,48 +702,48 @@ void GraphicsLayerChromium::updateContentsVideo()
 
 void GraphicsLayerChromium::updateContentsRect()
 {
-    if (!m_contentsLayer)
+    if (m_contentsLayer.isNull())
         return;
 
-    m_contentsLayer->setPosition(FloatPoint(m_contentsRect.x(), m_contentsRect.y()));
-    m_contentsLayer->setBounds(IntSize(m_contentsRect.width(), m_contentsRect.height()));
+    m_contentsLayer.setPosition(FloatPoint(m_contentsRect.x(), m_contentsRect.y()));
+    m_contentsLayer.setBounds(IntSize(m_contentsRect.width(), m_contentsRect.height()));
 }
 
 void GraphicsLayerChromium::updateContentsScale()
 {
     // If page scale is already applied then there's no need to apply it again.
-    if (appliesPageScale() || !m_layer)
+    if (appliesPageScale() || m_layer.isNull())
         return;
 
-    m_layer->setContentsScale(contentsScale());
+    m_layer.setContentsScale(contentsScale());
 }
 
 void GraphicsLayerChromium::setupContentsLayer(LayerChromium* contentsLayer)
 {
-    if (contentsLayer == m_contentsLayer)
+    if (contentsLayer == m_contentsLayer.unwrap<LayerChromium>())
         return;
 
-    if (m_contentsLayer) {
-        m_contentsLayer->removeFromParent();
-        m_contentsLayer = 0;
+    if (!m_contentsLayer.isNull()) {
+        m_contentsLayer.removeFromParent();
+        m_contentsLayer.reset();
     }
 
     if (contentsLayer) {
-        m_contentsLayer = contentsLayer;
+        m_contentsLayer = WebLayer(contentsLayer);
 
-        m_contentsLayer->setAnchorPoint(FloatPoint(0, 0));
+        m_contentsLayer.setAnchorPoint(FloatPoint(0, 0));
 
-        // It is necessary to update setIsDrawable as soon as we receive the new contentsLayer, for
+        // It is necessary to call setDrawsContent as soon as we receive the new contentsLayer, for
         // the correctness of early exit conditions in setDrawsContent() and setContentsVisible().
-        m_contentsLayer->setIsDrawable(m_contentsVisible);
+        m_contentsLayer.setDrawsContent(m_contentsVisible);
 
         // Insert the content layer first. Video elements require this, because they have
         // shadow content that must display in front of the video.
-        m_layer->insertChild(m_contentsLayer.get(), 0);
+        m_layer.insertChild(m_contentsLayer, 0);
 
         if (showDebugBorders()) {
-            m_contentsLayer->setDebugBorderColor(Color(0, 0, 128, 180));
-            m_contentsLayer->setDebugBorderWidth(1);
+            m_contentsLayer.setDebugBorderColor(Color(0, 0, 128, 180).rgb());
+            m_contentsLayer.setDebugBorderWidth(1);
         }
     }
     updateDebugIndicators();
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index 8ce1fc48e..11e67a162 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -34,11 +34,12 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "ContentLayerChromium.h"
-#include "LayerChromium.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
 #include "cc/CCLayerAnimationDelegate.h"
 
+#include <public/WebContentLayer.h>
+#include <public/WebLayer.h>
 #include <wtf/HashMap.h>
 
 namespace WebCore {
@@ -98,7 +99,7 @@ public:
     virtual void setContentsToImage(Image*);
     virtual void setContentsToMedia(PlatformLayer*);
     virtual void setContentsToCanvas(PlatformLayer*);
-    virtual bool hasContentsLayer() const { return m_contentsLayer; }
+    virtual bool hasContentsLayer() const { return !m_contentsLayer.isNull(); }
 
     virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String&, double timeOffset);
     virtual void pauseAnimation(const String& animationName, double timeOffset);
@@ -123,16 +124,14 @@ public:
     virtual void notifyAnimationFinished(double finishTime);
 
     // Exposed for tests.
-    LayerChromium* contentsLayer() const { return m_contentsLayer.get(); }
+    WebKit::WebLayer contentsLayer() const { return m_contentsLayer; }
 
 private:
     virtual void willBeDestroyed();
 
-    typedef HashMap<String, int> AnimationIdMap;
-
-    LayerChromium* primaryLayer() const  { return m_transformLayer.get() ? m_transformLayer.get() : m_layer.get(); }
-    LayerChromium* hostLayerForChildren() const;
-    LayerChromium* layerForParent() const;
+    WebKit::WebLayer primaryLayer() const  { return m_transformLayer.isNull() ? m_layer : m_transformLayer; }
+    WebKit::WebLayer hostLayerForChildren() const;
+    WebKit::WebLayer layerForParent() const;
 
     void updateNames();
     void updateChildList();
@@ -158,10 +157,9 @@ private:
 
     String m_nameBase;
 
-    RefPtr<ContentLayerChromium> m_layer;
-    RefPtr<LayerChromium> m_transformLayer;
-    RefPtr<LayerChromium> m_contentsLayer;
-    RefPtr<LinkHighlight> m_linkHighlight;
+    WebKit::WebContentLayer m_layer;
+    WebKit::WebLayer m_transformLayer;
+    WebKit::WebLayer m_contentsLayer;
 
     enum ContentsLayerPurpose {
         NoContentsLayer = 0,
@@ -175,6 +173,9 @@ private:
     bool m_inSetChildren;
     bool m_pageScaleChanged;
 
+    RefPtr<LinkHighlight> m_linkHighlight;
+
+    typedef HashMap<String, int> AnimationIdMap;
     AnimationIdMap m_animationIdMap;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index f94aad60e..1a0e67089 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -600,8 +600,10 @@ bool LayerChromium::addAnimation(const KeyframeValueList& values, const IntSize&
         return false;
 
     bool addedAnimation = m_layerAnimationController->addAnimation(values, boxSize, animation, animationId, groupId, timeOffset);
-    if (addedAnimation)
+    if (addedAnimation) {
+        m_layerTreeHost->didAddAnimation();
         setNeedsCommit();
+    }
     return addedAnimation;
 }
 
@@ -632,9 +634,20 @@ void LayerChromium::resumeAnimations(double monotonicTime)
 void LayerChromium::setLayerAnimationController(PassOwnPtr<CCLayerAnimationController> layerAnimationController)
 {
     m_layerAnimationController = layerAnimationController;
+    if (m_layerAnimationController) {
+        m_layerAnimationController->setClient(this);
+        m_layerAnimationController->setForceSync();
+    }
     setNeedsCommit();
 }
 
+PassOwnPtr<CCLayerAnimationController> LayerChromium::releaseLayerAnimationController()
+{
+    OwnPtr<CCLayerAnimationController> toReturn = m_layerAnimationController.release();
+    m_layerAnimationController = CCLayerAnimationController::create(this);
+    return toReturn.release();
+}
+
 bool LayerChromium::hasActiveAnimation() const
 {
     return m_layerAnimationController->hasActiveAnimation();
@@ -643,7 +656,8 @@ bool LayerChromium::hasActiveAnimation() const
 void LayerChromium::notifyAnimationStarted(const CCAnimationEvent& event, double wallClockTime)
 {
     m_layerAnimationController->notifyAnimationStarted(event);
-    m_layerAnimationDelegate->notifyAnimationStarted(wallClockTime);
+    if (m_layerAnimationDelegate)
+        m_layerAnimationDelegate->notifyAnimationStarted(wallClockTime);
 }
 
 void LayerChromium::notifyAnimationFinished(double wallClockTime)
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 9e7fce50c..755a7da91 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -240,6 +240,7 @@ public:
 
     CCLayerAnimationController* layerAnimationController() { return m_layerAnimationController.get(); }
     void setLayerAnimationController(PassOwnPtr<CCLayerAnimationController>);
+    PassOwnPtr<CCLayerAnimationController> releaseLayerAnimationController();
 
     void setLayerAnimationDelegate(CCLayerAnimationDelegate* layerAnimationDelegate) { m_layerAnimationDelegate = layerAnimationDelegate; }
 
@@ -349,8 +350,6 @@ private:
     IntRect m_drawableContentRect;
     float m_contentsScale;
 
-    bool m_pageScaleDirty;
-
     CCLayerAnimationDelegate* m_layerAnimationDelegate;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index 9f3edd0ae..a9f3d4665 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -143,6 +143,24 @@ bool needsLionIOSurfaceReadbackWorkaround()
 #endif
 }
 
+class UnthrottledTextureUploader : public TextureUploader {
+    WTF_MAKE_NONCOPYABLE(UnthrottledTextureUploader);
+public:
+    static PassOwnPtr<UnthrottledTextureUploader> create()
+    {
+        return adoptPtr(new UnthrottledTextureUploader());
+    }
+    virtual ~UnthrottledTextureUploader() { }
+
+    virtual bool isBusy() { return false; }
+    virtual void beginUploads() { }
+    virtual void endUploads() { }
+    virtual void uploadTexture(GraphicsContext3D* context, LayerTextureUpdater::Texture* texture, TextureAllocator* allocator, const IntRect sourceRect, const IntRect destRect) { texture->updateRect(context, allocator, sourceRect, destRect); }
+
+protected:
+    UnthrottledTextureUploader() { }
+};
+
 } // anonymous namespace
 
 class LayerRendererSwapBuffersCompleteCallbackAdapter : public Extensions3DChromium::SwapBuffersCompleteCallbackCHROMIUM {
@@ -194,9 +212,9 @@ private:
 };
 
 
-PassOwnPtr<LayerRendererChromium> LayerRendererChromium::create(LayerRendererChromiumClient* client, PassRefPtr<GraphicsContext3D> context, PassOwnPtr<TextureUploader> uploader)
+PassOwnPtr<LayerRendererChromium> LayerRendererChromium::create(LayerRendererChromiumClient* client, PassRefPtr<GraphicsContext3D> context, TextureUploaderOption textureUploaderSetting)
 {
-    OwnPtr<LayerRendererChromium> layerRenderer(adoptPtr(new LayerRendererChromium(client, context, uploader)));
+    OwnPtr<LayerRendererChromium> layerRenderer(adoptPtr(new LayerRendererChromium(client, context, textureUploaderSetting)));
     if (!layerRenderer->initialize())
         return nullptr;
 
@@ -205,17 +223,17 @@ PassOwnPtr<LayerRendererChromium> LayerRendererChromium::create(LayerRendererChr
 
 LayerRendererChromium::LayerRendererChromium(LayerRendererChromiumClient* client,
                                              PassRefPtr<GraphicsContext3D> context,
-                                             PassOwnPtr<TextureUploader> uploader)
+                                             TextureUploaderOption textureUploaderSetting)
     : m_client(client)
     , m_currentRenderSurface(0)
     , m_currentManagedTexture(0)
     , m_offscreenFramebufferId(0)
-    , m_textureUploader(uploader)
     , m_context(context)
     , m_defaultRenderSurface(0)
     , m_sharedGeometryQuad(FloatRect(-0.5f, -0.5f, 1.0f, 1.0f))
     , m_isViewportChanged(false)
     , m_isFramebufferDiscarded(false)
+    , m_textureUploaderSetting(textureUploaderSetting)
 {
 }
 
@@ -398,7 +416,8 @@ void LayerRendererChromium::beginDrawingFrame(CCRenderSurface* defaultRenderSurf
 
     size_t contentsMemoryUseBytes = m_contentsTextureAllocator->currentMemoryUseBytes();
     size_t maxLimit = TextureManager::highLimitBytes(viewportSize());
-    m_renderSurfaceTextureManager->setMaxMemoryLimitBytes(maxLimit - contentsMemoryUseBytes);
+    size_t newLimit = (maxLimit > contentsMemoryUseBytes) ? maxLimit - contentsMemoryUseBytes : 0;
+    m_renderSurfaceTextureManager->setMaxMemoryLimitBytes(newLimit);
 
     if (viewportSize().isEmpty())
         return;
@@ -1382,6 +1401,10 @@ bool LayerRendererChromium::initializeSharedObjects()
                                                            TextureManager::reclaimLimitBytes(viewportSize()),
                                                            m_capabilities.maxTextureSize);
     m_textureCopier = AcceleratedTextureCopier::create(m_context.get());
+    if (m_textureUploaderSetting == ThrottledUploader)
+        m_textureUploader = ThrottledTextureUploader::create(m_context.get());
+    else
+        m_textureUploader = UnthrottledTextureUploader::create();
     m_contentsTextureAllocator = TrackingTextureAllocator::create(m_context.get());
     m_renderSurfaceTextureAllocator = TrackingTextureAllocator::create(m_context.get());
     if (m_capabilities.usingTextureUsageHint)
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index d73f71ae7..1a2ebed0e 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -66,7 +66,7 @@ class ScopedEnsureFramebufferAllocation;
 
 class LayerRendererChromiumClient {
 public:
-    virtual const IntSize& viewportSize() const = 0;
+    virtual const IntSize& deviceViewportSize() const = 0;
     virtual const CCSettings& settings() const = 0;
     virtual void didLoseContext() = 0;
     virtual void onSwapBuffersComplete() = 0;
@@ -74,11 +74,13 @@ public:
     virtual void setContentsMemoryAllocationLimitBytes(size_t) = 0;
 };
 
+enum TextureUploaderOption { ThrottledUploader, UnthrottledUploader };
+
 // Class that handles drawing of composited render layers using GL.
 class LayerRendererChromium {
     WTF_MAKE_NONCOPYABLE(LayerRendererChromium);
 public:
-    static PassOwnPtr<LayerRendererChromium> create(LayerRendererChromiumClient*, PassRefPtr<GraphicsContext3D>, PassOwnPtr<TextureUploader>);
+    static PassOwnPtr<LayerRendererChromium> create(LayerRendererChromiumClient*, PassRefPtr<GraphicsContext3D>, TextureUploaderOption);
 
     ~LayerRendererChromium();
 
@@ -88,10 +90,6 @@ public:
     GraphicsContext3D* context();
     bool contextSupportsMapSub() const { return m_capabilities.usingMapSub; }
 
-    const IntSize& viewportSize() { return m_client->viewportSize(); }
-    int viewportWidth() { return viewportSize().width(); }
-    int viewportHeight() { return viewportSize().height(); }
-
     void viewportChanged();
 
     void beginDrawingFrame(CCRenderSurface* defaultRenderSurface);
@@ -144,10 +142,14 @@ protected:
     void ensureFramebuffer();
     bool isFramebufferDiscarded() const { return m_isFramebufferDiscarded; }
 
-    LayerRendererChromium(LayerRendererChromiumClient*, PassRefPtr<GraphicsContext3D>, PassOwnPtr<TextureUploader>);
+    LayerRendererChromium(LayerRendererChromiumClient*, PassRefPtr<GraphicsContext3D>, TextureUploaderOption);
     bool initialize();
 
 private:
+    const IntSize& viewportSize() { return m_client->deviceViewportSize(); }
+    int viewportWidth() { return viewportSize().width(); }
+    int viewportHeight() { return viewportSize().height(); }
+
     void drawQuad(const CCDrawQuad*, const FloatRect& surfaceDamageRect);
     void drawCheckerboardQuad(const CCCheckerboardDrawQuad*);
     void drawDebugBorderQuad(const CCDebugBorderDrawQuad*);
@@ -298,6 +300,7 @@ private:
 
     bool m_isViewportChanged;
     bool m_isFramebufferDiscarded;
+    TextureUploaderOption m_textureUploaderSetting;
 };
 
 
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformImage.cpp b/Source/WebCore/platform/graphics/chromium/PlatformImage.cpp
index 9672c9c7b..2e2f1abcf 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformImage.cpp
+++ b/Source/WebCore/platform/graphics/chromium/PlatformImage.cpp
@@ -24,20 +24,10 @@
  */
 
 #include "config.h"
-
 #include "PlatformImage.h"
 
-#if USE(SKIA)
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
-#elif USE(CG)
-#include <CoreGraphics/CGBitmapContext.h>
-#include <CoreGraphics/CGContext.h>
-#include <CoreGraphics/CGImage.h>
-#include <wtf/RetainPtr.h>
-#else
-#error "Need to implement for your platform"
-#endif
 
 namespace WebCore {
 
@@ -47,19 +37,12 @@ PlatformImage::PlatformImage()
 
 void PlatformImage::updateFromImage(NativeImagePtr nativeImage)
 {
-#if USE(SKIA)
     // The layer contains an Image.
     NativeImageSkia* skiaImage = static_cast<NativeImageSkia*>(nativeImage);
     ASSERT(skiaImage);
     const SkBitmap& skiaBitmap = skiaImage->bitmap();
 
     IntSize bitmapSize(skiaBitmap.width(), skiaBitmap.height());
-#elif USE(CG)
-    // NativeImagePtr is a CGImageRef on Mac OS X.
-    int width = CGImageGetWidth(nativeImage);
-    int height = CGImageGetHeight(nativeImage);
-    IntSize bitmapSize(width, height);
-#endif
 
     size_t bufferSize = bitmapSize.width() * bitmapSize.height() * 4;
     if (m_size != bitmapSize) {
@@ -68,44 +51,10 @@ void PlatformImage::updateFromImage(NativeImagePtr nativeImage)
         m_size = bitmapSize;
     }
 
-#if USE(SKIA)
     SkAutoLockPixels lock(skiaBitmap);
     // FIXME: do we need to support more image configurations?
     ASSERT(skiaBitmap.config()== SkBitmap::kARGB_8888_Config);
     skiaBitmap.copyPixelsTo(m_pixelData.get(), bufferSize);
-#elif USE(CG)
-    // FIXME: we should get rid of this temporary copy where possible.
-    int tempRowBytes = width * 4;
-    // Note we do not zero this vector since we are going to
-    // completely overwrite its contents with the image below.
-    // Try to reuse the color space from the image to preserve its colors.
-    // Some images use a color space (such as indexed) unsupported by the bitmap context.
-    RetainPtr<CGColorSpaceRef> colorSpaceReleaser;
-    CGColorSpaceRef colorSpace = CGImageGetColorSpace(nativeImage);
-    CGColorSpaceModel colorSpaceModel = CGColorSpaceGetModel(colorSpace);
-    switch (colorSpaceModel) {
-    case kCGColorSpaceModelMonochrome:
-    case kCGColorSpaceModelRGB:
-    case kCGColorSpaceModelCMYK:
-    case kCGColorSpaceModelLab:
-    case kCGColorSpaceModelDeviceN:
-        break;
-    default:
-        colorSpaceReleaser.adoptCF(CGColorSpaceCreateDeviceRGB());
-        colorSpace = colorSpaceReleaser.get();
-        break;
-    }
-    RetainPtr<CGContextRef> tempContext(AdoptCF, CGBitmapContextCreate(m_pixelData.get(),
-                                                                       width, height, 8, tempRowBytes,
-                                                                       colorSpace,
-                                                                       kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host));
-    CGContextSetBlendMode(tempContext.get(), kCGBlendModeCopy);
-    CGContextDrawImage(tempContext.get(),
-                       CGRectMake(0, 0, static_cast<CGFloat>(width), static_cast<CGFloat>(height)),
-                       nativeImage);
-#else
-#error "Need to implement for your platform."
-#endif
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
index 71a874b18..6c27358cc 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
@@ -43,13 +43,6 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
-// Start tiling when the width and height of a layer are larger than this size.
-static int maxUntiledSize = 512;
-
-// When tiling is enabled, use tiles of this size:
-static int defaultTileWidth = 256;
-static int defaultTileHeight = 256;
-
 using namespace std;
 
 namespace WebCore {
@@ -101,7 +94,7 @@ TiledLayerChromium::TiledLayerChromium()
     , m_didPaint(false)
     , m_tilingOption(AutoTile)
 {
-    m_tiler = CCLayerTilingData::create(IntSize(defaultTileWidth, defaultTileHeight), CCLayerTilingData::HasBorderTexels);
+    m_tiler = CCLayerTilingData::create(IntSize(), CCLayerTilingData::HasBorderTexels);
 }
 
 TiledLayerChromium::~TiledLayerChromium()
@@ -115,13 +108,24 @@ PassOwnPtr<CCLayerImpl> TiledLayerChromium::createCCLayerImpl()
 
 void TiledLayerChromium::updateTileSizeAndTilingOption()
 {
-    const IntSize tileSize(min(defaultTileWidth, contentBounds().width()), min(defaultTileHeight, contentBounds().height()));
+    ASSERT(layerTreeHost());
+
+    const CCSettings& settings = layerTreeHost()->settings();
+    const IntSize& defaultTileSize = settings.defaultTileSize;
+    const IntSize& maxUntiledLayerSize = settings.maxUntiledLayerSize;
+    int layerWidth = contentBounds().width();
+    int layerHeight = contentBounds().height();
+
+    const IntSize tileSize(min(defaultTileSize.width(), layerWidth), min(defaultTileSize.height(), layerHeight));
 
     // Tile if both dimensions large, or any one dimension large and the other
-    // extends into a second tile. This heuristic allows for long skinny layers
-    // (e.g. scrollbars) that are Nx1 tiles to minimize wasted texture space.
-    const bool anyDimensionLarge = contentBounds().width() > maxUntiledSize || contentBounds().height() > maxUntiledSize;
-    const bool anyDimensionOneTile = contentBounds().width() <= defaultTileWidth || contentBounds().height() <= defaultTileHeight;
+    // extends into a second tile but the total layer area isn't larger than that
+    // of the largest possible untiled layer. This heuristic allows for long skinny layers
+    // (e.g. scrollbars) that are Nx1 tiles to minimize wasted texture space but still avoids
+    // creating very large tiles.
+    const bool anyDimensionLarge = layerWidth > maxUntiledLayerSize.width() || layerHeight > maxUntiledLayerSize.height();
+    const bool anyDimensionOneTile = (layerWidth <= defaultTileSize.width() || layerHeight <= defaultTileSize.height())
+                                      && (layerWidth * layerHeight) <= (maxUntiledLayerSize.width() * maxUntiledLayerSize.height());
     const bool autoTiled = anyDimensionLarge && !anyDimensionOneTile;
 
     bool isTiled;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
index df50be834..98f401448 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
@@ -124,7 +124,8 @@ PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& val
 } // namepace
 
 CCLayerAnimationController::CCLayerAnimationController(CCLayerAnimationControllerClient* client)
-    : m_client(client)
+    : m_forceSync(false)
+    , m_client(client)
 {
 }
 
@@ -203,9 +204,14 @@ void CCLayerAnimationController::resumeAnimations(double monotonicTime)
 // are kept in sync.
 void CCLayerAnimationController::pushAnimationUpdatesTo(CCLayerAnimationController* controllerImpl)
 {
-    pushNewAnimationsToImplThread(controllerImpl);
-    removeAnimationsCompletedOnMainThread(controllerImpl);
-    pushPropertiesToImplThread(controllerImpl);
+    if (m_forceSync) {
+        replaceImplThreadAnimations(controllerImpl);
+        m_forceSync = false;
+    } else {
+        pushNewAnimationsToImplThread(controllerImpl);
+        removeAnimationsCompletedOnMainThread(controllerImpl);
+        pushPropertiesToImplThread(controllerImpl);
+    }
 }
 
 void CCLayerAnimationController::animate(double monotonicTime, CCAnimationEventsVector* events)
@@ -253,8 +259,7 @@ bool CCLayerAnimationController::isAnimatingProperty(CCActiveAnimation::TargetPr
 void CCLayerAnimationController::notifyAnimationStarted(const CCAnimationEvent& event)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
-        if (m_activeAnimations[i]->group() == event.groupId && m_activeAnimations[i]->targetProperty() == event.targetProperty) {
-            ASSERT(m_activeAnimations[i]->needsSynchronizedStartTime());
+        if (m_activeAnimations[i]->group() == event.groupId && m_activeAnimations[i]->targetProperty() == event.targetProperty && m_activeAnimations[i]->needsSynchronizedStartTime()) {
             m_activeAnimations[i]->setNeedsSynchronizedStartTime(false);
             m_activeAnimations[i]->setStartTime(event.monotonicTime);
             return;
@@ -262,6 +267,11 @@ void CCLayerAnimationController::notifyAnimationStarted(const CCAnimationEvent&
     }
 }
 
+void CCLayerAnimationController::setClient(CCLayerAnimationControllerClient* client)
+{
+    m_client = client;
+}
+
 void CCLayerAnimationController::pushNewAnimationsToImplThread(CCLayerAnimationController* controllerImpl) const
 {
     // Any new animations owned by the main thread's controller are cloned and adde to the impl thread's controller.
@@ -281,6 +291,7 @@ void CCLayerAnimationController::pushNewAnimationsToImplThread(CCLayerAnimationC
         ASSERT(!toAdd->needsSynchronizedStartTime());
         // The new animation should be set to run as soon as possible.
         toAdd->setRunState(CCActiveAnimation::WaitingForTargetAvailability, 0);
+        toAdd->setStartTime(0);
         controllerImpl->add(toAdd.release());
     }
 }
@@ -437,6 +448,13 @@ void CCLayerAnimationController::purgeFinishedAnimations(double monotonicTime, C
     }
 }
 
+void CCLayerAnimationController::replaceImplThreadAnimations(CCLayerAnimationController* controllerImpl) const
+{
+    controllerImpl->m_activeAnimations.clear();
+    for (size_t i = 0; i < m_activeAnimations.size(); ++i)
+        controllerImpl->add(m_activeAnimations[i]->cloneForImplThread());
+}
+
 void CCLayerAnimationController::tickAnimations(double monotonicTime)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
index e22f8054d..ac7287f71 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
@@ -90,6 +90,12 @@ public:
     // function updates the corresponding main thread animation's start time.
     void notifyAnimationStarted(const CCAnimationEvent&);
 
+    // If a sync is forced, then the next time animation updates are pushed to the impl
+    // thread, all animations will be transferred.
+    void setForceSync() { m_forceSync = true; }
+
+    void setClient(CCLayerAnimationControllerClient*);
+
 protected:
     explicit CCLayerAnimationController(CCLayerAnimationControllerClient*);
 
@@ -99,6 +105,7 @@ private:
     void pushNewAnimationsToImplThread(CCLayerAnimationController*) const;
     void removeAnimationsCompletedOnMainThread(CCLayerAnimationController*) const;
     void pushPropertiesToImplThread(CCLayerAnimationController*) const;
+    void replaceImplThreadAnimations(CCLayerAnimationController*) const;
 
     void startAnimationsWaitingForNextTick(double monotonicTime, CCAnimationEventsVector*);
     void startAnimationsWaitingForStartTime(double monotonicTime, CCAnimationEventsVector*);
@@ -108,6 +115,9 @@ private:
 
     void tickAnimations(double monotonicTime);
 
+    // If this is true, we force a sync to the impl thread.
+    bool m_forceSync;
+
     CCLayerAnimationControllerClient* m_client;
     Vector<OwnPtr<CCActiveAnimation> > m_activeAnimations;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index 9e576ac37..f82ac373c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -143,11 +143,16 @@ void CCLayerTreeHost::initializeLayerRenderer()
     // Update m_settings based on partial update capability.
     m_settings.maxPartialTextureUpdates = min(m_settings.maxPartialTextureUpdates, m_proxy->maxPartialTextureUpdates());
 
-    m_contentsTextureManager = TextureManager::create(TextureManager::highLimitBytes(viewportSize()),
-                                                      TextureManager::reclaimLimitBytes(viewportSize()),
+    m_contentsTextureManager = TextureManager::create(TextureManager::highLimitBytes(deviceViewportSize()),
+                                                      TextureManager::reclaimLimitBytes(deviceViewportSize()),
                                                       m_proxy->layerRendererCapabilities().maxTextureSize);
 
     m_layerRendererInitialized = true;
+
+    m_settings.defaultTileSize = IntSize(min(m_settings.defaultTileSize.width(), m_proxy->layerRendererCapabilities().maxTextureSize),
+                                         min(m_settings.defaultTileSize.height(), m_proxy->layerRendererCapabilities().maxTextureSize));
+    m_settings.maxUntiledLayerSize = IntSize(min(m_settings.maxUntiledLayerSize.width(), m_proxy->layerRendererCapabilities().maxTextureSize),
+                                             min(m_settings.maxUntiledLayerSize.height(), m_proxy->layerRendererCapabilities().maxTextureSize));
 }
 
 CCLayerTreeHost::RecreateResult CCLayerTreeHost::recreateContext()
@@ -233,10 +238,8 @@ void CCLayerTreeHost::finishCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
 
     // We may have added an animation during the tree sync. This will cause both layer tree hosts
     // to visit their controllers.
-    if (rootLayer()) {
+    if (rootLayer() && m_needsAnimateLayers)
         hostImpl->setNeedsAnimateLayers();
-        m_needsAnimateLayers = true;
-    }
 
     hostImpl->setSourceFrameNumber(frameNumber());
     hostImpl->setViewportSize(viewportSize());
@@ -339,6 +342,12 @@ void CCLayerTreeHost::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> eve
     setAnimationEventsRecursive(*events, m_rootLayer.get(), wallClockTime);
 }
 
+void CCLayerTreeHost::didAddAnimation()
+{
+    m_needsAnimateLayers = true;
+    m_proxy->didAddAnimation();
+}
+
 void CCLayerTreeHost::setRootLayer(PassRefPtr<LayerChromium> rootLayer)
 {
     if (m_rootLayer == rootLayer)
@@ -358,6 +367,10 @@ void CCLayerTreeHost::setViewportSize(const IntSize& viewportSize)
         return;
 
     m_viewportSize = viewportSize;
+
+    m_deviceViewportSize = viewportSize;
+    m_deviceViewportSize.scale(m_settings.deviceScaleFactor);
+
     setNeedsCommit();
 }
 
@@ -407,10 +420,8 @@ void CCLayerTreeHost::didBecomeInvisibleOnImplThread(CCLayerTreeHostImpl* hostIm
 
     // We may have added an animation during the tree sync. This will cause both layer tree hosts
     // to visit their controllers.
-    if (rootLayer()) {
+    if (rootLayer() && m_needsAnimateLayers)
         hostImpl->setNeedsAnimateLayers();
-        m_needsAnimateLayers = true;
-    }
 }
 
 void CCLayerTreeHost::setContentsMemoryAllocationLimitBytes(size_t bytes)
@@ -476,9 +487,9 @@ void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& u
 
     if (!rootLayer->renderSurface())
         rootLayer->createRenderSurface();
-    rootLayer->renderSurface()->setContentRect(IntRect(IntPoint(0, 0), viewportSize()));
+    rootLayer->renderSurface()->setContentRect(IntRect(IntPoint(0, 0), deviceViewportSize()));
 
-    IntRect rootClipRect(IntPoint(), viewportSize());
+    IntRect rootClipRect(IntPoint(), deviceViewportSize());
     rootLayer->setClipRect(rootClipRect);
 
     LayerList updateList;
@@ -487,10 +498,12 @@ void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& u
     RenderSurfaceChromium* rootRenderSurface = rootLayer->renderSurface();
     rootRenderSurface->clearLayerList();
 
-    TransformationMatrix identityMatrix;
     {
         TRACE_EVENT("CCLayerTreeHost::updateLayers::calcDrawEtc", this, 0);
-        CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(rootLayer, rootLayer, identityMatrix, identityMatrix, updateList, rootRenderSurface->layerList(), layerRendererCapabilities().maxTextureSize);
+        TransformationMatrix identityMatrix;
+        TransformationMatrix deviceScaleTransform;
+        deviceScaleTransform.scale(m_settings.deviceScaleFactor);
+        CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(rootLayer, rootLayer, deviceScaleTransform, identityMatrix, updateList, rootRenderSurface->layerList(), layerRendererCapabilities().maxTextureSize);
     }
 
     // Reset partial texture update requests.
@@ -568,7 +581,7 @@ void CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList
     typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::FrontToBack> CCLayerIteratorType;
 
     bool recordMetricsForFrame = true; // FIXME: In the future, disable this when about:tracing is off.
-    CCOcclusionTracker occlusionTracker(IntRect(IntPoint(), viewportSize()), recordMetricsForFrame);
+    CCOcclusionTracker occlusionTracker(IntRect(IntPoint(), deviceViewportSize()), recordMetricsForFrame);
     occlusionTracker.setMinimumTrackingSize(CCOcclusionTracker::preferredMinimumTrackingSize());
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&renderSurfaceLayerList);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
index 8edac781b..3a863f77d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
@@ -83,7 +83,11 @@ struct CCSettings {
             , perTilePainting(false)
             , partialSwapEnabled(false)
             , threadedAnimationEnabled(false)
-            , maxPartialTextureUpdates(std::numeric_limits<size_t>::max()) { }
+            , maxPartialTextureUpdates(std::numeric_limits<size_t>::max())
+            , defaultTileSize(IntSize(256, 256))
+            , maxUntiledLayerSize(IntSize(512, 512))
+            , deviceScaleFactor(1)
+    { }
 
     bool acceleratePainting;
     bool showFPSCounter;
@@ -96,6 +100,9 @@ struct CCSettings {
     bool partialSwapEnabled;
     bool threadedAnimationEnabled;
     size_t maxPartialTextureUpdates;
+    IntSize defaultTileSize;
+    IntSize maxUntiledLayerSize;
+    float deviceScaleFactor;
 };
 
 // Provides information on an Impl's rendering capabilities back to the CCLayerTreeHost
@@ -198,6 +205,7 @@ public:
     bool commitRequested() const;
 
     void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
+    void didAddAnimation();
 
     LayerChromium* rootLayer() { return m_rootLayer.get(); }
     const LayerChromium* rootLayer() const { return m_rootLayer.get(); }
@@ -208,6 +216,8 @@ public:
     void setViewportSize(const IntSize&);
 
     const IntSize& viewportSize() const { return m_viewportSize; }
+    // Gives the viewport size in device/content space.
+    const IntSize& deviceViewportSize() const { return m_deviceViewportSize; }
 
     void setPageScaleFactorAndLimits(float pageScaleFactor, float minPageScaleFactor, float maxPageScaleFactor);
 
@@ -276,6 +286,7 @@ private:
     CCSettings m_settings;
 
     IntSize m_viewportSize;
+    IntSize m_deviceViewportSize;
     bool m_visible;
     typedef HashMap<GraphicsContext3D*, RefPtr<RateLimiter> > RateLimiterMap;
     RateLimiterMap m_rateLimiters;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index ec564f5f6..e7a06aaa9 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -119,7 +119,7 @@ CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCSettings& settings, CCLayerTree
     , m_maxPageScale(0)
     , m_needsAnimateLayers(false)
     , m_pinchGestureActive(false)
-    , m_timeSourceClientAdapter(CCLayerTreeHostImplTimeSourceAdapter::create(this, CCDelayBasedTimeSource::create(lowFrequencyAnimationInterval * 1000.0, CCProxy::currentThread())))
+    , m_timeSourceClientAdapter(CCLayerTreeHostImplTimeSourceAdapter::create(this, CCDelayBasedTimeSource::create(lowFrequencyAnimationInterval, CCProxy::currentThread())))
     , m_fpsCounter(CCFrameRateCounter::create())
     , m_debugRectHistory(CCDebugRectHistory::create())
 {
@@ -251,14 +251,16 @@ void CCLayerTreeHostImpl::calculateRenderSurfaceLayerList(CCLayerList& renderSur
     if (!m_rootLayerImpl->renderSurface())
         m_rootLayerImpl->createRenderSurface();
     m_rootLayerImpl->renderSurface()->clearLayerList();
-    m_rootLayerImpl->renderSurface()->setContentRect(IntRect(IntPoint(), viewportSize()));
+    m_rootLayerImpl->renderSurface()->setContentRect(IntRect(IntPoint(), deviceViewportSize()));
 
-    m_rootLayerImpl->setClipRect(IntRect(IntPoint(), viewportSize()));
+    m_rootLayerImpl->setClipRect(IntRect(IntPoint(), deviceViewportSize()));
 
     {
-        TransformationMatrix identityMatrix;
         TRACE_EVENT("CCLayerTreeHostImpl::calcDrawEtc", this, 0);
-        CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(m_rootLayerImpl.get(), m_rootLayerImpl.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, m_rootLayerImpl->renderSurface()->layerList(), &m_layerSorter, layerRendererCapabilities().maxTextureSize);
+        TransformationMatrix identityMatrix;
+        TransformationMatrix deviceScaleTransform;
+        deviceScaleTransform.scale(m_settings.deviceScaleFactor);
+        CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(m_rootLayerImpl.get(), m_rootLayerImpl.get(), deviceScaleTransform, identityMatrix, renderSurfaceLayerList, m_rootLayerImpl->renderSurface()->layerList(), &m_layerSorter, layerRendererCapabilities().maxTextureSize);
     }
 }
 
@@ -295,7 +297,7 @@ bool CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes, CCLaye
     if (layerRendererCapabilities().usingPartialSwap)
         scissorRect = enclosingIntRect(m_rootDamageRect);
     else
-        scissorRect = IntRect(IntPoint(), viewportSize());
+        scissorRect = IntRect(IntPoint(), deviceViewportSize());
 
     bool recordMetricsForFrame = true; // FIXME: In the future, disable this when about:tracing is off.
     CCOcclusionTrackerImpl occlusionTracker(scissorRect, recordMetricsForFrame);
@@ -526,10 +528,10 @@ void CCLayerTreeHostImpl::setVisible(bool visible)
     m_timeSourceClientAdapter->setActive(shouldTickInBackground);
 }
 
-bool CCLayerTreeHostImpl::initializeLayerRenderer(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<TextureUploader> uploader)
+bool CCLayerTreeHostImpl::initializeLayerRenderer(PassRefPtr<GraphicsContext3D> context, TextureUploaderOption textureUploader)
 {
     OwnPtr<LayerRendererChromium> layerRenderer;
-    layerRenderer = LayerRendererChromium::create(this, context, uploader);
+    layerRenderer = LayerRendererChromium::create(this, context, textureUploader);
 
     // Since we now have a new context/layerRenderer, we cannot continue to use the old
     // resources (i.e. renderSurfaces and texture IDs).
@@ -552,6 +554,10 @@ void CCLayerTreeHostImpl::setViewportSize(const IntSize& viewportSize)
         return;
 
     m_viewportSize = viewportSize;
+
+    m_deviceViewportSize = viewportSize;
+    m_deviceViewportSize.scale(m_settings.deviceScaleFactor);
+
     updateMaxScrollPosition();
 
     if (m_layerRenderer)
@@ -628,8 +634,11 @@ void CCLayerTreeHostImpl::updateMaxScrollPosition()
             viewBounds = clipLayer->bounds();
     }
     viewBounds.scale(1 / m_pageScaleDelta);
+    viewBounds.scale(m_settings.deviceScaleFactor);
 
+    // maxScroll is computed in physical pixels, but scroll positions are in layout pixels.
     IntSize maxScroll = contentSize() - expandedIntSize(viewBounds);
+    maxScroll.scale(1 / m_settings.deviceScaleFactor);
     // The viewport may be larger than the contents in some cases, such as
     // having a vertical scrollbar but no horizontal overflow.
     maxScroll.clampNegativeToZero();
@@ -657,8 +666,13 @@ CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoi
         return ScrollFailed;
     }
 
-    IntPoint scrollLayerContentPoint(m_scrollLayerImpl->screenSpaceTransform().inverse().mapPoint(viewportPoint));
-    if (m_scrollLayerImpl->nonFastScrollableRegion().contains(scrollLayerContentPoint)) {
+    IntPoint deviceViewportPoint = viewportPoint;
+    deviceViewportPoint.scale(m_settings.deviceScaleFactor, m_settings.deviceScaleFactor);
+
+    // The inverse of the screen space transform takes us from physical pixels to layout pixels.
+    IntPoint scrollLayerPoint(m_scrollLayerImpl->screenSpaceTransform().inverse().mapPoint(deviceViewportPoint));
+
+    if (m_scrollLayerImpl->nonFastScrollableRegion().contains(scrollLayerPoint)) {
         TRACE_EVENT("scrollBegin Failed nonFastScrollableRegion", this, 0);
         return ScrollFailed;
     }
@@ -757,8 +771,9 @@ void CCLayerTreeHostImpl::computePinchZoomDeltas(CCScrollAndScaleSet* scrollInfo
     FloatSize scrollEnd = scrollBegin + anchor;
     scrollEnd.scale(m_minPageScale / scaleBegin);
     scrollEnd -= anchor;
-    scrollEnd = scrollEnd.shrunkTo(roundedIntSize(scaledContentsSize - m_viewportSize)).expandedTo(FloatSize(0, 0));
+    scrollEnd = scrollEnd.shrunkTo(roundedIntSize(scaledContentsSize - m_deviceViewportSize)).expandedTo(FloatSize(0, 0));
     scrollEnd.scale(1 / pageScaleDeltaToSend);
+    scrollEnd.scale(m_settings.deviceScaleFactor);
 
     makeScrollAndScaleSet(scrollInfo, roundedIntSize(scrollEnd), m_minPageScale);
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index 8f16f9fd4..9333c16f9 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -105,7 +105,7 @@ public:
     void didDrawAllLayers(const FrameData&);
 
     // LayerRendererChromiumClient implementation
-    virtual const IntSize& viewportSize() const OVERRIDE { return m_viewportSize; }
+    virtual const IntSize& deviceViewportSize() const OVERRIDE { return m_deviceViewportSize; }
     virtual const CCSettings& settings() const OVERRIDE { return m_settings; }
     virtual void didLoseContext() OVERRIDE;
     virtual void onSwapBuffersComplete() OVERRIDE;
@@ -122,7 +122,7 @@ public:
     void finishAllRendering();
     int frameNumber() const { return m_frameNumber; }
 
-    bool initializeLayerRenderer(PassRefPtr<GraphicsContext3D>, PassOwnPtr<TextureUploader>);
+    bool initializeLayerRenderer(PassRefPtr<GraphicsContext3D>, TextureUploaderOption);
     bool isContextLost();
     LayerRendererChromium* layerRenderer() { return m_layerRenderer.get(); }
     const LayerRendererCapabilities& layerRendererCapabilities() const;
@@ -144,10 +144,11 @@ public:
     int sourceFrameNumber() const { return m_sourceFrameNumber; }
     void setSourceFrameNumber(int frameNumber) { m_sourceFrameNumber = frameNumber; }
 
+    const IntSize& viewportSize() const { return m_viewportSize; }
     void setViewportSize(const IntSize&);
 
-    void setPageScaleFactorAndLimits(float pageScale, float minPageScale, float maxPageScale);
     float pageScale() const { return m_pageScale; }
+    void setPageScaleFactorAndLimits(float pageScale, float minPageScale, float maxPageScale);
 
     PassOwnPtr<CCScrollAndScaleSet> processScrollDeltas();
 
@@ -170,6 +171,9 @@ protected:
     void animatePageScale(double monotonicTime);
     void animateGestures(double monotonicTime);
 
+    // Exposed for testing.
+    void calculateRenderSurfaceLayerList(CCLayerList&);
+
     // Virtual for testing.
     virtual void animateLayers(double monotonicTime, double wallClockTime);
 
@@ -187,7 +191,6 @@ private:
     void adjustScrollsForPageScaleChange(float);
     void updateMaxScrollPosition();
     void trackDamageForAllSurfaces(CCLayerImpl* rootDrawLayer, const CCLayerList& renderSurfaceLayerList);
-    void calculateRenderSurfaceLayerList(CCLayerList&);
 
     // Returns false if the frame should not be displayed. This function should
     // only be called from prepareToDraw, as didDrawAllLayers must be called
@@ -205,6 +208,7 @@ private:
     CCLayerImpl* m_scrollLayerImpl;
     CCSettings m_settings;
     IntSize m_viewportSize;
+    IntSize m_deviceViewportSize;
     bool m_visible;
 
     OwnPtr<CCHeadsUpDisplay> m_headsUpDisplay;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
index 9ebb71dc7..905c21a1d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
@@ -38,6 +38,7 @@ namespace WebCore {
 namespace {
 #ifndef NDEBUG
 bool implThreadIsOverridden = false;
+bool s_isMainThreadBlocked = false;
 ThreadIdentifier threadIDOverridenToBeImplThread;
 #endif
 CCThread* s_mainThread = 0;
@@ -102,6 +103,16 @@ void CCProxy::setCurrentThreadIsImplThread(bool isImplThread)
     if (isImplThread)
         threadIDOverridenToBeImplThread = WTF::currentThread();
 }
+
+bool CCProxy::isMainThreadBlocked()
+{
+    return s_isMainThreadBlocked;
+}
+
+void CCProxy::setMainThreadBlocked(bool isMainThreadBlocked)
+{
+    s_isMainThreadBlocked = isMainThreadBlocked;
+}
 #endif
 
 CCProxy::CCProxy()
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
index 4a36c388e..22297c1f7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
@@ -86,6 +86,8 @@ public:
     virtual void setNeedsRedraw() = 0;
     virtual void setVisible(bool) = 0;
 
+    virtual void didAddAnimation() = 0;
+
     virtual bool commitRequested() const = 0;
 
     virtual void start() = 0; // Must be called before using the proxy.
@@ -106,6 +108,8 @@ public:
 #ifndef NDEBUG
     static bool isMainThread();
     static bool isImplThread();
+    static bool isMainThreadBlocked();
+    static void setMainThreadBlocked(bool);
 #endif
 
     // Temporary hack while render_widget still does scheduling for CCLayerTreeHostMainThreadI
@@ -121,6 +125,25 @@ public:
 protected:
     CCProxy();
     friend class DebugScopedSetImplThread;
+    friend class DebugScopedSetMainThreadBlocked;
+};
+
+class DebugScopedSetMainThreadBlocked {
+public:
+    DebugScopedSetMainThreadBlocked()
+    {
+#if !ASSERT_DISABLED
+        ASSERT(!CCProxy::isMainThreadBlocked());
+        CCProxy::setMainThreadBlocked(true);
+#endif
+    }
+    ~DebugScopedSetMainThreadBlocked()
+    {
+#if !ASSERT_DISABLED
+        ASSERT(CCProxy::isMainThreadBlocked());
+        CCProxy::setMainThreadBlocked(false);
+#endif
+    }
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index d5318ae36..ef6e8c6ec 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -32,30 +32,35 @@
 #include "cc/CCFontAtlas.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCTextureUpdater.h"
+#include "cc/CCTimer.h"
 #include <wtf/CurrentTime.h>
 
 using namespace WTF;
 
 namespace WebCore {
 
-class UnthrottledTextureUploader : public TextureUploader {
-    WTF_MAKE_NONCOPYABLE(UnthrottledTextureUploader);
+class CCSingleThreadProxyAnimationTimer : public CCTimer, CCTimerClient {
 public:
-    static PassOwnPtr<UnthrottledTextureUploader> create()
+    static PassOwnPtr<CCSingleThreadProxyAnimationTimer> create(CCSingleThreadProxy* proxy) { return adoptPtr(new CCSingleThreadProxyAnimationTimer(proxy)); }
+
+    virtual void onTimerFired() OVERRIDE
     {
-        return adoptPtr(new UnthrottledTextureUploader());
+        m_proxy->compositeImmediately();
     }
-    virtual ~UnthrottledTextureUploader() { }
 
-    virtual bool isBusy() { return false; }
-    virtual void beginUploads() { }
-    virtual void endUploads() { }
-    virtual void uploadTexture(GraphicsContext3D* context, LayerTextureUpdater::Texture* texture, TextureAllocator* allocator, const IntRect sourceRect, const IntRect destRect) { texture->updateRect(context, allocator, sourceRect, destRect); }
+private:
+    explicit CCSingleThreadProxyAnimationTimer(CCSingleThreadProxy* proxy)
+        : CCTimer(CCProxy::mainThread(), this)
+        , m_proxy(proxy)
+    {
+    }
 
-protected:
-    UnthrottledTextureUploader() { }
+    CCSingleThreadProxy* m_proxy;
 };
 
+// Measured in seconds.
+static const double animationTimerDelay = 1 / 60.0;
+
 PassOwnPtr<CCProxy> CCSingleThreadProxy::create(CCLayerTreeHost* layerTreeHost)
 {
     return adoptPtr(new CCSingleThreadProxy(layerTreeHost));
@@ -65,6 +70,7 @@ CCSingleThreadProxy::CCSingleThreadProxy(CCLayerTreeHost* layerTreeHost)
     : m_layerTreeHost(layerTreeHost)
     , m_contextLost(false)
     , m_compositorIdentifier(-1)
+    , m_animationTimer(CCSingleThreadProxyAnimationTimer::create(this))
     , m_layerRendererInitialized(false)
     , m_nextFrameIsNewlyCommittedFrame(false)
 {
@@ -155,7 +161,7 @@ bool CCSingleThreadProxy::initializeLayerRenderer()
     ASSERT(m_contextBeforeInitialization);
     {
         DebugScopedSetImplThread impl;
-        bool ok = m_layerTreeHostImpl->initializeLayerRenderer(m_contextBeforeInitialization.release(), UnthrottledTextureUploader::create());
+        bool ok = m_layerTreeHostImpl->initializeLayerRenderer(m_contextBeforeInitialization.release(), UnthrottledUploader);
         if (ok) {
             m_layerRendererInitialized = true;
             m_layerRendererCapabilitiesForMainThread = m_layerTreeHostImpl->layerRendererCapabilities();
@@ -179,7 +185,7 @@ bool CCSingleThreadProxy::recreateContext()
     {
         DebugScopedSetImplThread impl;
         m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
-        initialized = m_layerTreeHostImpl->initializeLayerRenderer(context, UnthrottledTextureUploader::create());
+        initialized = m_layerTreeHostImpl->initializeLayerRenderer(context, UnthrottledUploader);
         if (initialized) {
             m_layerRendererCapabilitiesForMainThread = m_layerTreeHostImpl->layerRendererCapabilities();
         }
@@ -216,7 +222,9 @@ void CCSingleThreadProxy::doCommit(CCTextureUpdater& updater)
     ASSERT(CCProxy::isMainThread());
     // Commit immediately
     {
+        DebugScopedSetMainThreadBlocked mainThreadBlocked;
         DebugScopedSetImplThread impl;
+
         m_layerTreeHostImpl->beginCommit();
 
         m_layerTreeHost->beginCommitOnImplThread(m_layerTreeHostImpl.get());
@@ -276,12 +284,19 @@ void CCSingleThreadProxy::setVisible(bool visible)
     setNeedsCommit();
 }
 
+void CCSingleThreadProxy::didAddAnimation()
+{
+    m_animationTimer->startOneShot(animationTimerDelay);
+}
+
 void CCSingleThreadProxy::stop()
 {
     TRACE_EVENT("CCSingleThreadProxy::stop", this, 0);
     ASSERT(CCProxy::isMainThread());
     {
+        DebugScopedSetMainThreadBlocked mainThreadBlocked;
         DebugScopedSetImplThread impl;
+
         m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
         m_layerTreeHostImpl.clear();
     }
@@ -345,21 +360,22 @@ bool CCSingleThreadProxy::doComposite()
 {
     ASSERT(!m_contextLost);
     {
-      DebugScopedSetImplThread impl;
-      double monotonicTime = monotonicallyIncreasingTime();
-      double wallClockTime = currentTime();
-      m_layerTreeHostImpl->animate(monotonicTime, wallClockTime);
-
-      // We guard prepareToDraw() with canDraw() because it always returns a valid frame, so can only
-      // be used when such a frame is possible. Since drawLayers() depends on the result of
-      // prepareToDraw(), it is guarded on canDraw() as well.
-      if (!m_layerTreeHostImpl->canDraw())
-          return false;
-
-      CCLayerTreeHostImpl::FrameData frame;
-      m_layerTreeHostImpl->prepareToDraw(frame);
-      m_layerTreeHostImpl->drawLayers(frame);
-      m_layerTreeHostImpl->didDrawAllLayers(frame);
+        DebugScopedSetImplThread impl;
+        double monotonicTime = monotonicallyIncreasingTime();
+        double wallClockTime = currentTime();
+
+        m_layerTreeHostImpl->animate(monotonicTime, wallClockTime);
+
+        // We guard prepareToDraw() with canDraw() because it always returns a valid frame, so can only
+        // be used when such a frame is possible. Since drawLayers() depends on the result of
+        // prepareToDraw(), it is guarded on canDraw() as well.
+        if (!m_layerTreeHostImpl->canDraw())
+            return false;
+
+        CCLayerTreeHostImpl::FrameData frame;
+        m_layerTreeHostImpl->prepareToDraw(frame);
+        m_layerTreeHostImpl->drawLayers(frame);
+        m_layerTreeHostImpl->didDrawAllLayers(frame);
     }
 
     if (m_layerTreeHostImpl->isContextLost()) {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
index 156bddca1..165dc84c5 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
@@ -35,6 +35,7 @@
 namespace WebCore {
 
 class CCLayerTreeHost;
+class CCSingleThreadProxyAnimationTimer;
 
 class CCSingleThreadProxy : public CCProxy, CCLayerTreeHostImplClient {
 public:
@@ -59,6 +60,7 @@ public:
     virtual void setNeedsRedraw() OVERRIDE;
     virtual bool commitRequested() const OVERRIDE;
     virtual void setVisible(bool) OVERRIDE;
+    virtual void didAddAnimation() OVERRIDE;
     virtual void start() OVERRIDE;
     virtual void stop() OVERRIDE;
     virtual size_t maxPartialTextureUpdates() const OVERRIDE { return std::numeric_limits<size_t>::max(); }
@@ -94,6 +96,8 @@ private:
     // be used for anything else.
     RefPtr<GraphicsContext3D> m_contextBeforeInitialization;
 
+    OwnPtr<CCSingleThreadProxyAnimationTimer> m_animationTimer;
+
     // Used on the CCThread, but checked on main thread during initialization/shutdown.
     OwnPtr<CCLayerTreeHostImpl> m_layerTreeHostImpl;
     bool m_layerRendererInitialized;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index 078490581..7a6abc4d8 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -57,24 +57,12 @@ static const double contextRecreationTickRate = 0.03;
 
 namespace WebCore {
 
-// FIXME: remove when ThrottledTextureUploader is ready to be used.
-class UnthrottledTextureUploader : public TextureUploader {
-    WTF_MAKE_NONCOPYABLE(UnthrottledTextureUploader);
-public:
-    static PassOwnPtr<UnthrottledTextureUploader> create(PassRefPtr<GraphicsContext3D> context)
-    {
-        return adoptPtr(new UnthrottledTextureUploader(context));
-    }
-    virtual ~UnthrottledTextureUploader() { }
+namespace {
 
-    virtual bool isBusy() { return false; }
-    virtual void beginUploads() { }
-    virtual void endUploads() { }
-    virtual void uploadTexture(GraphicsContext3D* context, LayerTextureUpdater::Texture* texture, TextureAllocator* allocator, const IntRect sourceRect, const IntRect destRect) { texture->updateRect(context, allocator, sourceRect, destRect); }
+// Type of texture uploader to use for texture updates.
+static TextureUploaderOption textureUploader = ThrottledUploader;
 
-protected:
-    explicit UnthrottledTextureUploader(PassRefPtr<GraphicsContext3D>) { }
-};
+} // anonymous namespace
 
 PassOwnPtr<CCProxy> CCThreadProxy::create(CCLayerTreeHost* layerTreeHost)
 {
@@ -409,9 +397,13 @@ void CCThreadProxy::stop()
     ASSERT(m_started);
 
     // Synchronously deletes the impl.
-    CCCompletionEvent completion;
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::layerTreeHostClosedOnImplThread, AllowCrossThreadAccess(&completion)));
-    completion.wait();
+    {
+        DebugScopedSetMainThreadBlocked mainThreadBlocked;
+
+        CCCompletionEvent completion;
+        CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::layerTreeHostClosedOnImplThread, AllowCrossThreadAccess(&completion)));
+        completion.wait();
+    }
 
     m_mainThreadProxy->shutdown(); // Stop running tasks posted to us.
 
@@ -541,6 +533,8 @@ void CCThreadProxy::beginFrame()
     // coordinated by the CCScheduler.
     {
         TRACE_EVENT("commit", this, 0);
+        DebugScopedSetMainThreadBlocked mainThreadBlocked;
+
         CCCompletionEvent completion;
         CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::beginFrameCompleteOnImplThread, AllowCrossThreadAccess(&completion)));
         completion.wait();
@@ -834,8 +828,7 @@ void CCThreadProxy::initializeLayerRendererOnImplThread(CCCompletionEvent* compl
     TRACE_EVENT("CCThreadProxy::initializeLayerRendererOnImplThread", this, 0);
     ASSERT(isImplThread());
     ASSERT(m_contextBeforeInitializationOnImplThread);
-    OwnPtr<TextureUploader> uploader = UnthrottledTextureUploader::create(m_contextBeforeInitializationOnImplThread.get());
-    *initializeSucceeded = m_layerTreeHostImpl->initializeLayerRenderer(m_contextBeforeInitializationOnImplThread.release(), uploader.release());
+    *initializeSucceeded = m_layerTreeHostImpl->initializeLayerRenderer(m_contextBeforeInitializationOnImplThread.release(), textureUploader);
     if (*initializeSucceeded) {
         *capabilities = m_layerTreeHostImpl->layerRendererCapabilities();
         if (capabilities->usingSwapCompleteCallback)
@@ -885,8 +878,7 @@ void CCThreadProxy::recreateContextOnImplThread(CCCompletionEvent* completion, G
     TRACE_EVENT0("cc", "CCThreadProxy::recreateContextOnImplThread");
     ASSERT(isImplThread());
     m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
-    OwnPtr<TextureUploader> uploader = UnthrottledTextureUploader::create(contextPtr);
-    *recreateSucceeded = m_layerTreeHostImpl->initializeLayerRenderer(adoptRef(contextPtr), uploader.release());
+    *recreateSucceeded = m_layerTreeHostImpl->initializeLayerRenderer(adoptRef(contextPtr), textureUploader);
     if (*recreateSucceeded) {
         *capabilities = m_layerTreeHostImpl->layerRendererCapabilities();
         m_schedulerOnImplThread->didRecreateContext();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
index 2915a8119..9ff581ef9 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
@@ -68,6 +68,7 @@ public:
     virtual void setNeedsRedraw() OVERRIDE;
     virtual bool commitRequested() const OVERRIDE;
     virtual void setVisible(bool) OVERRIDE;
+    virtual void didAddAnimation() OVERRIDE { }
     virtual void start() OVERRIDE;
     virtual void stop() OVERRIDE;
     virtual size_t maxPartialTextureUpdates() const OVERRIDE;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTimer.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTimer.cpp
index 6d6189e23..ba9eccc95 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTimer.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTimer.cpp
@@ -52,10 +52,14 @@ public:
 
     void performTask()
     {
-        if (!m_timer || !m_timer->m_client)
+        if (!m_timer)
             return;
 
-        m_timer->m_client->onTimerFired();
+        CCTimerClient* client = m_timer->m_client;
+
+        m_timer->stop();
+        if (client)
+            client->onTimerFired();
     }
 
 private:
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
index 9c076a2ed..f585d6804 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
@@ -80,12 +80,19 @@ CCVideoLayerImpl::CCVideoLayerImpl(int id, WebKit::WebVideoFrameProvider* provid
     , m_frame(0)
 {
     memcpy(m_streamTextureMatrix, flipTransform, sizeof(m_streamTextureMatrix));
-    provider->setVideoFrameProviderClient(this);
+
+    // This only happens during a commit on the compositor thread while the main
+    // thread is blocked. That makes this a thread-safe call to set the video
+    // frame provider client that does not require a lock. The same is true of
+    // the call in the destructor.
+    ASSERT(CCProxy::isMainThreadBlocked());
+    m_provider->setVideoFrameProviderClient(this);
 }
 
 CCVideoLayerImpl::~CCVideoLayerImpl()
 {
-    MutexLocker locker(m_providerMutex);
+    // See comment in constructor for why this doesn't need a lock.
+    ASSERT(CCProxy::isMainThreadBlocked());
     if (m_provider) {
         m_provider->setVideoFrameProviderClient(0);
         m_provider = 0;
@@ -96,7 +103,10 @@ CCVideoLayerImpl::~CCVideoLayerImpl()
 
 void CCVideoLayerImpl::stopUsingProvider()
 {
+    // Block the provider from shutting down until this client is done
+    // using the frame.
     MutexLocker locker(m_providerMutex);
+    ASSERT(!m_frame);
     m_provider = 0;
 }
 
diff --git a/Source/WebCore/platform/graphics/clutter/DrawingBufferClutter.cpp b/Source/WebCore/platform/graphics/clutter/DrawingBufferClutter.cpp
index 41bc7e612..af99700c9 100644
--- a/Source/WebCore/platform/graphics/clutter/DrawingBufferClutter.cpp
+++ b/Source/WebCore/platform/graphics/clutter/DrawingBufferClutter.cpp
@@ -71,7 +71,7 @@ unsigned DrawingBuffer::frontColorBuffer() const
     return colorBuffer();
 }
 
-void DrawingBuffer::paintCompositedResultsToCanvas(CanvasRenderingContext* context)
+void DrawingBuffer::paintCompositedResultsToCanvas(ImageBuffer*)
 {
 }
 #endif
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
index e5601c8f8..6a37ebc10 100644
--- a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
@@ -725,7 +725,7 @@ bool GraphicsContext3D::layerComposited() const
     return false;
 }
 
-void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context, DrawingBuffer* drawingBuffer)
+void GraphicsContext3D::paintRenderingResultsToCanvas(ImageBuffer*, DrawingBuffer* drawingBuffer)
 {
     notImplemented();
 }
@@ -736,7 +736,7 @@ PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData(Drawin
     return 0;
 }
 
-bool GraphicsContext3D::paintCompositedResultsToCanvas(CanvasRenderingContext*)
+bool GraphicsContext3D::paintCompositedResultsToCanvas(ImageBuffer*)
 {
     return false;
 }
diff --git a/Source/WebCore/platform/graphics/efl/ImageEfl.cpp b/Source/WebCore/platform/graphics/efl/ImageEfl.cpp
index 822ef2e72..a7d1a2bdb 100644
--- a/Source/WebCore/platform/graphics/efl/ImageEfl.cpp
+++ b/Source/WebCore/platform/graphics/efl/ImageEfl.cpp
@@ -37,10 +37,6 @@
 
 namespace WebCore {
 
-void BitmapImage::initPlatformData()
-{
-}
-
 void BitmapImage::invalidatePlatformData()
 {
 }
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.cpp b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
index 57101af7f..ddfa1e419 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -124,7 +124,7 @@ void FEComposite::correctFilterResultIfNeeded()
     forceValidPreMultipliedPixels();
 }
 
-template <int b1, int b2, int b3, int b4>
+template <int b1, int b4>
 static inline void computeArithmeticPixels(unsigned char* source, unsigned char* destination, int pixelArrayLength,
                                     float k1, float k2, float k3, float k4)
 {
@@ -138,13 +138,9 @@ static inline void computeArithmeticPixels(unsigned char* source, unsigned char*
     while (--pixelArrayLength >= 0) {
         unsigned char i1 = *source;
         unsigned char i2 = *destination;
-        float result = 0;
+        float result = k2 * i1 + k3 * i2;
         if (b1)
             result += scaledK1 * i1 * i2;
-        if (b2)
-            result += k2 * i1;
-        if (b3)
-            result += k3 * i2;
         if (b4)
             result += scaledK4;
 
@@ -164,19 +160,19 @@ static inline void arithmeticSoftware(unsigned char* source, unsigned char* dest
 {
     if (!k4) {
         if (!k1) {
-            computeArithmeticPixels<0, 1, 1, 0>(source, destination, pixelArrayLength, k1, k2, k3, k4);
+            computeArithmeticPixels<0, 0>(source, destination, pixelArrayLength, k1, k2, k3, k4);
             return;
         }
 
-        computeArithmeticPixels<1, 1, 1, 0>(source, destination, pixelArrayLength, k1, k2, k3, k4);
+        computeArithmeticPixels<1, 0>(source, destination, pixelArrayLength, k1, k2, k3, k4);
         return;
     }
 
     if (!k1) {
-        computeArithmeticPixels<0, 1, 1, 1>(source, destination, pixelArrayLength, k1, k2, k3, k4);
+        computeArithmeticPixels<0, 1>(source, destination, pixelArrayLength, k1, k2, k3, k4);
         return;
     }
-    computeArithmeticPixels<1, 1, 1, 1>(source, destination, pixelArrayLength, k1, k2, k3, k4);
+    computeArithmeticPixels<1, 1>(source, destination, pixelArrayLength, k1, k2, k3, k4);
 }
 
 inline void FEComposite::platformArithmeticSoftware(Uint8ClampedArray* source, Uint8ClampedArray* destination,
@@ -185,10 +181,9 @@ inline void FEComposite::platformArithmeticSoftware(Uint8ClampedArray* source, U
     int length = source->length();
     ASSERT(length == static_cast<int>(destination->length()));
     // The selection here eventually should happen dynamically.
-#if CPU(ARM_NEON) && COMPILER(GCC)
+#if HAVE(ARM_NEON_INTRINSICS)
     ASSERT(!(length & 0x3));
-    float coefficients[4]  = { k1, k2, k3, k4 };
-    platformArithmeticNeon(source->data(), destination->data(), length, coefficients);
+    platformArithmeticNeon(source->data(), destination->data(), length, k1, k2, k3, k4);
 #else
     arithmeticSoftware(source->data(), destination->data(), length, k1, k2, k3, k4);
 #endif
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.h b/Source/WebCore/platform/graphics/filters/FEComposite.h
index 42695f6c2..60fded137 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.h
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.h
@@ -74,8 +74,13 @@ protected:
 private:
     FEComposite(Filter*, const CompositeOperationType&, float, float, float, float);
 
-    inline void platformArithmeticSoftware(Uint8ClampedArray* source, Uint8ClampedArray* destination, float k1, float k2, float k3, float k4);
-    inline void platformArithmeticNeon(unsigned char* source, unsigned  char* destination, unsigned pixelArrayLength, float* kArray);
+    inline void platformArithmeticSoftware(Uint8ClampedArray* source, Uint8ClampedArray* destination,
+        float k1, float k2, float k3, float k4);
+    template <int b1, int b4>
+    static inline void computeArithmeticPixelsNeon(unsigned char* source, unsigned  char* destination,
+        unsigned pixelArrayLength, float k1, float k2, float k3, float k4);
+    static inline void platformArithmeticNeon(unsigned char* source, unsigned  char* destination,
+        unsigned pixelArrayLength, float k1, float k2, float k3, float k4);
 
     CompositeOperationType m_type;
     float m_k1;
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
index 89223bb19..010521c3f 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
@@ -77,6 +77,9 @@ FECustomFilter::FECustomFilter(Filter* filter, HostWindow* hostWindow, PassRefPt
                                CustomFilterOperation::MeshType meshType)
     : FilterEffect(filter)
     , m_hostWindow(hostWindow)
+    , m_frameBuffer(0)
+    , m_depthBuffer(0)
+    , m_destTexture(0)
     , m_program(program)
     , m_parameters(parameters)
     , m_meshRows(meshRows)
@@ -93,6 +96,27 @@ PassRefPtr<FECustomFilter> FECustomFilter::create(Filter* filter, HostWindow* ho
     return adoptRef(new FECustomFilter(filter, hostWindow, program, parameters, meshRows, meshColumns, meshBoxType, meshType));
 }
 
+FECustomFilter::~FECustomFilter()
+{
+    deleteRenderBuffers();
+}
+
+void FECustomFilter::deleteRenderBuffers()
+{
+    if (m_frameBuffer) {
+        m_context->deleteFramebuffer(m_frameBuffer);
+        m_frameBuffer = 0;
+    }
+    if (m_depthBuffer) {
+        m_context->deleteRenderbuffer(m_depthBuffer);
+        m_depthBuffer = 0;
+    }
+    if (m_destTexture) {
+        m_context->deleteTexture(m_destTexture);
+        m_destTexture = 0;
+    }
+}
+
 void FECustomFilter::platformApplySoftware()
 {
     Uint8ClampedArray* dstPixelArray = createPremultipliedImageResult();
@@ -106,11 +130,11 @@ void FECustomFilter::platformApplySoftware()
     IntSize newContextSize(effectDrawingRect.size());
     bool hadContext = m_context;
     if (!m_context)
-        initializeContext(newContextSize);
+        initializeContext();
     
     if (!hadContext || m_contextSize != newContextSize)
         resizeContext(newContextSize);
-    
+
     // Do not draw the filter if the input image cannot fit inside a single GPU texture.
     if (m_inputTexture->tiles().numTilesX() != 1 || m_inputTexture->tiles().numTilesY() != 1)
         return;
@@ -118,6 +142,9 @@ void FECustomFilter::platformApplySoftware()
     // The shader had compiler errors. We cannot draw anything.
     if (!m_shader->isInitialized())
         return;
+
+    m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_frameBuffer);
+    m_context->viewport(0, 0, newContextSize.width(), newContextSize.height());
     
     m_context->clearColor(0, 0, 0, 0);
     m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT | GraphicsContext3D::DEPTH_BUFFER_BIT);
@@ -126,15 +153,11 @@ void FECustomFilter::platformApplySoftware()
     
     m_context->drawElements(GraphicsContext3D::TRIANGLES, m_mesh->indicesCount(), GraphicsContext3D::UNSIGNED_SHORT, 0);
     
-    m_drawingBuffer->commit();
-
-    RefPtr<ImageData> imageData = m_context->paintRenderingResultsToImageData(m_drawingBuffer.get());
-    Uint8ClampedArray* gpuResult = imageData->data();
-    ASSERT(gpuResult->length() == dstPixelArray->length());
-    memcpy(dstPixelArray->data(), gpuResult->data(), gpuResult->length());
+    ASSERT(static_cast<size_t>(newContextSize.width() * newContextSize.height() * 4) == dstPixelArray->length());
+    m_context->readPixels(0, 0, newContextSize.width(), newContextSize.height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, dstPixelArray->data());
 }
 
-void FECustomFilter::initializeContext(const IntSize& contextSize)
+void FECustomFilter::initializeContext()
 {
     GraphicsContext3D::Attributes attributes;
     attributes.preserveDrawingBuffer = true;
@@ -142,7 +165,7 @@ void FECustomFilter::initializeContext(const IntSize& contextSize)
     
     ASSERT(!m_context.get());
     m_context = GraphicsContext3D::create(attributes, m_hostWindow, GraphicsContext3D::RenderOffscreen);
-    m_drawingBuffer = DrawingBuffer::create(m_context.get(), contextSize, DrawingBuffer::Discard, DrawingBuffer::Alpha);
+    m_context->enable(GraphicsContext3D::DEPTH_TEST);
     
     m_shader = m_program->createShaderWithContext(m_context.get());
     m_mesh = CustomFilterMesh::create(m_context.get(), m_meshColumns, m_meshRows, 
@@ -152,11 +175,31 @@ void FECustomFilter::initializeContext(const IntSize& contextSize)
 
 void FECustomFilter::resizeContext(const IntSize& newContextSize)
 {
-    m_inputTexture = 0;
-    m_drawingBuffer->reset(newContextSize);
-    m_context->reshape(newContextSize.width(), newContextSize.height());
-    m_context->viewport(0, 0, newContextSize.width(), newContextSize.height());
     m_inputTexture = Texture::create(m_context.get(), Texture::RGBA8, newContextSize.width(), newContextSize.height());
+    
+    if (!m_frameBuffer)
+        m_frameBuffer = m_context->createFramebuffer();
+    if (!m_depthBuffer)
+        m_depthBuffer = m_context->createRenderbuffer();
+    if (!m_destTexture) {
+        m_destTexture = m_context->createTexture();
+        m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_destTexture);
+        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
+        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
+        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+    }
+    
+    m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_destTexture);
+    m_context->texImage2DResourceSafe(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, newContextSize.width(), newContextSize.height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE);
+
+    m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_frameBuffer);
+    m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_destTexture, 0);
+    
+    m_context->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+    m_context->renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT16, newContextSize.width(), newContextSize.height());
+    m_context->framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+    
     m_contextSize = newContextSize;
 }
 
@@ -222,12 +265,7 @@ void FECustomFilter::bindProgramAndBuffers(Uint8ClampedArray* srcPixelArray)
     
     if (m_shader->projectionMatrixLocation() != -1) {
         TransformationMatrix projectionMatrix; 
-#if PLATFORM(CHROMIUM)
-        // We flip-y the projection matrix here because Chromium will flip-y the resulting image for us.
-        orthogonalProjectionMatrix(projectionMatrix, -0.5, 0.5, 0.5, -0.5);
-#else
         orthogonalProjectionMatrix(projectionMatrix, -0.5, 0.5, -0.5, 0.5);
-#endif
         float glProjectionMatrix[16];
         projectionMatrix.toColumnMajorFloatArray(glProjectionMatrix);
         m_context->uniformMatrix4fv(m_shader->projectionMatrixLocation(), 1, false, &glProjectionMatrix[0]);
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.h b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
index 5f5f02768..f56dac010 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.h
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
@@ -35,6 +35,7 @@
 #include "CustomFilterOperation.h"
 #include "Filter.h"
 #include "FilterEffect.h"
+#include "GraphicsTypes3D.h"
 #include <wtf/RefPtr.h>
 
 namespace JSC {
@@ -69,8 +70,10 @@ private:
     FECustomFilter(Filter*, HostWindow*, PassRefPtr<CustomFilterProgram>, const CustomFilterParameterList&,
                    unsigned meshRows, unsigned meshColumns, CustomFilterOperation::MeshBoxType, 
                    CustomFilterOperation::MeshType);
+    ~FECustomFilter();
     
-    void initializeContext(const IntSize& contextSize);
+    void initializeContext();
+    void deleteRenderBuffers();
     void resizeContext(const IntSize& newContextSize);
     void bindVertexAttribute(int attributeLocation, unsigned size, unsigned& offset);
     void bindProgramNumberParameters(int uniformLocation, CustomFilterNumberParameter*);
@@ -80,12 +83,15 @@ private:
     HostWindow* m_hostWindow;
     
     RefPtr<GraphicsContext3D> m_context;
-    RefPtr<DrawingBuffer> m_drawingBuffer;
     RefPtr<Texture> m_inputTexture;
     RefPtr<CustomFilterShader> m_shader;
     RefPtr<CustomFilterMesh> m_mesh;
     IntSize m_contextSize;
 
+    Platform3DObject m_frameBuffer;
+    Platform3DObject m_depthBuffer;
+    Platform3DObject m_destTexture;
+
     RefPtr<CustomFilterProgram> m_program;
     CustomFilterParameterList m_parameters;
 
diff --git a/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
index fc3baf832..6f2277681 100644
--- a/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -142,7 +142,7 @@ inline void FEGaussianBlur::platformApplyGeneric(Uint8ClampedArray* srcPixelArra
 void FEGaussianBlur::platformApplyWorker(PlatformApplyParameters* parameters)
 {
     IntSize paintSize(parameters->width, parameters->height);
-#if CPU(ARM_NEON) && COMPILER(GCC)
+#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
     parameters->filter->platformApplyNeon(parameters->srcPixelArray.get(), parameters->dstPixelArray.get(),
         parameters->kernelSizeX, parameters->kernelSizeY, paintSize);
 #else
@@ -221,7 +221,7 @@ inline void FEGaussianBlur::platformApply(Uint8ClampedArray* srcPixelArray, Uint
     }
 
     // The selection here eventually should happen dynamically on some platforms.
-#if CPU(ARM_NEON) && COMPILER(GCC)
+#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
     platformApplyNeon(srcPixelArray, tmpPixelArray, kernelSizeX, kernelSizeY, paintSize);
 #else
     platformApplyGeneric(srcPixelArray, tmpPixelArray, kernelSizeX, kernelSizeY, paintSize);
diff --git a/Source/WebCore/platform/graphics/filters/FELighting.cpp b/Source/WebCore/platform/graphics/filters/FELighting.cpp
index 9d386fc6a..0249ba1fb 100644
--- a/Source/WebCore/platform/graphics/filters/FELighting.cpp
+++ b/Source/WebCore/platform/graphics/filters/FELighting.cpp
@@ -283,7 +283,7 @@ inline void FELighting::platformApplyGeneric(LightingData& data, LightSource::Pa
 inline void FELighting::platformApply(LightingData& data, LightSource::PaintingData& paintingData)
 {
     // The selection here eventually should happen dynamically on some platforms.
-#if CPU(ARM_NEON) && COMPILER(GCC)
+#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
     platformApplyNeon(data, paintingData);
 #else
     platformApplyGeneric(data, paintingData);
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
index 8dc918553..9701e5340 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -29,6 +29,10 @@
 #include "TextStream.h"
 #include <wtf/Uint8ClampedArray.h>
 
+#if HAVE(ARM_NEON_INTRINSICS)
+#include <arm_neon.h>
+#endif
+
 namespace WebCore {
 
 FilterEffect::FilterEffect(Filter* filter)
@@ -131,6 +135,26 @@ void FilterEffect::forceValidPreMultipliedPixels()
 
     // We must have four bytes per pixel, and complete pixels
     ASSERT(!(pixelArrayLength % 4));
+
+#if HAVE(ARM_NEON_INTRINSICS)
+    if (pixelArrayLength >= 64) {
+        unsigned char* lastPixel = pixelData + (pixelArrayLength & ~0x3f);
+        do {
+            // Increments pixelData by 64.
+            uint8x16x4_t sixteenPixels = vld4q_u8(pixelData);
+            sixteenPixels.val[0] = vminq_u8(sixteenPixels.val[0], sixteenPixels.val[3]);
+            sixteenPixels.val[1] = vminq_u8(sixteenPixels.val[1], sixteenPixels.val[3]);
+            sixteenPixels.val[2] = vminq_u8(sixteenPixels.val[2], sixteenPixels.val[3]);
+            vst4q_u8(pixelData, sixteenPixels);
+            pixelData += 64;
+        } while (pixelData < lastPixel);
+
+        pixelArrayLength &= 0x3f;
+        if (!pixelArrayLength)
+            return;
+    }
+#endif
+
     int numPixels = pixelArrayLength / 4;
 
     // Iterate over each pixel, checking alpha and adjusting color components if necessary
diff --git a/Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp b/Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp
deleted file mode 100644
index 22a845823..000000000
--- a/Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.cpp
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * Copyright (C) 2011 University of Szeged
- * Copyright (C) 2011 Felician Marton
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(FILTERS)
-#include "FECompositeArithmeticNEON.h"
-
-#if CPU(ARM_NEON) && COMPILER(GCC)
-
-namespace WebCore {
-
-#define ASSTRING(str) #str
-#define TOSTRING(value) ASSTRING(value)
-
-#define NL "\n"
-
-#define SOURCE_R     "r0"
-#define DEST_R       "r1"
-#define END_R        "r2"
-#define K_R          "r3"
-#define NEXTPIXEL_R  "r12"
-
-#define TEMP_Q       "q0"
-#define TEMP_D0      "d0"
-#define TEMP_D00     "d0[0]"
-#define TEMP_D01     "d0[1]"
-#define TEMP_D10     "d1[0]"
-#define TEMP_D11     "d1[1]"
-#define PIXEL1_Q     "q1"
-#define PIXEL1_D0    "d2"
-#define PIXEL1_D00   "d2[0]"
-#define PIXEL2_Q     "q2"
-#define PIXEL2_D0    "d4"
-#define PIXEL2_D00   "d4[0]"
-#define BYTEMAX_Q    "q3"
-#define K1_Q         "q8"
-#define K2_Q         "q9"
-#define K3_Q         "q10"
-#define K4_Q         "q11"
-
-asm ( // NOLINT
-".globl " TOSTRING(neonDrawCompositeArithmetic) NL
-TOSTRING(neonDrawCompositeArithmetic) ":" NL
-    "cmp " END_R ", #0" NL
-    "bxeq lr"  NL
-    // Set the end of the source register.
-    "add " END_R ", " SOURCE_R ", " END_R NL
-
-    "vld1.f32 {" TEMP_Q "}, [" K_R "]" NL
-    "ldr " K_R ", [" K_R "]" NL
-    "vdup.f32 " K1_Q ", " TEMP_D00 NL
-    "vdup.f32 " K2_Q ", " TEMP_D01 NL
-    "vdup.f32 " K3_Q ", " TEMP_D10 NL
-    "vdup.f32 " K4_Q ", " TEMP_D11 NL
-
-    "vmov.i32 " BYTEMAX_Q ", #0xFF" NL
-    "vcvt.f32.u32 " TEMP_Q ", " BYTEMAX_Q NL
-    "vmul.f32 " K4_Q ", " K4_Q ", " TEMP_Q NL
-
-    "mov " NEXTPIXEL_R ", #4" NL
-    "cmp " K_R ", #0" NL
-    "beq .arithmeticK1IsZero" NL
-
-    "vrecpe.f32 " TEMP_Q ", " TEMP_Q NL
-    "vmul.f32 " K1_Q ", " K1_Q ", " TEMP_Q NL
-
-".arithmeticK1IsNonZero:" NL
-
-    "vld1.u32 " PIXEL1_D00 ", [ " SOURCE_R "], " NEXTPIXEL_R NL
-    "vld1.u32 " PIXEL2_D00 ", [" DEST_R "]" NL
-
-    "vmovl.u8 " PIXEL1_Q ", " PIXEL1_D0 NL
-    "vmovl.u16 " PIXEL1_Q ", " PIXEL1_D0 NL
-    "vcvt.f32.u32 " PIXEL1_Q ", " PIXEL1_Q NL
-    "vmovl.u8 " PIXEL2_Q ", " PIXEL2_D0 NL
-    "vmovl.u16 " PIXEL2_Q ", " PIXEL2_D0 NL
-    "vcvt.f32.u32 " PIXEL2_Q ", " PIXEL2_Q NL
-
-    "vmul.f32 " TEMP_Q ", " PIXEL1_Q ", " PIXEL2_Q NL
-    "vmul.f32 " TEMP_Q ", " TEMP_Q ", " K1_Q NL
-    "vmla.f32 " TEMP_Q ", " PIXEL1_Q ", " K2_Q NL
-    "vmla.f32 " TEMP_Q ", " PIXEL2_Q ", " K3_Q NL
-    "vadd.f32 " TEMP_Q ", " K4_Q NL
-
-    // Convert result to uint so negative values are converted to zero.
-    "vcvt.u32.f32 " TEMP_Q ", " TEMP_Q NL
-    "vmin.u32 " TEMP_Q ", " TEMP_Q ", " BYTEMAX_Q NL
-    "vmovn.u32 " TEMP_D0 ", " TEMP_Q NL
-    "vmovn.u16 " TEMP_D0 ", " TEMP_Q NL
-
-    "vst1.u32 " TEMP_D00 ", [" DEST_R "], " NEXTPIXEL_R NL
-
-    "cmp " SOURCE_R ", " END_R NL
-    "bcc .arithmeticK1IsNonZero" NL
-    "bx lr" NL
-
-".arithmeticK1IsZero:" NL
-
-    "vld1.u32 " PIXEL1_D00 ", [ " SOURCE_R "], " NEXTPIXEL_R NL
-    "vld1.u32 " PIXEL2_D00 ", [" DEST_R "]" NL
-
-    "vmovl.u8 " PIXEL1_Q ", " PIXEL1_D0 NL
-    "vmovl.u16 " PIXEL1_Q ", " PIXEL1_D0 NL
-    "vcvt.f32.u32 " PIXEL1_Q ", " PIXEL1_Q NL
-    "vmovl.u8 " PIXEL2_Q ", " PIXEL2_D0 NL
-    "vmovl.u16 " PIXEL2_Q ", " PIXEL2_D0 NL
-    "vcvt.f32.u32 " PIXEL2_Q ", " PIXEL2_Q NL
-
-    "vmul.f32 " TEMP_Q ", " PIXEL1_Q ", " K2_Q NL
-    "vmla.f32 " TEMP_Q ", " PIXEL2_Q ", " K3_Q NL
-    "vadd.f32 " TEMP_Q ", " K4_Q NL
-
-    // Convert result to uint so negative values are converted to zero.
-    "vcvt.u32.f32 " TEMP_Q ", " TEMP_Q NL
-    "vmin.u32 " TEMP_Q ", " TEMP_Q ", " BYTEMAX_Q NL
-    "vmovn.u32 " TEMP_D0 ", " TEMP_Q NL
-    "vmovn.u16 " TEMP_D0 ", " TEMP_Q NL
-
-    "vst1.u32 " TEMP_D00 ", [" DEST_R "], " NEXTPIXEL_R NL
-
-    "cmp " SOURCE_R ", " END_R NL
-    "bcc .arithmeticK1IsZero" NL
-    "bx lr" NL
-); // NOLINT
-
-} // namespace WebCore
-
-#endif // CPU(ARM_NEON) && COMPILER(GCC)
-
-#endif // ENABLE(FILTERS)
-
diff --git a/Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.h b/Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.h
index a2b3f6f4d..50f34b77a 100644
--- a/Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.h
+++ b/Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.h
@@ -29,25 +29,73 @@
 
 #include <wtf/Platform.h>
 
-#if ENABLE(FILTERS)
-#if CPU(ARM_NEON) && COMPILER(GCC)
+#if ENABLE(FILTERS) && HAVE(ARM_NEON_INTRINSICS)
 
 #include "FEComposite.h"
+#include <arm_neon.h>
 
 namespace WebCore {
 
-extern "C" {
-void neonDrawCompositeArithmetic(unsigned char* source, unsigned char* destination, unsigned pixelArrayLength, float* coefficients);
+template <int b1, int b4>
+inline void FEComposite::computeArithmeticPixelsNeon(unsigned char* source, unsigned char* destination,
+    unsigned pixelArrayLength, float k1, float k2, float k3, float k4)
+{
+    float32x4_t k1x4 = vdupq_n_f32(k1 / 255);
+    float32x4_t k2x4 = vdupq_n_f32(k2);
+    float32x4_t k3x4 = vdupq_n_f32(k3);
+    float32x4_t k4x4 = vdupq_n_f32(k4 * 255);
+    uint32x4_t max255 = vdupq_n_u32(255);
+
+    uint32_t* sourcePixel = reinterpret_cast<uint32_t*>(source);
+    uint32_t* destinationPixel = reinterpret_cast<uint32_t*>(destination);
+    uint32_t* destinationEndPixel = destinationPixel + (pixelArrayLength >> 2);
+
+    while (destinationPixel < destinationEndPixel) {
+        uint32x2_t temporary1 = vset_lane_u32(*sourcePixel, temporary1, 0);
+        uint16x4_t temporary2 = vget_low_u16(vmovl_u8(vreinterpret_u8_u32(temporary1)));
+        float32x4_t sourcePixelAsFloat = vcvtq_f32_u32(vmovl_u16(temporary2));
+
+        temporary1 = vset_lane_u32(*destinationPixel, temporary1, 0);
+        temporary2 = vget_low_u16(vmovl_u8(vreinterpret_u8_u32(temporary1)));
+        float32x4_t destinationPixelAsFloat = vcvtq_f32_u32(vmovl_u16(temporary2));
+
+        float32x4_t result = vmulq_f32(sourcePixelAsFloat, k2x4);
+        result = vmlaq_f32(result, destinationPixelAsFloat, k3x4);
+        if (b1)
+            result = vmlaq_f32(result, vmulq_f32(sourcePixelAsFloat, destinationPixelAsFloat), k1x4);
+        if (b4)
+            result = vaddq_f32(result, k4x4);
+
+        // Convert result to uint so negative values are converted to zero.
+        uint16x4_t temporary3 = vmovn_u32(vminq_u32(vcvtq_u32_f32(result), max255));
+        uint8x8_t temporary4 = vmovn_u16(vcombine_u16(temporary3, temporary3));
+        *destinationPixel++ = vget_lane_u32(vreinterpret_u32_u8(temporary4), 0);
+        ++sourcePixel;
+    }
 }
 
-inline void FEComposite::platformArithmeticNeon(unsigned char* source, unsigned char* destination, unsigned pixelArrayLength, float* coefficients)
+inline void FEComposite::platformArithmeticNeon(unsigned char* source, unsigned char* destination,
+    unsigned pixelArrayLength, float k1, float k2, float k3, float k4)
 {
-    neonDrawCompositeArithmetic(source, destination, pixelArrayLength, coefficients);
+    if (!k4) {
+        if (!k1) {
+            computeArithmeticPixelsNeon<0, 0>(source, destination, pixelArrayLength, k1, k2, k3, k4);
+            return;
+        }
+
+        computeArithmeticPixelsNeon<1, 0>(source, destination, pixelArrayLength, k1, k2, k3, k4);
+        return;
+    }
+
+    if (!k1) {
+        computeArithmeticPixelsNeon<0, 1>(source, destination, pixelArrayLength, k1, k2, k3, k4);
+        return;
+    }
+    computeArithmeticPixelsNeon<1, 1>(source, destination, pixelArrayLength, k1, k2, k3, k4);
 }
 
 } // namespace WebCore
 
-#endif // CPU(ARM_NEON) && COMPILER(GCC)
-#endif // ENABLE(FILTERS)
+#endif // ENABLE(FILTERS) && HAVE(ARM_NEON_INTRINSICS)
 
 #endif // FECompositeArithmeticNEON_h
diff --git a/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.cpp b/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.cpp
index d17f2caf4..300369801 100644
--- a/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.cpp
+++ b/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "FEGaussianBlurNEON.h"
 
-#if CPU(ARM_NEON) && COMPILER(GCC)
+#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
 
 #include <wtf/Alignment.h>
 
diff --git a/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h b/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h
index 1fb3752c5..a2fb0bd44 100644
--- a/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h
+++ b/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h
@@ -29,7 +29,7 @@
 
 #include <wtf/Platform.h>
 
-#if CPU(ARM_NEON) && COMPILER(GCC)
+#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
 
 #include "FEGaussianBlur.h"
 
diff --git a/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp b/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp
index 110b528c4..76fefbd59 100644
--- a/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp
+++ b/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "FELightingNEON.h"
 
-#if CPU(ARM_NEON) && COMPILER(GCC)
+#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
 
 #include <wtf/Alignment.h>
 
diff --git a/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h b/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h
index 9094153d7..13c975c09 100644
--- a/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h
+++ b/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h
@@ -29,7 +29,7 @@
 
 #include <wtf/Platform.h>
 
-#if CPU(ARM_NEON) && COMPILER(GCC)
+#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
 
 #include "FELighting.h"
 #include <wtf/Alignment.h>
diff --git a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
index a84dcdc13..3419ff541 100644
--- a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
+++ b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
@@ -44,7 +44,6 @@
 #endif
 
 namespace WebCore {
-class CanvasRenderingContext;
 class GraphicsContext3D;
 class ImageData;
 #if PLATFORM(CHROMIUM)
@@ -127,7 +126,7 @@ public:
     void prepareBackBuffer();
     bool requiresCopyFromBackToFrontBuffer() const;
     unsigned frontColorBuffer() const;
-    void paintCompositedResultsToCanvas(CanvasRenderingContext*);
+    void paintCompositedResultsToCanvas(ImageBuffer*);
 #endif
 
     GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
diff --git a/Source/WebCore/platform/graphics/gpu/qt/DrawingBufferQt.cpp b/Source/WebCore/platform/graphics/gpu/qt/DrawingBufferQt.cpp
index 5eeac100a..23d28b2fa 100644
--- a/Source/WebCore/platform/graphics/gpu/qt/DrawingBufferQt.cpp
+++ b/Source/WebCore/platform/graphics/gpu/qt/DrawingBufferQt.cpp
@@ -101,7 +101,7 @@ unsigned DrawingBuffer::frontColorBuffer() const
     return colorBuffer();
 }
 
-void DrawingBuffer::paintCompositedResultsToCanvas(CanvasRenderingContext* context)
+void DrawingBuffer::paintCompositedResultsToCanvas(ImageBuffer*)
 {
 }
 #endif
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index 62f53536a..40330c98e 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -1498,145 +1498,95 @@ static HashSet<String> mimeTypeCache()
     DEFINE_STATIC_LOCAL(HashSet<String>, cache, ());
     static bool typeListInitialized = false;
 
-    if (!typeListInitialized) {
-        // Build a whitelist of mime-types known to be supported by
-        // GStreamer.
-        HashSet<String> handledApplicationSubtypes;
-        handledApplicationSubtypes.add(String("ogg"));
-        handledApplicationSubtypes.add(String("vnd.rn-realmedia"));
-        handledApplicationSubtypes.add(String("x-pn-realaudio"));
-
-        GList* factories = gst_type_find_factory_get_list();
-        for (GList* iterator = factories; iterator; iterator = iterator->next) {
-            GstTypeFindFactory* factory = GST_TYPE_FIND_FACTORY(iterator->data);
-            GstCaps* caps = gst_type_find_factory_get_caps(factory);
-            gchar** extensions;
-
-            if (!caps)
-                continue;
-
-            for (guint structureIndex = 0; structureIndex < gst_caps_get_size(caps); structureIndex++) {
-                GstStructure* structure = gst_caps_get_structure(caps, structureIndex);
-                const gchar* name = gst_structure_get_name(structure);
-                bool cached = false;
-
-                // There isn't a one-to-one correspondance of caps to supported mime types in
-                // GStreamer, so we need to manually map between them. At some point in the future,
-                // GStreamer may reduce the differences between caps and mime types and we can
-                // remove mappings.
-                if (g_str_equal(name, "video/x-h264")) {
-                    cache.add(String("video/mp4"));
-                    cached = true;
-                }
-
-                if (g_str_equal(name, "audio/x-m4a")) {
-                    cache.add(String("audio/aac"));
-                    cache.add(String("audio/mp4"));
-                    cache.add(String("audio/x-m4a"));
-                    cached = true;
-                }
-
-                if (g_str_equal(name, "application/x-3gp")) {
-                    cache.add(String("audio/3gpp"));
-                    cache.add(String("video/3gpp"));
-                    cache.add(String("application/x-3gp"));
-                    cached = true;
-                }
-
-                if (g_str_equal(name, "video/x-theora")) {
-                    cache.add(String("video/ogg"));
-                    cached = true;
-                }
-
-                if (g_str_equal(name, "audio/x-vorbis")) {
-                    cache.add(String("audio/ogg"));
-                    cache.add(String("audio/x-vorbis+ogg"));
-                    cache.add(String("audio/webm"));
-                    cached = true;
-                }
-
-                if (g_str_equal(name, "audio/x-wav")) {
-                    cache.add(String("audio/wav"));
-                    cache.add(String("audio/x-wav"));
-                    cached = true;
-                }
-
-                if (g_str_equal(name, "audio/x-flac")) {
-                    cache.add(String("audio/flac"));
-                    cache.add(String("audio/x-flac"));
-                    cached = true;
-                }
-
-                if (g_str_equal(name, "audio/mpeg")) {
-                    cache.add(String(name));
-                    cache.add(String("audio/x-mpeg"));
-                    cached = true;
-
-                    // This is what we are handling:
-                    // mpegversion=(int)1, layer=(int)[ 1, 3 ]
-                    gint mpegVersion = 0;
-                    if (gst_structure_get_int(structure, "mpegversion", &mpegVersion) && (mpegVersion == 1)) {
-                        const GValue* layer = gst_structure_get_value(structure, "layer");
-                        if (G_VALUE_TYPE(layer) == GST_TYPE_INT_RANGE) {
-                            gint minLayer = gst_value_get_int_range_min(layer);
-                            gint maxLayer = gst_value_get_int_range_max(layer);
-                            if (minLayer <= 1 && 1 <= maxLayer)
-                                cache.add(String("audio/mp1"));
-                            if (minLayer <= 2 && 2 <= maxLayer)
-                                cache.add(String("audio/mp2"));
-                            if (minLayer <= 3 && 3 <= maxLayer) {
-                                cache.add(String("audio/x-mp3"));
-                                cache.add(String("audio/mp3"));
-                            }
-                        }
-                    }
-                }
-
-                if (!cached) {
-                    // GStreamer plugins can be capable of supporting
-                    // types which WebKit supports by default. In that
-                    // case, we should not consider these types
-                    // supportable by GStreamer.  Examples of what
-                    // GStreamer can support but should not be added:
-                    // text/plain, text/html, image/jpeg,
-                    // application/xml
-                    gchar** mimetype = g_strsplit(name, "/", 2);
-                    if (g_str_equal(mimetype[0], "audio")
-                        || g_str_equal(mimetype[0], "video")
-                        || (g_str_equal(mimetype[0], "application")
-                            && handledApplicationSubtypes.contains(String(mimetype[1]))))
-                        cache.add(String(name));
-                    else if (g_str_equal(name, "application/x-hls"))
-                        cache.add(String("application/vnd.apple.mpegurl"));
-
-
-                    g_strfreev(mimetype);
-                }
-
-                // As a last resort try some special cases depending
-                // on the file extensions registered with the typefind
-                // factory.
-                if (!cached && (extensions = gst_type_find_factory_get_extensions(factory))) {
-                    for (int index = 0; extensions[index]; index++) {
-                        if (g_str_equal(extensions[index], "m4v"))
-                            cache.add(String("video/x-m4v"));
-
-                        // Workaround for
-                        // https://bugzilla.gnome.org/show_bug.cgi?id=640709.
-                        // typefindfunctions <= 0.10.32 doesn't
-                        // register the H264 typefinder correctly so
-                        // as a workaround we check the registered
-                        // file extensions for it.
-                        if (g_str_equal(extensions[index], "h264"))
-                            cache.add(String("video/mp4"));
-                    }
-                }
-            }
-        }
-
-        gst_plugin_feature_list_free(factories);
-        typeListInitialized = true;
-    }
+    if (typeListInitialized)
+        return cache;
+    const char* mimeTypes[] = {"application/ogg",
+                               "application/vnd.apple.mpegurl",
+                               "application/vnd.rn-realmedia",
+                               "application/x-3gp",
+                               "application/x-pn-realaudio",
+                               "audio/3gpp",
+                               "audio/aac",
+                               "audio/flac",
+                               "audio/iLBC-sh",
+                               "audio/midi",
+                               "audio/mobile-xmf",
+                               "audio/mp1",
+                               "audio/mp2",
+                               "audio/mp3",
+                               "audio/mp4",
+                               "audio/mpeg",
+                               "audio/ogg",
+                               "audio/qcelp",
+                               "audio/riff-midi",
+                               "audio/wav",
+                               "audio/webm",
+                               "audio/x-ac3",
+                               "audio/x-aiff",
+                               "audio/x-amr-nb-sh",
+                               "audio/x-amr-wb-sh",
+                               "audio/x-au",
+                               "audio/x-ay",
+                               "audio/x-celt",
+                               "audio/x-dts",
+                               "audio/x-flac",
+                               "audio/x-gbs",
+                               "audio/x-gsm",
+                               "audio/x-gym",
+                               "audio/x-imelody",
+                               "audio/x-ircam",
+                               "audio/x-kss",
+                               "audio/x-m4a",
+                               "audio/x-mod",
+                               "audio/x-mp3",
+                               "audio/x-mpeg",
+                               "audio/x-musepack",
+                               "audio/x-nist",
+                               "audio/x-nsf",
+                               "audio/x-paris",
+                               "audio/x-sap",
+                               "audio/x-sbc",
+                               "audio/x-sds",
+                               "audio/x-shorten",
+                               "audio/x-sid",
+                               "audio/x-spc",
+                               "audio/x-speex",
+                               "audio/x-svx",
+                               "audio/x-ttafile",
+                               "audio/x-vgm",
+                               "audio/x-voc",
+                               "audio/x-vorbis+ogg",
+                               "audio/x-w64",
+                               "audio/x-wav",
+                               "audio/x-wavpack",
+                               "audio/x-wavpack-correction",
+                               "video/3gpp",
+                               "video/mj2",
+                               "video/mp4",
+                               "video/mpeg",
+                               "video/mpegts",
+                               "video/ogg",
+                               "video/quicktime",
+                               "video/vivo",
+                               "video/webm",
+                               "video/x-cdxa",
+                               "video/x-dirac",
+                               "video/x-dv",
+                               "video/x-fli",
+                               "video/x-flv",
+                               "video/x-h263",
+                               "video/x-ivf",
+                               "video/x-m4v",
+                               "video/x-matroska",
+                               "video/x-mng",
+                               "video/x-ms-asf",
+                               "video/x-msvideo",
+                               "video/x-mve",
+                               "video/x-nuv",
+                               "video/x-vcd"};
+
+    for (unsigned i = 0; i < (sizeof(mimeTypes) / sizeof(*mimeTypes)); ++i)
+        cache.add(String(mimeTypes[i]));
 
     return cache;
 }
diff --git a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
index 7555e147c..9d9fbeff0 100644
--- a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
@@ -73,10 +73,6 @@ static PassRefPtr<SharedBuffer> loadResourceSharedBuffer(CString name)
     return SharedBuffer::create(content.get(), length);
 }
 
-void BitmapImage::initPlatformData()
-{
-}
-
 void BitmapImage::invalidatePlatformData()
 {
 }
diff --git a/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp b/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp
index edf630892..dfdd8de22 100644
--- a/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp
@@ -54,7 +54,7 @@ DisplayRefreshMonitor::~DisplayRefreshMonitor()
         m_displayLink = 0;
     }
 
-    cancelCallOnMainThread(DisplayRefreshMonitor::refreshDisplayOnMainThread, this);
+    cancelCallOnMainThread(DisplayRefreshMonitor::handleDisplayRefreshedNotificationOnMainThread, this);
 }
 
 bool DisplayRefreshMonitor::requestRefreshCallback()
@@ -87,7 +87,7 @@ bool DisplayRefreshMonitor::requestRefreshCallback()
 void DisplayRefreshMonitor::displayLinkFired(double nowSeconds, double outputTimeSeconds)
 {
     MutexLocker lock(m_mutex);
-    if (!m_scheduled || !m_previousFrameDone)
+    if (!m_previousFrameDone)
         return;
 
     m_previousFrameDone = false;
@@ -95,7 +95,7 @@ void DisplayRefreshMonitor::displayLinkFired(double nowSeconds, double outputTim
     double webKitNow = currentTime();
     m_timestamp = webKitNow - nowSeconds + outputTimeSeconds;
     
-    callOnMainThread(refreshDisplayOnMainThread, this);
+    callOnMainThread(handleDisplayRefreshedNotificationOnMainThread, this);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/mac/ImageMac.mm b/Source/WebCore/platform/graphics/mac/ImageMac.mm
index 6dc7b93d9..62fa565ed 100644
--- a/Source/WebCore/platform/graphics/mac/ImageMac.mm
+++ b/Source/WebCore/platform/graphics/mac/ImageMac.mm
@@ -39,10 +39,6 @@
 
 namespace WebCore {
 
-void BitmapImage::initPlatformData()
-{
-}
-
 void BitmapImage::invalidatePlatformData()
 {
     if (m_frames.size() != 1)
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
index cb3a5b77e..654a8cd10 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
@@ -30,10 +30,8 @@
 
 #include "GraphicsContext3D.h"
 
-#include "CanvasRenderingContext.h"
 #include "Extensions3DOpenGL.h"
 #include "GraphicsContext.h"
-#include "HTMLCanvasElement.h"
 #include "ImageBuffer.h"
 #include "ImageData.h"
 #include "IntRect.h"
@@ -45,6 +43,7 @@
 #include <wtf/ArrayBufferView.h>
 #include <wtf/Float32Array.h>
 #include <wtf/Int32Array.h>
+#include <wtf/MainThread.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/Uint8Array.h>
 #include <wtf/UnusedParam.h>
@@ -109,11 +108,8 @@ bool GraphicsContext3D::isResourceSafe()
     return false;
 }
 
-void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context, DrawingBuffer*)
+void GraphicsContext3D::paintRenderingResultsToCanvas(ImageBuffer* imageBuffer, DrawingBuffer*)
 {
-    HTMLCanvasElement* canvas = context->canvas();
-    ImageBuffer* imageBuffer = canvas->buffer();
-
     int rowBytes = m_currentWidth * 4;
     int totalBytes = rowBytes * m_currentHeight;
 
@@ -133,10 +129,10 @@ void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* co
     }
 
     paintToCanvas(pixels.get(), m_currentWidth, m_currentHeight,
-                  canvas->width(), canvas->height(), imageBuffer->context()->platformContext());
+                  imageBuffer->internalSize().width(), imageBuffer->internalSize().height(), imageBuffer->context()->platformContext());
 }
 
-bool GraphicsContext3D::paintCompositedResultsToCanvas(CanvasRenderingContext*)
+bool GraphicsContext3D::paintCompositedResultsToCanvas(ImageBuffer*)
 {
     // Not needed at the moment, so return that nothing was done.
     return false;
diff --git a/Source/WebCore/platform/graphics/openvg/ImageOpenVG.cpp b/Source/WebCore/platform/graphics/openvg/ImageOpenVG.cpp
index 8636edf11..98a730c06 100644
--- a/Source/WebCore/platform/graphics/openvg/ImageOpenVG.cpp
+++ b/Source/WebCore/platform/graphics/openvg/ImageOpenVG.cpp
@@ -70,8 +70,6 @@ BitmapImage::BitmapImage(TiledImageOpenVG* tiledImage, ImageObserver* observer)
     , m_hasUniformFrameSize(true)
     , m_haveFrameCount(true)
 {
-    initPlatformData();
-
     ASSERT(m_size.width() > 0);
     ASSERT(m_size.height() > 0);
 
@@ -103,10 +101,6 @@ void BitmapImage::checkForSolidColor()
     m_checkedForSolidColor = true;
 }
 
-void BitmapImage::initPlatformData()
-{
-}
-
 void BitmapImage::invalidatePlatformData()
 {
 }
diff --git a/Source/WebCore/platform/graphics/qt/FontPlatformData.h b/Source/WebCore/platform/graphics/qt/FontPlatformData.h
index f55e19c2b..b60d05d52 100644
--- a/Source/WebCore/platform/graphics/qt/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/qt/FontPlatformData.h
@@ -55,7 +55,17 @@ public:
         , bold(bold)
         , oblique(oblique)
         , isDeletedValue(false)
-    { }
+    {
+// This is necessary for SVG Fonts, which are only supported when using QRawFont.
+// It is used to construct the appropriate platform data to use as a fallback.
+#if HAVE(QRAWFONT)
+        QFont font;
+        font.setBold(bold);
+        font.setItalic(oblique);
+        rawFont = QRawFont::fromFont(font, QFontDatabase::Any);
+        rawFont.setPixelSize(size);
+#endif
+    }
 #if !HAVE(QRAWFONT)
     FontPlatformDataPrivate(const QFont& font)
         : font(font)
diff --git a/Source/WebCore/platform/graphics/qt/FractionalLayoutPointQt.cpp b/Source/WebCore/platform/graphics/qt/FractionalLayoutPointQt.cpp
new file mode 100644
index 000000000..39e563a9c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/qt/FractionalLayoutPointQt.cpp
@@ -0,0 +1,45 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "FractionalLayoutPoint.h"
+
+#include <QPoint>
+#include <QPointF>
+
+namespace WebCore {
+
+FractionalLayoutPoint::FractionalLayoutPoint(const QPoint& point)
+    : m_x(point.x())
+    , m_y(point.y())
+{
+}
+
+FractionalLayoutPoint::FractionalLayoutPoint(const QPointF& point)
+    : m_x(point.x())
+    , m_y(point.y())
+{
+}
+
+FractionalLayoutPoint::operator QPointF() const
+{
+    return QPointF(m_x, m_y);
+}
+
+} // namespace
diff --git a/Source/WebCore/platform/graphics/qt/FractionalLayoutRectQt.cpp b/Source/WebCore/platform/graphics/qt/FractionalLayoutRectQt.cpp
new file mode 100644
index 000000000..1dad914bb
--- /dev/null
+++ b/Source/WebCore/platform/graphics/qt/FractionalLayoutRectQt.cpp
@@ -0,0 +1,45 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "FractionalLayoutRect.h"
+
+#include <QRect>
+#include <QRectF>
+
+namespace WebCore {
+
+FractionalLayoutRect::FractionalLayoutRect(const QRect& r)
+    : m_location(r.topLeft())
+    , m_size(r.width(), r.height())
+{
+}
+
+FractionalLayoutRect::FractionalLayoutRect(const QRectF& r)
+    : m_location(r.topLeft())
+    , m_size(r.width(), r.height())
+{
+}
+
+FractionalLayoutRect::operator QRectF() const
+{
+    return QRectF(x(), y(), width(), height());
+}
+
+} // namespace
diff --git a/Source/WebCore/platform/graphics/qt/FractionalLayoutSizeQt.cpp b/Source/WebCore/platform/graphics/qt/FractionalLayoutSizeQt.cpp
new file mode 100644
index 000000000..ed59d0037
--- /dev/null
+++ b/Source/WebCore/platform/graphics/qt/FractionalLayoutSizeQt.cpp
@@ -0,0 +1,46 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "FractionalLayoutSize.h"
+
+#include <QSize>
+#include <QSizeF>
+
+namespace WebCore {
+
+FractionalLayoutSize::FractionalLayoutSize(const QSize& size)
+    : m_width(size.width())
+    , m_height(size.height())
+{
+}
+
+FractionalLayoutSize::FractionalLayoutSize(const QSizeF& size)
+    : m_width(size.width())
+    , m_height(size.height())
+{
+}
+
+FractionalLayoutSize::operator QSizeF() const
+{
+    return QSizeF(width(), height());
+}
+
+} // namespace
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index e1c2b4942..af95e4f74 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -1614,7 +1614,13 @@ bool GraphicsContext3D::getImageData(Image* image,
     AlphaOp neededAlphaOp = AlphaDoNothing;
     if (premultiplyAlpha)
         neededAlphaOp = AlphaDoPremultiply;
-    outputVector.resize(nativeImage.byteCount());
+
+    unsigned int packedSize;
+    // Output data is tightly packed (alignment == 1).
+    if (computeImageSizeInBytes(format, type, image->width(), image->height(), 1, &packedSize, 0) != GraphicsContext3D::NO_ERROR)
+        return false;
+    outputVector.resize(packedSize);
+
     return packPixels(nativeImage.bits(), SourceFormatBGRA8, image->width(), image->height(), 0, format, type, neededAlphaOp, outputVector.data());
 }
 
diff --git a/Source/WebCore/platform/graphics/qt/ImageQt.cpp b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
index eb4be2d4a..182b36684 100644
--- a/Source/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -202,8 +202,6 @@ BitmapImage::BitmapImage(QPixmap* pixmap, ImageObserver* observer)
     , m_sizeAvailable(true)
     , m_haveFrameCount(true)
 {
-    initPlatformData();
-
     int width = pixmap->width();
     int height = pixmap->height();
     m_decodedSize = width * height * 4;
@@ -216,10 +214,6 @@ BitmapImage::BitmapImage(QPixmap* pixmap, ImageObserver* observer)
     checkForSolidColor();
 }
 
-void BitmapImage::initPlatformData()
-{
-}
-
 void BitmapImage::invalidatePlatformData()
 {
 }
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
index f341152d0..019037c45 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
@@ -79,7 +79,11 @@ bool GraphicsContext3D::getImageData(Image* image,
     const SkBitmap& skiaImageRef = skiaImage->bitmap();
     SkAutoLockPixels lock(skiaImageRef);
     ASSERT(skiaImageRef.rowBytes() == skiaImageRef.width() * 4);
-    outputVector.resize(skiaImageRef.rowBytes() * skiaImageRef.height());
+    unsigned int packedSize;
+    // Output data is tightly packed (alignment == 1).
+    if (computeImageSizeInBytes(format, type, skiaImageRef.width(), skiaImageRef.height(), 1, &packedSize, 0) != GraphicsContext3D::NO_ERROR)
+        return false;
+    outputVector.resize(packedSize);
     return packPixels(reinterpret_cast<const uint8_t*>(skiaImageRef.getPixels()),
                       SK_B32_SHIFT ? SourceFormatRGBA8 : SourceFormatBGRA8,
                       skiaImageRef.width(), skiaImageRef.height(), 0,
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index ce44f0c60..29ed24ebe 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -629,7 +629,8 @@ void GraphicsContext::drawLineForText(const FloatPoint& pt,
     int thickness = SkMax32(static_cast<int>(strokeThickness()), 1);
     SkRect r;
     r.fLeft = WebCoreFloatToSkScalar(pt.x());
-    r.fTop = WebCoreFloatToSkScalar(pt.y());
+    // Avoid anti-aliasing lines. Currently, these are always horizontal.
+    r.fTop = WebCoreFloatToSkScalar(floorf(pt.y()));
     r.fRight = r.fLeft + WebCoreFloatToSkScalar(width);
     r.fBottom = r.fTop + SkIntToScalar(thickness);
 
diff --git a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
index 4732d1d22..81dfa3aa1 100644
--- a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -146,15 +146,32 @@ static ResamplingMode computeResamplingMode(PlatformContextSkia* platformContext
         return RESAMPLE_LINEAR;
 
     // Everything else gets resampled.
-    // If the platform context permits high quality interpolation, use it.
     // High quality interpolation only enabled for scaling and translation.
-    if (platformContext->interpolationQuality() == InterpolationHigh
-        && !(platformContext->canvas()->getTotalMatrix().getType() & (SkMatrix::kAffine_Mask | SkMatrix::kPerspective_Mask)))
+    if (!(platformContext->canvas()->getTotalMatrix().getType() & (SkMatrix::kAffine_Mask | SkMatrix::kPerspective_Mask)))
         return RESAMPLE_AWESOME;
     
     return RESAMPLE_LINEAR;
 }
 
+static ResamplingMode limitResamplingMode(PlatformContextSkia* platformContext, ResamplingMode resampling)
+{
+    switch (platformContext->interpolationQuality()) {
+    case InterpolationNone:
+        return RESAMPLE_NONE;
+    case InterpolationMedium:
+        // For now we treat InterpolationMedium and InterpolationLow the same.
+    case InterpolationLow:
+        if (resampling == RESAMPLE_AWESOME)
+            return RESAMPLE_LINEAR;
+        break;
+    case InterpolationHigh:
+    case InterpolationDefault:
+        break;
+    }
+
+    return resampling;
+}
+
 // Draws the given bitmap to the given canvas. The subset of the source bitmap
 // identified by src_rect is drawn to the given destination rect. The bitmap
 // will be resampled to resample_width * resample_height (this is the size of
@@ -224,7 +241,6 @@ static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImag
 #endif
     SkPaint paint;
     paint.setXfermodeMode(compOp);
-    paint.setFilterBitmap(true);
     paint.setAlpha(platformContext->getNormalizedAlpha());
     paint.setLooper(platformContext->getDrawLooper());
     // only antialias if we're rotated or skewed
@@ -238,9 +254,17 @@ static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImag
     else
         resampling = platformContext->printing() ? RESAMPLE_NONE :
             computeResamplingMode(platformContext, bitmap, srcRect.width(), srcRect.height(), SkScalarToFloat(destRect.width()), SkScalarToFloat(destRect.height()));
-    if (resampling == RESAMPLE_AWESOME) {
+    if (resampling == RESAMPLE_NONE) {
+      // FIXME: This is to not break tests (it results in the filter bitmap flag
+      // being set to true). We need to decide if we respect RESAMPLE_NONE
+      // being returned from computeResamplingMode.
+        resampling = RESAMPLE_LINEAR;
+    }
+    resampling = limitResamplingMode(platformContext, resampling);
+    paint.setFilterBitmap(resampling == RESAMPLE_LINEAR);
+    if (resampling == RESAMPLE_AWESOME)
         drawResampledBitmap(*canvas, paint, bitmap, srcRect, destRect);
-    } else {
+    else {
         // No resampling necessary, we can just draw the bitmap. We want to
         // filter it if we decided to do linear interpolation above, or if there
         // is something interesting going on with the matrix (like a rotation).
@@ -253,20 +277,21 @@ static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImag
 
 // Transforms the given dimensions with the given matrix. Used to see how big
 // images will be once transformed.
-static void TransformDimensions(const SkMatrix& matrix, float srcWidth, float srcHeight, float* destWidth, float* destHeight) {
+static void TransformDimensions(const SkMatrix& matrix, float srcWidth, float srcHeight, float* destWidth, float* destHeight)
+{
     // Transform 3 points to see how long each side of the bitmap will be.
-    SkPoint src_points[3];  // (0, 0), (width, 0), (0, height).
-    src_points[0].set(0, 0);
-    src_points[1].set(SkFloatToScalar(srcWidth), 0);
-    src_points[2].set(0, SkFloatToScalar(srcHeight));
+    SkPoint srcPoints[3]; // (0, 0), (width, 0), (0, height).
+    srcPoints[0].set(0, 0);
+    srcPoints[1].set(SkFloatToScalar(srcWidth), 0);
+    srcPoints[2].set(0, SkFloatToScalar(srcHeight));
 
     // Now measure the length of the two transformed vectors relative to the
     // transformed origin to see how big the bitmap will be. Note: for skews,
     // this isn't the best thing, but we don't have skews.
-    SkPoint dest_points[3];
-    matrix.mapPoints(dest_points, src_points, 3);
-    *destWidth = SkScalarToFloat((dest_points[1] - dest_points[0]).length());
-    *destHeight = SkScalarToFloat((dest_points[2] - dest_points[0]).length());
+    SkPoint destPoints[3];
+    matrix.mapPoints(destPoints, srcPoints, 3);
+    *destWidth = SkScalarToFloat((destPoints[1] - destPoints[0]).length());
+    *destHeight = SkScalarToFloat((destPoints[2] - destPoints[0]).length());
 }
 
 // A helper method for translating negative width and height values.
@@ -333,6 +358,7 @@ void Image::drawPattern(GraphicsContext* context,
         resampling = RESAMPLE_LINEAR;
     else
         resampling = computeResamplingMode(context->platformContext(), *bitmap, srcRect.width(), srcRect.height(), destBitmapWidth, destBitmapHeight);
+    resampling = limitResamplingMode(context->platformContext(), resampling);
 
     // Load the transform WebKit requested.
     SkMatrix matrix(patternTransform);
@@ -382,17 +408,8 @@ void Image::drawPattern(GraphicsContext* context,
 
 // FIXME: These should go to BitmapImageSkia.cpp
 
-void BitmapImage::initPlatformData()
-{
-    // This is not used. On Mac, the "platform" data is a cache of some OS
-    // specific versions of the image that are created is some cases. These
-    // aren't normally used, it is equivalent to getHBITMAP on Windows, and
-    // the platform data is the cache.
-}
-
 void BitmapImage::invalidatePlatformData()
 {
-    // See initPlatformData above.
 }
 
 void BitmapImage::checkForSolidColor()
@@ -428,13 +445,13 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect,
 
     NativeImageSkia* bm = nativeImageForCurrentFrame();
     if (!bm)
-        return;  // It's too early and we don't have an image yet.
+        return; // It's too early and we don't have an image yet.
 
     FloatRect normDstRect = normalizeRect(dstRect);
     FloatRect normSrcRect = normalizeRect(srcRect);
 
     if (normSrcRect.isEmpty() || normDstRect.isEmpty())
-        return;  // Nothing to draw.
+        return; // Nothing to draw.
 
     paintSkBitmap(ctxt->platformContext(),
                   *bm,
@@ -458,7 +475,7 @@ void BitmapImageSingleFrameSkia::draw(GraphicsContext* ctxt,
     FloatRect normSrcRect = normalizeRect(srcRect);
 
     if (normSrcRect.isEmpty() || normDstRect.isEmpty())
-        return;  // Nothing to draw.
+        return; // Nothing to draw.
 
     paintSkBitmap(ctxt->platformContext(),
                   m_nativeImage,
@@ -486,4 +503,4 @@ PassRefPtr<BitmapImageSingleFrameSkia> BitmapImageSingleFrameSkia::create(const
     return adoptRef(new BitmapImageSingleFrameSkia(bitmap));
 }
 
-}  // namespace WebCore
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
index b5d03a1b2..fbf86992b 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
@@ -24,6 +24,13 @@
 
 namespace WebCore {
 
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
+{
+    if (s_graphicsLayerFactory)
+        return (*s_graphicsLayerFactory)(client);
+    return adoptPtr(new GraphicsLayerTextureMapper(client));
+}
+
 GraphicsLayerTextureMapper::GraphicsLayerTextureMapper(GraphicsLayerClient* client)
     : GraphicsLayer(client)
     , m_layer(adoptPtr(new TextureMapperLayer()))
@@ -383,11 +390,9 @@ void GraphicsLayerTextureMapper::animationStartedTimerFired(Timer<GraphicsLayerT
     client()->notifyAnimationStarted(this, /* DOM time */ WTF::currentTime());
 }
 
-PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
+void GraphicsLayerTextureMapper::setDebugBorder(const Color& color, float width)
 {
-    if (s_graphicsLayerFactory)
-        return (*s_graphicsLayerFactory)(client);
-    return adoptPtr(new GraphicsLayerTextureMapper(client));
+    m_layer->setDebugBorder(color, width);
 }
 
 #if ENABLE(CSS_FILTERS)
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
index c82e943eb..94530dbca 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -90,6 +90,8 @@ public:
     bool needsDisplay() const { return m_needsDisplay; }
     IntRect needsDisplayRect() const { return enclosingIntRect(m_needsDisplayRect); }
 
+    virtual void setDebugBorder(const Color&, float width);
+
 #if ENABLE(CSS_FILTERS)
     virtual bool setFilters(const FilterOperations&);
 #endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index ca31d1769..2907d1ac8 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -112,6 +112,7 @@ public:
     static PassOwnPtr<TextureMapper> create(AccelerationMode newMode = SoftwareMode);
     virtual ~TextureMapper() { }
 
+    virtual void drawBorder(const Color&, float borderWidth, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix = TransformationMatrix()) = 0;
     virtual void drawTexture(const BitmapTexture&, const FloatRect& target, const TransformationMatrix& modelViewMatrix = TransformationMatrix(), float opacity = 1.0f, const BitmapTexture* maskTexture = 0) = 0;
 
     // makes a surface the target for the following drawTexture calls.
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
index 4c92c597d..aa022a24e 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
@@ -180,22 +180,26 @@ bool TextureMapperAnimation::isActive() const
 
 bool TextureMapperAnimations::hasActiveAnimationsOfType(AnimatedPropertyID type) const
 {
-    HashMap<String, TextureMapperAnimation>::const_iterator end = m_animations.end();
-    for (HashMap<String, TextureMapperAnimation>::const_iterator it = m_animations.begin(); it != end; ++it) {
-        const TextureMapperAnimation& animation = it->second;
-        if (animation.isActive() && animation.property() == type)
-            return true;
+    HashMap<String, Vector<TextureMapperAnimation> >::const_iterator end = m_animations.end();
+    for (HashMap<String, Vector<TextureMapperAnimation> >::const_iterator it = m_animations.begin(); it != end; ++it) {
+        const Vector<TextureMapperAnimation>& animations = it->second;
+        for (size_t i = 0; i < animations.size(); ++i) {
+            if (animations[i].isActive() && animations[i].property() == type)
+                return true;
+        }
     }
     return false;
 }
 
 bool TextureMapperAnimations::hasRunningAnimations() const
 {
-    HashMap<String, TextureMapperAnimation>::const_iterator end = m_animations.end();
-    for (HashMap<String, TextureMapperAnimation>::const_iterator it = m_animations.begin(); it != end; ++it) {
-        const TextureMapperAnimation& animation = it->second;
-        if (animation.state() == TextureMapperAnimation::PlayingState)
-            return true;
+    HashMap<String, Vector<TextureMapperAnimation> >::const_iterator end = m_animations.end();
+    for (HashMap<String, Vector<TextureMapperAnimation> >::const_iterator it = m_animations.begin(); it != end; ++it) {
+        const Vector<TextureMapperAnimation>& animations = it->second;
+        for (size_t i = 0; i < animations.size(); ++i) {
+            if (animations[i].state() == TextureMapperAnimation::PlayingState)
+                return true;
+        }
     }
 
     return false;
@@ -247,19 +251,36 @@ void TextureMapperAnimation::pause(double offset)
     m_pauseTime = WTF::currentTime() - offset;
 }
 
+void TextureMapperAnimations::add(const String& name, const TextureMapperAnimation& animation)
+{
+    HashMap<String, Vector<TextureMapperAnimation> >::iterator it = m_animations.find(name);
+    if (it != m_animations.end()) {
+        it->second.append(animation);
+        return;
+    }
+
+    Vector<TextureMapperAnimation> animations;
+    animations.append(animation);
+    m_animations.add(name, animations);
+}
+
 void TextureMapperAnimations::pause(const String& name, double offset)
 {
-    HashMap<String, TextureMapperAnimation>::iterator it = m_animations.find(name);
+    HashMap<String, Vector<TextureMapperAnimation> >::iterator it = m_animations.find(name);
     if (it == m_animations.end())
         return;
-    it->second.pause(offset);
+
+    for (size_t i = 0; i < it->second.size(); i++) 
+        it->second[i].pause(offset);
 }
 
 void TextureMapperAnimations::apply(TextureMapperAnimationClient* client)
 {
-    HashMap<String, TextureMapperAnimation>::iterator end = m_animations.end();
-    for (HashMap<String, TextureMapperAnimation>::iterator it = m_animations.begin(); it != end; ++it)
-        it->second.apply(client);
+    HashMap<String, Vector<TextureMapperAnimation> >::iterator end = m_animations.end();
+    for (HashMap<String, Vector<TextureMapperAnimation> >::iterator it = m_animations.begin(); it != end; ++it) {
+        for (size_t i = 0; i < it->second.size(); ++i)
+            it->second[i].apply(client);
+    }
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h b/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h
index 7cb8a7c5a..d0e90b518 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h
@@ -66,7 +66,7 @@ class TextureMapperAnimations {
 public:
     TextureMapperAnimations() { }
 
-    void add(const String& name, const TextureMapperAnimation& animation) { m_animations.add(name, animation); }
+    void add(const String&, const TextureMapperAnimation&);
     void remove(const String& name) { m_animations.remove(name); }
     void pause(const String&, double);
     void apply(TextureMapperAnimationClient*);
@@ -76,7 +76,7 @@ public:
     bool hasActiveAnimationsOfType(AnimatedPropertyID type) const;
 
 private:
-    HashMap<String, TextureMapperAnimation> m_animations;
+    HashMap<String, Vector<TextureMapperAnimation> > m_animations;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
index 43ac7810b..8877bfe34 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
@@ -52,6 +52,11 @@ void TextureMapperTile::paint(TextureMapper* textureMapper, const Transformation
     textureMapper->drawTexture(*texture().get(), rect(), transform, opacity, mask);
 }
 
+TextureMapperTiledBackingStore::TextureMapperTiledBackingStore()
+    : m_drawsDebugBorders(false)
+{
+}
+
 void TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded(TextureMapper* textureMapper)
 {
     if (!m_image)
@@ -66,8 +71,11 @@ void TextureMapperTiledBackingStore::paintToTextureMapper(TextureMapper* texture
     updateContentsFromImageIfNeeded(textureMapper);
     TransformationMatrix adjustedTransform = transform;
     adjustedTransform.multiply(TransformationMatrix::rectToRect(rect(), targetRect));
-    for (size_t i = 0; i < m_tiles.size(); ++i)
+    for (size_t i = 0; i < m_tiles.size(); ++i) {
         m_tiles[i].paint(textureMapper, adjustedTransform, opacity, mask);
+        if (m_drawsDebugBorders)
+            textureMapper->drawBorder(m_debugBorderColor, m_debugBorderWidth, m_tiles[i].rect(), adjustedTransform);
+    }
 }
 
 void TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded(const FloatSize& size, const IntSize& tileSize, bool hasAlpha)
@@ -152,4 +160,10 @@ PassRefPtr<BitmapTexture> TextureMapperTiledBackingStore::texture() const
     return PassRefPtr<BitmapTexture>();
 }
 
+void TextureMapperTiledBackingStore::setDebugBorder(const Color& color, float width)
+{
+    m_debugBorderColor = color;
+    m_debugBorderWidth = width;
+}
+
 }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
index df61b8626..37a365036 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
@@ -72,13 +72,20 @@ public:
     void setContentsToImage(Image* image) { m_image = image; }
     void updateContentsFromImageIfNeeded(TextureMapper*);
 
+    void setShowDebugBorders(bool drawsDebugBorders) { m_drawsDebugBorders = drawsDebugBorders; }
+    void setDebugBorder(const Color&, float width);
+
 private:
-    TextureMapperTiledBackingStore() { }
+    TextureMapperTiledBackingStore();
     void createOrDestroyTilesIfNeeded(const FloatSize& backingStoreSize, const IntSize& tileSize, bool hasAlpha);
 
     Vector<TextureMapperTile> m_tiles;
     FloatSize m_size;
     RefPtr<Image> m_image;
+
+    bool m_drawsDebugBorders;
+    Color m_debugBorderColor;
+    float m_debugBorderWidth;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index df9b8b03e..0f7652cd4 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -33,7 +33,7 @@
 #if PLATFORM(QT)
 #if QT_VERSION >= 0x050000
 #include <QOpenGLContext>
-#include <QPlatformPixmap>
+#include <qpa/qplatformpixmap.h>
 #else
 #include <QGLContext>
 #endif // QT_VERSION
@@ -304,6 +304,55 @@ void TextureMapperGL::endPainting()
 #endif
 }
 
+void TextureMapperGL::drawRect(const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, TextureMapperShaderProgram* shaderProgram, GLenum drawingMode, bool needsBlending)
+{
+    GL_CMD(glEnableVertexAttribArray(shaderProgram->vertexAttrib()));
+    GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0));
+    const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
+    GL_CMD(glVertexAttribPointer(shaderProgram->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect));
+
+    TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
+            targetRect.width(), 0, 0, 0,
+            0, targetRect.height(), 0, 0,
+            0, 0, 1, 0,
+            targetRect.x(), targetRect.y(), 0, 1));
+
+    const GLfloat m4[] = {
+        matrix.m11(), matrix.m12(), matrix.m13(), matrix.m14(),
+        matrix.m21(), matrix.m22(), matrix.m23(), matrix.m24(),
+        matrix.m31(), matrix.m32(), matrix.m33(), matrix.m34(),
+        matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
+    };
+    GL_CMD(glUniformMatrix4fv(shaderProgram->matrixVariable(), 1, GL_FALSE, m4));
+
+    if (needsBlending) {
+        GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA));
+        GL_CMD(glEnable(GL_BLEND));
+    } else
+        GL_CMD(glDisable(GL_BLEND));
+
+    GL_CMD(glDrawArrays(drawingMode, 0, 4));
+    GL_CMD(glDisableVertexAttribArray(shaderProgram->vertexAttrib()));
+}
+
+void TextureMapperGL::drawBorder(const Color& color, float width, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix)
+{
+    if (clipStack().current().scissorBox.isEmpty())
+        return;
+
+    RefPtr<TextureMapperShaderProgramSolidColor> shaderInfo = data().sharedGLData().textureMapperShaderManager.solidColorProgram();
+    GL_CMD(glUseProgram(shaderInfo->id()));
+
+    float alpha = color.alpha() / 255.0;
+    GL_CMD(glUniform4f(shaderInfo->colorVariable(),
+                       (color.red() / 255.0) * alpha,
+                       (color.green() / 255.0) * alpha,
+                       (color.blue() / 255.0) * alpha,
+                       alpha));
+    GL_CMD(glLineWidth(width));
+
+    drawRect(targetRect, modelViewMatrix, shaderInfo.get(), GL_LINE_LOOP, color.hasAlpha());
+}
 
 void TextureMapperGL::drawTexture(const BitmapTexture& texture, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, const BitmapTexture* mask)
 {
@@ -324,55 +373,24 @@ void TextureMapperGL::drawTexture(uint32_t texture, Flags flags, const IntSize&
         shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram(TextureMapperShaderManager::OpacityAndMask);
     else
         shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram(TextureMapperShaderManager::Simple);
-
     GL_CMD(glUseProgram(shaderInfo->id()));
+
     GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()));
     GL_CMD(glActiveTexture(GL_TEXTURE0));
     GL_CMD(glBindTexture(GL_TEXTURE_2D, texture));
-    GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0));
-    const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(shaderInfo->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect));
-
-    TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
-            targetRect.width(), 0, 0, 0,
-            0, targetRect.height(), 0, 0,
-            0, 0, 1, 0,
-            targetRect.x(), targetRect.y(), 0, 1));
-
-    const GLfloat m4[] = {
-        matrix.m11(), matrix.m12(), matrix.m13(), matrix.m14(),
-        matrix.m21(), matrix.m22(), matrix.m23(), matrix.m24(),
-        matrix.m31(), matrix.m32(), matrix.m33(), matrix.m34(),
-        matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
-    };
+    GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0));
 
     const GLfloat m4src[] = {
         1, 0, 0, 0,
         0, (flags & ShouldFlipTexture) ? -1 : 1, 0, 0,
         0, 0, 1, 0,
         0, (flags & ShouldFlipTexture) ? 1 : 0, 0, 1};
-
-    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4));
     GL_CMD(glUniformMatrix4fv(shaderInfo->sourceMatrixVariable(), 1, GL_FALSE, m4src));
-    GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0));
 
     shaderInfo->prepare(opacity, maskTexture);
 
     bool needsBlending = (flags & SupportsBlending) || opacity < 0.99 || maskTexture;
-
-    if (needsBlending) {
-        GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA));
-        GL_CMD(glEnable(GL_BLEND));
-    } else
-        GL_CMD(glDisable(GL_BLEND));
-
-    GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4));
-    GL_CMD(glDisableVertexAttribArray(shaderInfo->vertexAttrib()));
-}
-
-const char* TextureMapperGL::type() const
-{
-    return "OpenGL";
+    drawRect(targetRect, modelViewMatrix, shaderInfo.get(), GL_TRIANGLE_FAN, needsBlending);
 }
 
 bool BitmapTextureGL::canReuseWith(const IntSize& contentsSize, Flags)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
index 4279499fc..627eae822 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
@@ -37,6 +37,7 @@ class TextureMapperShaderProgram;
 // An OpenGL-ES2 implementation of TextureMapper.
 class TextureMapperGL : public TextureMapper {
 public:
+    static PassOwnPtr<TextureMapperGL> create() { return adoptPtr(new TextureMapperGL); }
     TextureMapperGL();
     virtual ~TextureMapperGL();
 
@@ -47,23 +48,20 @@ public:
 
     typedef int Flags;
 
-    // reimps from TextureMapper
-    virtual void drawTexture(const BitmapTexture&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
+    // TextureMapper implementation
+    virtual void drawBorder(const Color&, float borderWidth, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix = TransformationMatrix()) OVERRIDE;
+    virtual void drawTexture(const BitmapTexture&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture) OVERRIDE;
     virtual void drawTexture(uint32_t texture, Flags, const IntSize& textureSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture);
-    virtual void bindSurface(BitmapTexture* surface);
-    virtual void beginClip(const TransformationMatrix&, const FloatRect&);
-    virtual void beginPainting(PaintFlags = 0);
-    virtual void endPainting();
-    virtual void endClip();
-    virtual IntSize maxTextureSize() { return IntSize(2000, 2000); }
-    virtual PassRefPtr<BitmapTexture> createTexture();
-    virtual const char* type() const;
-    static PassOwnPtr<TextureMapperGL> create() { return adoptPtr(new TextureMapperGL); }
-    void setGraphicsContext(GraphicsContext* context) { m_context = context; }
-    GraphicsContext* graphicsContext() { return m_context; }
-    virtual bool isOpenGLBacked() const { return true; }
-    void platformUpdateContents(NativeImagePtr, const IntRect&, const IntRect&);
-    virtual AccelerationMode accelerationMode() const { return OpenGLMode; }
+    virtual void bindSurface(BitmapTexture* surface) OVERRIDE;
+    virtual void beginClip(const TransformationMatrix&, const FloatRect&) OVERRIDE;
+    virtual void beginPainting(PaintFlags = 0) OVERRIDE;
+    virtual void endPainting() OVERRIDE;
+    virtual void endClip() OVERRIDE;
+    virtual IntSize maxTextureSize() const OVERRIDE { return IntSize(2000, 2000); }
+    virtual PassRefPtr<BitmapTexture> createTexture() OVERRIDE;
+    virtual GraphicsContext* graphicsContext() OVERRIDE { return m_context; }
+    virtual AccelerationMode accelerationMode() const OVERRIDE { return OpenGLMode; }
+    virtual void setGraphicsContext(GraphicsContext* context) OVERRIDE { m_context = context; }
 
 #if ENABLE(CSS_FILTERS)
     void drawFiltered(const BitmapTexture& sourceTexture, const BitmapTexture& contentTexture, const FilterOperation&);
@@ -94,6 +92,7 @@ private:
         Vector<ClipState> clipStack;
     };
 
+    void drawRect(const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, TextureMapperShaderProgram*, GLenum drawingMode, bool needsBlending);
     bool beginScissorClip(const TransformationMatrix&, const FloatRect&);
     void bindDefaultSurface();
     ClipStack& clipStack();
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
index 8a035628e..38171117f 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
@@ -48,19 +48,22 @@ private:
 
 class TextureMapperImageBuffer : public TextureMapper {
 public:
-    virtual void drawTexture(const BitmapTexture&, const FloatRect& targetRect, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
-    virtual void beginClip(const TransformationMatrix&, const FloatRect&);
-    virtual void bindSurface(BitmapTexture* surface) { m_currentSurface = surface;}
-    virtual void endClip() { graphicsContext()->restore(); }
     static PassOwnPtr<TextureMapper> create() { return adoptPtr(new TextureMapperImageBuffer); }
-    PassRefPtr<BitmapTexture> createTexture() { return BitmapTextureImageBuffer::create(); }
+
+    // TextureMapper implementation
+    virtual void drawBorder(const Color& color, float borderWidth, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix = TransformationMatrix()) OVERRIDE { };
+    virtual void drawTexture(const BitmapTexture&, const FloatRect& targetRect, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture) OVERRIDE;
+    virtual void beginClip(const TransformationMatrix&, const FloatRect&) OVERRIDE;
+    virtual void bindSurface(BitmapTexture* surface) OVERRIDE { m_currentSurface = surface;}
+    virtual void endClip() OVERRIDE { graphicsContext()->restore(); }
+    virtual PassRefPtr<BitmapTexture> createTexture() OVERRIDE { return BitmapTextureImageBuffer::create(); }
+    virtual AccelerationMode accelerationMode() const OVERRIDE { return SoftwareMode; }
+
     inline GraphicsContext* currentContext()
     {
         return m_currentSurface ? static_cast<BitmapTextureImageBuffer*>(m_currentSurface.get())->graphicsContext() : graphicsContext();
     }
 
-    virtual AccelerationMode accelerationMode() const { return SoftwareMode; }
-
 private:
     RefPtr<BitmapTexture> m_currentSurface;
 };
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
index 84a6601f2..40f0c9836 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
@@ -90,7 +90,7 @@ void TextureMapperLayer::computeTransformsRecursive()
         sortByZOrder(m_children, 0, m_children.size());
 }
 
-void TextureMapperLayer::updateBackingStore(TextureMapper* textureMapper, GraphicsLayer* layer)
+void TextureMapperLayer::updateBackingStore(TextureMapper* textureMapper, GraphicsLayerTextureMapper* layer)
 {
     if (!layer || !textureMapper)
         return;
@@ -123,7 +123,13 @@ void TextureMapperLayer::updateBackingStore(TextureMapper* textureMapper, Graphi
     layer->paintGraphicsLayerContents(*context, dirtyRect);
 
     RefPtr<Image> image = imageBuffer->copyImage(DontCopyBackingStore);
-    static_cast<TextureMapperTiledBackingStore*>(m_backingStore.get())->updateContents(textureMapper, image.get(), m_size, dirtyRect);
+
+    TextureMapperTiledBackingStore* backingStore = static_cast<TextureMapperTiledBackingStore*>(m_backingStore.get());
+    backingStore->updateContents(textureMapper, image.get(), m_size, dirtyRect);
+
+    backingStore->setShowDebugBorders(layer->showDebugBorders());
+    backingStore->setDebugBorder(m_debugBorderColor, m_debugBorderWidth);
+
     m_state.needsDisplay = false;
     m_state.needsDisplayRect = IntRect();
 }
@@ -372,6 +378,8 @@ void TextureMapperLayer::syncCompositingStateSelf(GraphicsLayerTextureMapper* gr
     if (changeMask == NoChanges && graphicsLayer->m_animations.isEmpty())
         return;
 
+    graphicsLayer->updateDebugIndicators();
+
     if (changeMask & ParentChange) {
         TextureMapperLayer* newParent = toTextureMapperLayer(graphicsLayer->parent());
         if (newParent != m_parent) {
@@ -546,5 +554,13 @@ void TextureMapperLayer::setScrollPositionDeltaIfNeeded(const IntPoint& delta)
     m_transform.setPosition(m_state.pos + m_scrollPositionDelta);
 }
 
+void TextureMapperLayer::setDebugBorder(const Color& color, float width)
+{
+    // The default values for GraphicsLayer debug borders are a little
+    // hard to see (some less than one pixel wide), so we double their size here.
+    m_debugBorderColor = color;
+    m_debugBorderWidth = width * 2;
+}
+
 }
 #endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
index 172ca5cb1..da1ac9916 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
@@ -106,6 +106,7 @@ public:
         , m_centerZ(0)
         , m_shouldUpdateBackingStoreFromLayer(true)
         , m_textureMapper(0)
+        , m_debugBorderWidth(0)
     { }
 
     virtual ~TextureMapperLayer();
@@ -129,6 +130,8 @@ public:
     void setScrollPositionDeltaIfNeeded(const IntPoint&);
     void setFixedToViewport(bool fixed) { m_fixedToViewport = fixed; }
 
+    void setDebugBorder(const Color&, float width);
+
 private:
     TextureMapperLayer* rootLayer();
     void computeTransformsRecursive();
@@ -152,7 +155,7 @@ private:
     void paintSelf(const TextureMapperPaintOptions&);
     void paintSelfAndChildren(const TextureMapperPaintOptions&);
     void paintSelfAndChildrenWithReplica(const TextureMapperPaintOptions&);
-    void updateBackingStore(TextureMapper*, GraphicsLayer*);
+    void updateBackingStore(TextureMapper*, GraphicsLayerTextureMapper*);
 
     void syncAnimations();
     bool isVisible() const;
@@ -230,6 +233,8 @@ private:
     TextureMapperAnimations m_animations;
     IntPoint m_scrollPositionDelta;
     bool m_fixedToViewport;
+    Color m_debugBorderColor;
+    float m_debugBorderWidth;
 };
 
 
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
index a759c5f4c..56fa74224 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
@@ -92,6 +92,58 @@ static const char* vertexShaderSourceSimple =
         }
     );
 
+static const char* vertexShaderSourceSolidColor =
+    VERTEX_SHADER(
+        uniform mat4 InMatrix;
+        attribute vec4 InVertex;
+        void main(void)
+        {
+            gl_Position = InMatrix * InVertex;
+        }
+    );
+
+
+static const char* fragmentShaderSourceSolidColor =
+    VERTEX_SHADER(
+        uniform vec4 Color;
+        void main(void)
+        {
+            gl_FragColor = Color;
+        }
+    );
+
+PassRefPtr<TextureMapperShaderProgramSolidColor> TextureMapperShaderManager::solidColorProgram()
+{
+    return static_pointer_cast<TextureMapperShaderProgramSolidColor>(getShaderProgram(SolidColor));
+}
+
+PassRefPtr<TextureMapperShaderProgram> TextureMapperShaderManager::getShaderProgram(ShaderType shaderType)
+{
+    RefPtr<TextureMapperShaderProgram> program;
+    if (shaderType == Invalid)
+        return program;
+
+    TextureMapperShaderProgramMap::iterator it = m_textureMapperShaderProgramMap.find(shaderType);
+    if (it != m_textureMapperShaderProgramMap.end())
+        return it->second;
+
+    switch (shaderType) {
+    case Simple:
+        program = TextureMapperShaderProgramSimple::create();
+        break;
+    case OpacityAndMask:
+        program = TextureMapperShaderProgramOpacityAndMask::create();
+        break;
+    case SolidColor:
+        program = TextureMapperShaderProgramSolidColor::create();
+        break;
+    case Invalid:
+        ASSERT_NOT_REACHED();
+    }
+    m_textureMapperShaderProgramMap.add(shaderType, program);
+    return program;
+}
+
 void TextureMapperShaderProgram::initializeProgram()
 {
     const char* vertexShaderSourceProgram = vertexShaderSource();
@@ -161,6 +213,28 @@ void TextureMapperShaderProgramSimple::prepare(float opacity, const BitmapTextur
     glUniform1f(m_opacityVariable, opacity);
 }
 
+PassRefPtr<TextureMapperShaderProgramSolidColor> TextureMapperShaderProgramSolidColor::create()
+{
+    return adoptRef(new TextureMapperShaderProgramSolidColor());
+}
+
+TextureMapperShaderProgramSolidColor::TextureMapperShaderProgramSolidColor()
+{
+    initializeProgram();
+    getUniformLocation(m_matrixVariable, "InMatrix");
+    getUniformLocation(m_colorVariable, "Color");
+}
+
+const char* TextureMapperShaderProgramSolidColor::vertexShaderSource() const
+{
+    return vertexShaderSourceSolidColor;
+}
+
+const char* TextureMapperShaderProgramSolidColor::fragmentShaderSource() const
+{
+    return fragmentShaderSourceSolidColor;
+}
+
 PassRefPtr<TextureMapperShaderProgramOpacityAndMask> TextureMapperShaderProgramOpacityAndMask::create()
 {
     return adoptRef(new TextureMapperShaderProgramOpacityAndMask());
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
index d0593e6c7..16221acda 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
@@ -123,12 +123,26 @@ private:
     GLint m_maskTextureVariable;
 };
 
+class TextureMapperShaderProgramSolidColor : public TextureMapperShaderProgram {
+public:
+    static PassRefPtr<TextureMapperShaderProgramSolidColor> create();
+    GLint colorVariable() const { return m_colorVariable; }
+
+private:
+    virtual const char* vertexShaderSource() const;
+    virtual const char* fragmentShaderSource() const;
+    TextureMapperShaderProgramSolidColor();
+    GLint m_colorVariable;
+};
+
+
 class TextureMapperShaderManager {
 public:
     enum ShaderType {
         Invalid = 0, // HashMaps do not like 0 as a key.
         Simple,
-        OpacityAndMask
+        OpacityAndMask,
+        SolidColor,
     };
 
     TextureMapperShaderManager();
@@ -137,30 +151,8 @@ public:
 #if ENABLE(CSS_FILTERS)
     PassRefPtr<StandardFilterProgram> getShaderForFilter(const FilterOperation&);
 #endif
-
-    PassRefPtr<TextureMapperShaderProgram> getShaderProgram(ShaderType shaderType)
-    {
-        RefPtr<TextureMapperShaderProgram> program;
-        if (shaderType == Invalid)
-            return program;
-
-        TextureMapperShaderProgramMap::iterator it = m_textureMapperShaderProgramMap.find(shaderType);
-        if (it != m_textureMapperShaderProgramMap.end())
-            return it->second;
-
-        switch (shaderType) {
-        case Simple:
-            program = TextureMapperShaderProgramSimple::create();
-            break;
-        case OpacityAndMask:
-            program = TextureMapperShaderProgramOpacityAndMask::create();
-            break;
-        case Invalid:
-            ASSERT_NOT_REACHED();
-        }
-        m_textureMapperShaderProgramMap.add(shaderType, program);
-        return program;
-    }
+    PassRefPtr<TextureMapperShaderProgram> getShaderProgram(ShaderType);
+    PassRefPtr<TextureMapperShaderProgramSolidColor> solidColorProgram();
 
 private:
     typedef HashMap<ShaderType, RefPtr<TextureMapperShaderProgram>, DefaultHash<int>::Hash, HashTraits<int> > TextureMapperShaderProgramMap;
diff --git a/Source/WebCore/platform/graphics/win/ImageCairoWin.cpp b/Source/WebCore/platform/graphics/win/ImageCairoWin.cpp
index 70b132ef3..272cba88f 100644
--- a/Source/WebCore/platform/graphics/win/ImageCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/ImageCairoWin.cpp
@@ -49,10 +49,9 @@ PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
     if (!dibSection.dsBm.bmBits)
         return 0;
 
-    cairo_surface_t* image = cairo_win32_surface_create_with_dib (CAIRO_FORMAT_ARGB32, dibSection.dsBm.bmWidth, dibSection.dsBm.bmHeight);
+    cairo_surface_t* surface = cairo_win32_surface_create_with_dib (CAIRO_FORMAT_ARGB32, dibSection.dsBm.bmWidth, dibSection.dsBm.bmHeight);
 
-    // The BitmapImage object takes over ownership of the cairo_surface_t*, so no need to destroy here.
-    return adoptRef(new BitmapImage(image));
+    return BitmapImage::create(new NativeImageCairo(surface));
 }
 
 bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
@@ -96,7 +95,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
 {
     size_t frames = frameCount();
     for (size_t i = 0; i < frames; ++i) {
-        cairo_surface_t* image = frameAtIndex(i);
+        cairo_surface_t* image = frameAtIndex(i)->surface();
         if (cairo_image_surface_get_height(image) == static_cast<size_t>(srcSize.height()) && cairo_image_surface_get_width(image) == static_cast<size_t>(srcSize.width())) {
             size_t currentFrame = m_currentFrame;
             m_currentFrame = i;
diff --git a/Source/WebCore/platform/graphics/win/ImageWin.cpp b/Source/WebCore/platform/graphics/win/ImageWin.cpp
index 54c5b41cc..03de163c7 100644
--- a/Source/WebCore/platform/graphics/win/ImageWin.cpp
+++ b/Source/WebCore/platform/graphics/win/ImageWin.cpp
@@ -34,10 +34,6 @@ PassRefPtr<WebCore::SharedBuffer> loadResourceIntoBuffer(const char*);
 
 namespace WebCore {
 
-void BitmapImage::initPlatformData()
-{
-}
-
 void BitmapImage::invalidatePlatformData()
 {
 }
diff --git a/Source/WebCore/platform/graphics/wx/ImageBufferDataWx.h b/Source/WebCore/platform/graphics/wx/ImageBufferDataWx.h
index 67f87c924..8430e8102 100644
--- a/Source/WebCore/platform/graphics/wx/ImageBufferDataWx.h
+++ b/Source/WebCore/platform/graphics/wx/ImageBufferDataWx.h
@@ -25,6 +25,11 @@
 
 #include <wtf/OwnPtr.h>
 
+// see http://trac.wxwidgets.org/ticket/11482
+#ifdef __WXMSW__
+#   include "wx/msw/winundef.h"
+#endif
+
 #include <wx/bitmap.h>
 #include <wx/dcmemory.h>
 
diff --git a/Source/WebCore/platform/graphics/wx/ImageWx.cpp b/Source/WebCore/platform/graphics/wx/ImageWx.cpp
index 85667dd36..54bbdbb8c 100644
--- a/Source/WebCore/platform/graphics/wx/ImageWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/ImageWx.cpp
@@ -80,11 +80,6 @@ PassRefPtr<Image> Image::loadPlatformResource(const char *name)
     return img.release();
 }
 
-void BitmapImage::initPlatformData()
-{
-    // FIXME: NYI
-}
-
 BitmapImage::BitmapImage(const wxBitmap& bitmap)
     : Image(0)
     , m_currentFrame(0)
@@ -103,8 +98,6 @@ BitmapImage::BitmapImage(const wxBitmap& bitmap)
     , m_haveFrameCount(true)
     , m_frameCount(1)
 {
-    initPlatformData();
-    
     m_decodedSize = bitmap.GetWidth() * bitmap.GetHeight() * 4;
     m_size = IntSize(bitmap.GetWidth(), bitmap.GetHeight());
 
diff --git a/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp
index aa60ba456..f2cfa877f 100644
--- a/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp
+++ b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp
@@ -40,7 +40,7 @@ PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create()
     return adoptPtr(new AsyncFileSystemGtk());
 }
 
-void AsyncFileSystem::openFileSystem(const KURL& basePath, const String& storageIdentifier, bool, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void AsyncFileSystem::openFileSystem(const String& basePath, const String& storageIdentifier, bool, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
     notImplemented();
     callbacks->didFail(NOT_SUPPORTED_ERR);
diff --git a/Source/WebCore/platform/gtk/KURLGtk.cpp b/Source/WebCore/platform/gtk/KURLGtk.cpp
index 12d2b1883..8d1feaca9 100644
--- a/Source/WebCore/platform/gtk/KURLGtk.cpp
+++ b/Source/WebCore/platform/gtk/KURLGtk.cpp
@@ -31,7 +31,10 @@ namespace WebCore {
 
 String KURL::fileSystemPath() const
 {
-    GRefPtr<GFile> file = adoptGRef(g_file_new_for_uri(m_string.utf8().data()));
+    if (!isValid() || !isLocalFile())
+        return String();
+
+    GRefPtr<GFile> file = adoptGRef(g_file_new_for_path(path().utf8().data()));
     GOwnPtr<char> filename(g_file_get_path(file.get()));
     return filenameToString(filename.get());
 }
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
index d9e969092..3db393aef 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -143,7 +143,7 @@ ImageFrame& ImageFrame::operator=(const ImageFrame& other)
     if (this == &other)
         return *this;
 
-    copyReferenceToBitmapData(other);
+    copyBitmapData(other);
     setOriginalFrameRect(other.originalFrameRect());
     setStatus(other.status());
     setDuration(other.duration());
@@ -169,14 +169,6 @@ void ImageFrame::zeroFillPixelData()
     m_hasAlpha = true;
 }
 
-#if !USE(CG)
-
-void ImageFrame::copyReferenceToBitmapData(const ImageFrame& other)
-{
-    ASSERT(this != &other);
-    copyBitmapData(other);
-}
-
 bool ImageFrame::copyBitmapData(const ImageFrame& other)
 {
     if (this == &other)
@@ -203,8 +195,6 @@ bool ImageFrame::setSize(int newWidth, int newHeight)
     return true;
 }
 
-#endif
-
 bool ImageFrame::hasAlpha() const
 {
     return m_hasAlpha;
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index 20122fffb..6ae738a3b 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -87,10 +87,6 @@ namespace WebCore {
         // the other.  Returns whether the copy succeeded.
         bool copyBitmapData(const ImageFrame&);
 
-        // Makes this frame reference the provided image's pixel data, so that
-        // modifications in one frame are reflected in the other.
-        void copyReferenceToBitmapData(const ImageFrame&);
-
         // Copies the pixel data at [(startX, startY), (endX, startY)) to the
         // same X-coordinates on each subsequent row up to but not including
         // endY.
@@ -154,12 +150,6 @@ namespace WebCore {
 #endif
 
     private:
-#if USE(CG)
-        typedef RetainPtr<CFMutableDataRef> NativeBackingStore;
-#else
-        typedef Vector<PixelData> NativeBackingStore;
-#endif
-
         int width() const;
         int height() const;
 
@@ -196,7 +186,7 @@ namespace WebCore {
         bool m_hasAlpha;
         IntSize m_size;
 #else
-        NativeBackingStore m_backingStore;
+        Vector<PixelData> m_backingStore;
         PixelData* m_bytes; // The memory is backed by m_backingStore.
         IntSize m_size;
         bool m_hasAlpha;
diff --git a/Source/WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp b/Source/WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp
deleted file mode 100644
index 8fbfe0bfe..000000000
--- a/Source/WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright (C) 2010 Google, Inc.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "ImageDecoder.h"
-
-#include "GraphicsContextCG.h"
-
-#include <CoreGraphics/CGColorSpace.h>
-#include <CoreGraphics/CGImage.h>
-
-namespace WebCore {
-
-static ImageFrame::PixelData* getPtrAsPixelData(CFMutableDataRef data)
-{
-    return data ? reinterpret_cast<ImageFrame::PixelData*>(CFDataGetMutableBytePtr(data)) : 0;
-}
-   
-void ImageFrame::copyReferenceToBitmapData(const ImageFrame& other)
-{
-    ASSERT(this != &other);
-    m_backingStore = other.m_backingStore;
-    m_bytes = getPtrAsPixelData(m_backingStore.get());
-    // FIXME: The rest of this function seems redundant with ImageFrame::copyBitmapData.
-    m_size = other.m_size;
-    setHasAlpha(other.m_hasAlpha);
-}
-
-bool ImageFrame::copyBitmapData(const ImageFrame& other)
-{
-    if (this == &other)
-        return true;
-
-    m_backingStore.adoptCF(CFDataCreateMutableCopy(kCFAllocatorDefault, 0, other.m_backingStore.get()));
-    m_bytes = getPtrAsPixelData(m_backingStore.get());
-    m_size = other.m_size;
-    setHasAlpha(other.m_hasAlpha);
-    return true;
-}
-
-bool ImageFrame::setSize(int newWidth, int newHeight)
-{
-    ASSERT(!m_backingStore);
-    size_t backingStoreSize = newWidth * newHeight * sizeof(PixelData);
-    CFMutableDataRef backingStoreRef = CFDataCreateMutable(kCFAllocatorDefault, backingStoreSize);
-    if (!backingStoreRef)
-        return false;
-    m_backingStore.adoptCF(backingStoreRef);
-    CFDataSetLength(backingStoreRef, backingStoreSize);
-    m_bytes = reinterpret_cast<PixelData*>(CFDataGetMutableBytePtr(m_backingStore.get()));
-    m_size = IntSize(newWidth, newHeight);
-
-    zeroFillPixelData();
-    return true;
-}
-
-static CGColorSpaceRef createColorSpace(const ColorProfile& colorProfile)
-{
-    if (colorProfile.isEmpty())
-        return CGColorSpaceCreateDeviceRGB();
-
-    RetainPtr<CFDataRef> data(AdoptCF, CFDataCreate(kCFAllocatorDefault, reinterpret_cast<const UInt8*>(colorProfile.data()), colorProfile.size()));
-#ifndef TARGETING_LEOPARD
-    return CGColorSpaceCreateWithICCProfile(data.get());
-#else
-    RetainPtr<CGDataProviderRef> profileDataProvider(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
-    CGFloat ranges[] = {0.0, 255.0, 0.0, 255.0, 0.0, 255.0};
-    return CGColorSpaceCreateICCBased(3, ranges, profileDataProvider.get(), deviceRGBColorSpaceRef());
-#endif
-}
-
-NativeImagePtr ImageFrame::asNewNativeImage() const
-{
-    RetainPtr<CGColorSpaceRef> colorSpace(AdoptCF, createColorSpace(m_colorProfile));
-    RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(m_backingStore.get()));
-
-    CGImageAlphaInfo alphaInfo = m_premultiplyAlpha ? kCGImageAlphaPremultipliedFirst : kCGImageAlphaFirst;
-
-    return CGImageCreate(width(), height(), 8, 32, width() * sizeof(PixelData), colorSpace.get(),
-        alphaInfo | kCGBitmapByteOrder32Host, dataProvider.get(), 0, /*shouldInterpolate=*/true, kCGRenderingIntentDefault);
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp b/Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp
index 420b35593..0ca96e30f 100644
--- a/Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp
+++ b/Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp
@@ -581,21 +581,39 @@ bool GIFImageReader::read(const unsigned char *buf, unsigned len,
 
     case gif_extension:
     {
-      int len = count = q[1];
+      count = q[1];
       gstate es = gif_skip_block;
 
+      // The GIF spec mandates lengths for three of the extensions below.
+      // However, it's possible for GIFs in the wild to deviate. For example,
+      // some GIFs that embed ICC color profiles using gif_application_extension
+      // violate the spec and treat this extension block like a sort of
+      // "extension + data" block, giving a size greater than 11 and filling the
+      // remaining bytes with data (then following with more data blocks as
+      // needed), instead of placing a true data block just after the 11 byte
+      // extension block.
+      //
+      // Accordingly, if the specified length is larger than the required value,
+      // we use it. If it's smaller, then we enforce the spec value, because the
+      // parsers for these extensions expect to have the specified number of
+      // bytes available, and if we don't ensure that, they could read off the
+      // end of the heap buffer. (In this case, it's likely the GIF is corrupt
+      // and we'll soon fail to decode anyway.)
       switch (*q)
       {
       case 0xf9:
         es = gif_control_extension;
+        count = std::max(count, 4);
         break;
 
       case 0x01:
         // ignoring plain text extension
+        count = std::max(count, 12);
         break;
 
       case 0xff:
         es = gif_application_extension;
+        count = std::max(count, 11);
         break;
 
       case 0xfe:
@@ -603,8 +621,8 @@ bool GIFImageReader::read(const unsigned char *buf, unsigned len,
         break;
       }
 
-      if (len)
-        GETN(len, es);
+      if (count)
+        GETN(count, es);
       else
         GETN(1, gif_image_start);
     }
diff --git a/Source/WebCore/platform/mac/NSScrollerImpDetails.h b/Source/WebCore/platform/mac/NSScrollerImpDetails.h
index c6a235f93..0c956c6eb 100644
--- a/Source/WebCore/platform/mac/NSScrollerImpDetails.h
+++ b/Source/WebCore/platform/mac/NSScrollerImpDetails.h
@@ -65,6 +65,7 @@ typedef NSInteger NSScrollerKnobStyle;
 - (BOOL)isExpanded;
 - (void)setDelegate:(id)delegate;
 - (void)setUiStateTransitionProgress:(CGFloat)uiStateTransitionProgress;
+- (void)setExpansionTransitionProgress:(CGFloat)expansionTransitionProgress;
 - (BOOL)isHorizontal;
 - (CGFloat)trackWidth;
 - (CGFloat)trackBoxWidth;
@@ -74,6 +75,7 @@ typedef NSInteger NSScrollerKnobStyle;
 - (CGFloat)trackEndInset;
 - (CGFloat)knobEndInset;
 - (CGFloat)uiStateTransitionProgress;
+- (CGFloat)expansionTransitionProgress;
 - (NSRect)rectForPart:(NSScrollerPart)partCode;
 - (void)drawKnobSlotInRect:(NSRect)slotRect highlight:(BOOL)flag alpha:(CGFloat)alpha;
 - (void)drawKnob;
diff --git a/Source/WebCore/platform/mac/RunLoopMac.mm b/Source/WebCore/platform/mac/RunLoopMac.mm
index 717dd8dac..ab2c9a02a 100644
--- a/Source/WebCore/platform/mac/RunLoopMac.mm
+++ b/Source/WebCore/platform/mac/RunLoopMac.mm
@@ -26,72 +26,8 @@
 #import "config.h"
 #import "RunLoop.h"
 
-#import <dispatch/dispatch.h>
-
 namespace WebCore {
 
-static RunLoop* s_mainRunLoop;
-
-void RunLoop::initializeMainRunLoop()
-{
-    static dispatch_once_t onceToken;
-    dispatch_once(&onceToken, ^{
-        s_mainRunLoop = new RunLoop(CFRunLoopGetMain());
-    });
-}
-
-RunLoop* RunLoop::current()
-{
-    if (pthread_main_np())
-        return RunLoop::main();
-
-    DEFINE_STATIC_LOCAL(WTF::ThreadSpecific<RunLoop>, runLoopData, ());
-    return &*runLoopData;
-}
-
-RunLoop* RunLoop::main()
-{
-    ASSERT(s_mainRunLoop);
-    return s_mainRunLoop;
-}
-
-void RunLoop::performWork(void* context)
-{
-    // Wrap main thread in an Autorelease pool.  Sending messages can call 
-    // into objc code and accumulate memory.  
-    if (current() == main()) {
-        NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
-        static_cast<RunLoop*>(context)->performWork();
-        [pool drain];
-    } else
-        static_cast<RunLoop*>(context)->performWork();
-}
-
-RunLoop::RunLoop()
-    : m_runLoop(CFRunLoopGetCurrent())
-    , m_nestingLevel(0)
-{
-    CFRunLoopSourceContext context = { 0, this, 0, 0, 0, 0, 0, 0, 0, performWork };
-    m_runLoopSource = CFRunLoopSourceCreate(kCFAllocatorDefault, 0, &context);
-    CFRunLoopAddSource(m_runLoop, m_runLoopSource, kCFRunLoopCommonModes);
-}
-
-RunLoop::RunLoop(CFRunLoopRef runLoop)
-    : m_runLoop(runLoop)
-    , m_nestingLevel(0)
-{
-    CFRunLoopSourceContext context = { 0, this, 0, 0, 0, 0, 0, 0, 0, performWork };
-    m_runLoopSource = CFRunLoopSourceCreate(kCFAllocatorDefault, 0, &context);
-    CFRunLoopAddSource(m_runLoop, m_runLoopSource, kCFRunLoopCommonModes);
-}
-
-RunLoop::~RunLoop()
-{
-    // FIXME: Tear down the work item queue here.
-    CFRunLoopSourceInvalidate(m_runLoopSource);
-    CFRelease(m_runLoopSource);
-}
-
 void RunLoop::run()
 {
     current()->m_nestingLevel++;
@@ -106,11 +42,6 @@ void RunLoop::run()
     current()->m_nestingLevel--;
 }
 
-void RunLoop::runForDuration(double duration)
-{
-    CFRunLoopRunInMode(kCFRunLoopDefaultMode, duration, true);
-}
-
 void RunLoop::stop()
 {
     ASSERT(m_runLoop == CFRunLoopGetCurrent());
@@ -131,63 +62,4 @@ void RunLoop::stop()
         CFRunLoopStop(m_runLoop);
 }
 
-void RunLoop::wakeUp()
-{
-    CFRunLoopSourceSignal(m_runLoopSource);
-    CFRunLoopWakeUp(m_runLoop);
-}
-
-// RunLoop::Timer
-
-void RunLoop::TimerBase::timerFired(CFRunLoopTimerRef, void* context)
-{
-    TimerBase* timer = static_cast<TimerBase*>(context);
-    
-    // Wrap main thread in an Autorelease pool.  The timer can call 
-    // into objc code and accumulate memory outside of the main event loop.
-    if (current() == main()) {
-        NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init]; 
-        timer->fired();
-        [pool drain];
-    } else
-        timer->fired();
-}
-
-RunLoop::TimerBase::TimerBase(RunLoop* runLoop)
-    : m_runLoop(runLoop)
-    , m_timer(0)
-{
-}
-
-RunLoop::TimerBase::~TimerBase()
-{
-    stop();
-}
-
-void RunLoop::TimerBase::start(double nextFireInterval, bool repeat)
-{
-    if (m_timer)
-        stop();
-
-    CFRunLoopTimerContext context = { 0, this, 0, 0, 0 };
-    CFTimeInterval repeatInterval = repeat ? nextFireInterval : 0;
-    m_timer = CFRunLoopTimerCreate(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent() + nextFireInterval, repeatInterval, 0, 0, timerFired, &context);
-    CFRunLoopAddTimer(m_runLoop->m_runLoop, m_timer, kCFRunLoopCommonModes);
-}
-
-void RunLoop::TimerBase::stop()
-{
-    if (!m_timer)
-        return;
-
-    CFRunLoopTimerInvalidate(m_timer);
-    CFRelease(m_timer);
-    m_timer = 0;
-}
-
-bool RunLoop::TimerBase::isActive() const
-{
-    return m_timer && CFRunLoopTimerIsValid(m_timer);
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index edeee38d0..cd8fb9056 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -53,6 +53,12 @@ static bool supportsUIStateTransitionProgress()
     return globalSupportsUIStateTransitionProgress;
 }
 
+static bool supportsExpansionTransitionProgress()
+{
+    static bool globalSupportsExpansionTransitionProgress = [NSClassFromString(@"NSScrollerImp") instancesRespondToSelector:@selector(expansionTransitionProgress)];
+    return globalSupportsExpansionTransitionProgress;
+}
+
 static ScrollbarThemeMac* macScrollbarTheme()
 {
     ScrollbarTheme* scrollbarTheme = ScrollbarTheme::theme();
@@ -278,7 +284,8 @@ static NSSize abs(NSSize size)
 enum FeatureToAnimate {
     ThumbAlpha,
     TrackAlpha,
-    UIStateTransition
+    UIStateTransition,
+    ExpansionTransition
 };
 
 @interface WebScrollbarPartAnimation : NSAnimation
@@ -351,6 +358,9 @@ enum FeatureToAnimate {
     case UIStateTransition:
         [_scrollbarPainter.get() setUiStateTransitionProgress:currentValue];
         break;
+    case ExpansionTransition:
+        [_scrollbarPainter.get() setExpansionTransitionProgress:currentValue];
+        break;
     }
 
     _scrollbar->invalidate();
@@ -373,6 +383,7 @@ enum FeatureToAnimate {
     RetainPtr<WebScrollbarPartAnimation> _knobAlphaAnimation;
     RetainPtr<WebScrollbarPartAnimation> _trackAlphaAnimation;
     RetainPtr<WebScrollbarPartAnimation> _uiStateTransitionAnimation;
+    RetainPtr<WebScrollbarPartAnimation> _expansionTransitionAnimation;
 }
 - (id)initWithScrollbar:(WebCore::Scrollbar*)scrollbar;
 - (void)cancelAnimations;
@@ -396,6 +407,7 @@ enum FeatureToAnimate {
     [_knobAlphaAnimation.get() stopAnimation];
     [_trackAlphaAnimation.get() stopAnimation];
     [_uiStateTransitionAnimation.get() stopAnimation];
+    [_expansionTransitionAnimation.get() stopAnimation];
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
@@ -530,6 +542,36 @@ enum FeatureToAnimate {
     [_uiStateTransitionAnimation.get() startAnimation];
 }
 
+- (void)scrollerImp:(id)scrollerImp animateExpansionTransitionWithDuration:(NSTimeInterval)duration
+{
+    if (!_scrollbar)
+        return;
+
+    if (!supportsExpansionTransitionProgress())
+        return;
+
+    ASSERT(scrollerImp == scrollbarPainterForScrollbar(_scrollbar));
+
+    ScrollbarPainter scrollbarPainter = (ScrollbarPainter)scrollerImp;
+
+    // ExpansionTransition always animates to 1. In case an animation is in progress this avoids a hard transition.
+    [scrollbarPainter setExpansionTransitionProgress:1 - [scrollerImp expansionTransitionProgress]];
+
+    if (!_expansionTransitionAnimation) {
+        _expansionTransitionAnimation.adoptNS([[WebScrollbarPartAnimation alloc] initWithScrollbar:_scrollbar
+                                                                                  featureToAnimate:ExpansionTransition
+                                                                                       animateFrom:[scrollbarPainter expansionTransitionProgress]
+                                                                                         animateTo:1.0
+                                                                                          duration:duration]);
+    } else {
+        // If we don't need to initialize the animation, just reset the values in case they have changed.
+        [_expansionTransitionAnimation.get() setStartValue:[scrollbarPainter uiStateTransitionProgress]];
+        [_expansionTransitionAnimation.get() setEndValue:1.0];
+        [_expansionTransitionAnimation.get() setDuration:duration];
+    }
+    [_expansionTransitionAnimation.get() startAnimation];
+}
+
 - (void)scrollerImp:(id)scrollerImp overlayScrollerStateChangedTo:(NSUInteger)newOverlayScrollerState
 {
     UNUSED_PARAM(scrollerImp);
@@ -543,6 +585,7 @@ enum FeatureToAnimate {
     [_knobAlphaAnimation.get() invalidate];
     [_trackAlphaAnimation.get() invalidate];
     [_uiStateTransitionAnimation.get() invalidate];
+    [_expansionTransitionAnimation.get() invalidate];
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
@@ -920,6 +963,10 @@ void ScrollAnimatorMac::cancelAnimations()
 
 void ScrollAnimatorMac::handleWheelEventPhase(PlatformWheelEventPhase phase)
 {
+    // This may not have been set to true yet if the wheel event was handled by the ScrollingTree,
+    // So set it to true here.
+    m_haveScrolledSincePageLoad = true;
+
     if (phase == PlatformWheelEventPhaseBegan)
         didBeginScrollGesture();
     else if (phase == PlatformWheelEventPhaseEnded || phase == PlatformWheelEventPhaseCancelled)
diff --git a/Source/WebCore/platform/mac/ScrollElasticityController.mm b/Source/WebCore/platform/mac/ScrollElasticityController.mm
index a81784696..7a753846b 100644
--- a/Source/WebCore/platform/mac/ScrollElasticityController.mm
+++ b/Source/WebCore/platform/mac/ScrollElasticityController.mm
@@ -27,6 +27,7 @@
 #include "ScrollElasticityController.h"
 
 #include "PlatformWheelEvent.h"
+#include "WebCoreSystemInterface.h"
 #include <sys/time.h>
 #include <sys/sysctl.h>
 
@@ -67,9 +68,12 @@ static NSTimeInterval systemUptime()
 namespace WebCore {
 
 static const float scrollVelocityZeroingTimeout = 0.10f;
-static const float rubberbandStiffness = 20;
 static const float rubberbandDirectionLockStretchRatio = 1;
 static const float rubberbandMinimumRequiredDeltaBeforeStretch = 10;
+
+#if defined(BUILDING_ON_LEOPARD) || defined(BULDING_ON_SNOW_LEOPARD) || \
+    defined(BUILDING_ON_LION) || PLATFORM(CHROMIUM)
+static const float rubberbandStiffness = 20;
 static const float rubberbandAmplitude = 0.31f;
 static const float rubberbandPeriod = 1.6f;
 
@@ -92,6 +96,22 @@ static float reboundDeltaForElasticDelta(float delta)
 {
     return delta * rubberbandStiffness;
 }
+#else
+static float elasticDeltaForTimeDelta(float initialPosition, float initialVelocity, float elapsedTime)
+{
+    return wkNSElasticDeltaForTimeDelta(initialPosition, initialVelocity, elapsedTime);
+}
+
+static float elasticDeltaForReboundDelta(float delta)
+{
+    return wkNSElasticDeltaForReboundDelta(delta);
+}
+
+static float reboundDeltaForElasticDelta(float delta)
+{
+    return wkNSReboundDeltaForElasticDelta(delta);
+}
+#endif
 
 static float scrollWheelMultiplier()
 {
@@ -159,8 +179,20 @@ bool ScrollElasticityController::handleWheelEvent(const PlatformWheelEvent& whee
     // Reset overflow values because we may decide to remove delta at various points and put it into overflow.
     m_overflowScrollDelta = FloatSize();
 
-    float eventCoalescedDeltaX = -wheelEvent.deltaX();
-    float eventCoalescedDeltaY = -wheelEvent.deltaY();
+    IntSize stretchAmount = m_client->stretchAmount();
+    bool isVerticallyStretched = stretchAmount.height();
+    bool isHorizontallyStretched = stretchAmount.width();
+
+    float eventCoalescedDeltaX;
+    float eventCoalescedDeltaY;
+
+    if (isVerticallyStretched || isHorizontallyStretched) {
+        eventCoalescedDeltaX = -wheelEvent.unacceleratedScrollingDeltaX();
+        eventCoalescedDeltaY = -wheelEvent.unacceleratedScrollingDeltaY();
+    } else {
+        eventCoalescedDeltaX = -wheelEvent.deltaX();
+        eventCoalescedDeltaY = -wheelEvent.deltaY();
+    }
 
     deltaX += eventCoalescedDeltaX;
     deltaY += eventCoalescedDeltaY;
@@ -171,15 +203,8 @@ bool ScrollElasticityController::handleWheelEvent(const PlatformWheelEvent& whee
     else
         deltaY = 0;
 
-    bool isVerticallyStretched = false;
-    bool isHorizontallyStretched = false;
     bool shouldStretch = false;
 
-    IntSize stretchAmount = m_client->stretchAmount();
-
-    isHorizontallyStretched = stretchAmount.width();
-    isVerticallyStretched = stretchAmount.height();
-
     PlatformWheelEventPhase momentumPhase = wheelEvent.momentumPhase();
 
     // If we are starting momentum scrolling then do some setup.
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.h b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
index dd16fa182..908dd95a9 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -323,6 +323,10 @@ extern void (*wkFilterRelease)(WebFilterEvaluator *);
 extern BOOL (*wkFilterWasBlocked)(WebFilterEvaluator *);
 extern const char* (*wkFilterAddData)(WebFilterEvaluator *, const char* data, int* length);
 extern const char* (*wkFilterDataComplete)(WebFilterEvaluator *, int* length);
+
+extern CGFloat (*wkNSElasticDeltaForTimeDelta)(CGFloat initialPosition, CGFloat initialVelocity, CGFloat elapsedTime);
+extern CGFloat (*wkNSElasticDeltaForReboundDelta)(CGFloat delta);
+extern CGFloat (*wkNSReboundDeltaForElasticDelta)(CGFloat delta);
 #endif
 
 }
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
index 439a2f24f..c087a5d87 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -202,4 +202,9 @@ void (*wkFilterRelease)(WebFilterEvaluator *);
 BOOL (*wkFilterWasBlocked)(WebFilterEvaluator *);
 const char* (*wkFilterAddData)(WebFilterEvaluator *, const char* data, int* length);
 const char* (*wkFilterDataComplete)(WebFilterEvaluator *, int* length);
+
+CGFloat (*wkNSElasticDeltaForTimeDelta)(CGFloat initialPosition, CGFloat initialVelocity, CGFloat elapsedTime);
+CGFloat (*wkNSElasticDeltaForReboundDelta)(CGFloat delta);
+CGFloat (*wkNSReboundDeltaForElasticDelta)(CGFloat delta);
 #endif
+
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
index 8354b10c1..1e811961b 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
@@ -449,7 +449,7 @@ void NetworkJob::handleNotifyClose(int status)
         else if (isUnauthorized(m_extendedStatusCode))
             purgeCredentials();
 
-        if (shouldNotifyClientFinished()) {
+        if (shouldReleaseClientResource()) {
             if (isRedirect(m_extendedStatusCode) && (m_redirectCount >= s_redirectMaximum))
                 m_extendedStatusCode = BlackBerry::Platform::FilterStream::StatusTooManyRedirects;
 
@@ -457,7 +457,7 @@ void NetworkJob::handleNotifyClose(int status)
             if (isClientAvailable()) {
 
                 RecursionGuard guard(m_callingClient);
-                if (isError(m_extendedStatusCode) && !m_dataReceived && m_handle->firstRequest().httpMethod() != "HEAD") {
+                if (shouldNotifyClientFailed()) {
                     String domain = m_extendedStatusCode < 0 ? ResourceError::platformErrorDomain : ResourceError::httpErrorDomain;
                     ResourceError error(domain, m_extendedStatusCode, m_response.url().string(), m_response.httpStatusText());
                     m_handle->client()->didFail(m_handle.get(), error);
@@ -476,7 +476,7 @@ void NetworkJob::handleNotifyClose(int status)
     m_multipartResponse = nullptr;
 }
 
-bool NetworkJob::shouldNotifyClientFinished()
+bool NetworkJob::shouldReleaseClientResource()
 {
     if (m_redirectCount >= s_redirectMaximum)
         return true;
@@ -490,6 +490,13 @@ bool NetworkJob::shouldNotifyClientFinished()
     return true;
 }
 
+bool NetworkJob::shouldNotifyClientFailed() const
+{
+    if (m_handle->firstRequest().targetType() == ResourceRequest::TargetIsXHR)
+        return m_extendedStatusCode < 0;
+    return isError(m_extendedStatusCode) && !m_dataReceived;
+}
+
 bool NetworkJob::retryAsFTPDirectory()
 {
     m_needsRetryAsFTPDirectory = false;
@@ -574,7 +581,7 @@ void NetworkJob::sendResponseIfNeeded()
 
     m_responseSent = true;
 
-    if (isError(m_extendedStatusCode) && !m_dataReceived)
+    if (shouldNotifyClientFailed())
         return;
 
     String urlFilename;
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.h b/Source/WebCore/platform/network/blackberry/NetworkJob.h
index 2bb557960..11bd2aa59 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.h
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.h
@@ -95,7 +95,8 @@ private:
 
     bool shouldSendClientData() const;
 
-    bool shouldNotifyClientFinished();
+    bool shouldReleaseClientResource();
+    bool shouldNotifyClientFailed() const;
 
     bool shouldDeferLoading() const
     {
@@ -133,7 +134,7 @@ private:
 
     void purgeCredentials();
 
-    bool isError(int statusCode)
+    bool isError(int statusCode) const
     {
         return statusCode < 0 || (400 <= statusCode && statusCode < 600);
     }
diff --git a/Source/WebCore/platform/network/blackberry/ResourceRequest.h b/Source/WebCore/platform/network/blackberry/ResourceRequest.h
index 964c35c74..fdd9db28a 100644
--- a/Source/WebCore/platform/network/blackberry/ResourceRequest.h
+++ b/Source/WebCore/platform/network/blackberry/ResourceRequest.h
@@ -45,7 +45,6 @@ public:
         TargetIsWorker,
         TargetIsSharedWorker,
         TargetIsPrefetch,
-        TargetIsPrerender,
         TargetIsFavicon,
         TargetIsXHR,
         TargetIsTextTrack,
diff --git a/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp b/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp
index 5844f3db8..5cffde039 100644
--- a/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp
+++ b/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp
@@ -86,8 +86,6 @@ static inline NetworkRequest::TargetType platformTargetTypeForRequest(const Reso
         return NetworkRequest::TargetIsImage;
     case ResourceRequest::TargetIsPrefetch:
         return NetworkRequest::TargetIsSubresource;
-    case ResourceRequest::TargetIsPrerender:
-        return NetworkRequest::TargetIsSubresource;
     case ResourceRequest::TargetIsXHR:
         return NetworkRequest::TargetIsSubresource;
     case ResourceRequest::TargetIsTextTrack:
diff --git a/Source/WebCore/platform/network/chromium/ResourceRequest.h b/Source/WebCore/platform/network/chromium/ResourceRequest.h
index fce1ebfd0..7ea61a888 100644
--- a/Source/WebCore/platform/network/chromium/ResourceRequest.h
+++ b/Source/WebCore/platform/network/chromium/ResourceRequest.h
@@ -53,7 +53,6 @@ namespace WebCore {
             TargetIsWorker,
             TargetIsSharedWorker,
             TargetIsPrefetch,
-            TargetIsPrerender,
             TargetIsFavicon,
             TargetIsXHR,
             TargetIsTextTrack,
diff --git a/Source/WebCore/platform/network/chromium/ResourceResponse.h b/Source/WebCore/platform/network/chromium/ResourceResponse.h
index 997cd71dd..261c5745d 100644
--- a/Source/WebCore/platform/network/chromium/ResourceResponse.h
+++ b/Source/WebCore/platform/network/chromium/ResourceResponse.h
@@ -36,13 +36,17 @@ namespace WebCore {
 
     class ResourceResponse : public ResourceResponseBase {
     public:
+        // FIXME: move this to ResourceResponseBase and implement for all ports (see history in http://webkit.org/b/86522).
+        enum HTTPVersion { Unknown, HTTP_0_9, HTTP_1_0, HTTP_1_1 };
+
         class ExtraData : public RefCounted<ExtraData> {
         public:
             virtual ~ExtraData() { }
         };
 
         ResourceResponse()
-            : m_appCacheID(0)
+            : m_httpVersion(Unknown)
+            , m_appCacheID(0)
             , m_isMultipartPayload(false)
             , m_wasFetchedViaSPDY(false)
             , m_wasNpnNegotiated(false)
@@ -55,6 +59,7 @@ namespace WebCore {
 
         ResourceResponse(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename)
             : ResourceResponseBase(url, mimeType, expectedLength, textEncodingName, filename)
+            , m_httpVersion(Unknown)
             , m_appCacheID(0)
             , m_isMultipartPayload(false)
             , m_wasFetchedViaSPDY(false)
@@ -66,6 +71,9 @@ namespace WebCore {
         {
         }
 
+        HTTPVersion httpVersion() const { return m_httpVersion; }
+        void setHTTPVersion(HTTPVersion version) { m_httpVersion = version; }
+
         const CString& getSecurityInfo() const { return m_securityInfo; }
         void setSecurityInfo(const CString& securityInfo) { m_securityInfo = securityInfo; }
 
@@ -128,6 +136,9 @@ namespace WebCore {
         PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData>) const;
         void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>);
 
+        // HTTP version used in the response, if known.
+        HTTPVersion m_httpVersion;
+
         // The id of the appcache this response was retrieved from, or zero if
         // the response was not retrieved from an appcache.
         long long m_appCacheID;
diff --git a/Source/WebCore/platform/network/curl/ResourceHandleManager.cpp b/Source/WebCore/platform/network/curl/ResourceHandleManager.cpp
index f0fd403f8..af075ef9e 100644
--- a/Source/WebCore/platform/network/curl/ResourceHandleManager.cpp
+++ b/Source/WebCore/platform/network/curl/ResourceHandleManager.cpp
@@ -426,7 +426,7 @@ void ResourceHandleManager::setProxyInfo(const String& host,
     m_proxyType = type;
 
     if (!host.length()) {
-        m_proxy = String("");
+        m_proxy = emptyString();
     } else {
         String userPass;
         if (username.length() || password.length())
diff --git a/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h b/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
index 4b8252c63..44784b3d4 100644
--- a/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
+++ b/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
@@ -21,6 +21,7 @@
 #define NetworkStateNotifierPrivate_h
 
 #include <QObject>
+#include <wtf/OwnPtr.h>
 
 QT_BEGIN_NAMESPACE
 class QNetworkConfigurationManager;
@@ -35,12 +36,18 @@ class NetworkStateNotifierPrivate : public QObject {
 public:
     NetworkStateNotifierPrivate(NetworkStateNotifier* notifier);
     ~NetworkStateNotifierPrivate();
+
+    void setNetworkAccessAllowed(bool);
+    bool effectivelyOnline() const { return m_online && m_networkAccessAllowed; }
+
 public slots:
-    void onlineStateChanged(bool);
-    void networkAccessPermissionChanged(bool);
+    void setOnlineState(bool);
+
+private slots:
+    void initialize();
 
 public:
-    QNetworkConfigurationManager* m_configurationManager;
+    OwnPtr<QNetworkConfigurationManager> m_configurationManager;
     bool m_online;
     bool m_networkAccessAllowed;
     NetworkStateNotifier* m_notifier;
diff --git a/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp b/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
index a356b713b..88de3c6bf 100644
--- a/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
+++ b/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
@@ -23,51 +23,62 @@
 #if (PLATFORM(QT) && !defined(QT_NO_BEARERMANAGEMENT))
 
 #include "NetworkStateNotifierPrivate.h"
-#include "qnetworkconfigmanager.h"
+#include <QNetworkConfigurationManager>
+#include <QTimer>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
 NetworkStateNotifierPrivate::NetworkStateNotifierPrivate(NetworkStateNotifier* notifier)
-    : m_configurationManager(new QNetworkConfigurationManager())
-    , m_online(m_configurationManager->isOnline())
+    : m_online(false)
     , m_networkAccessAllowed(true)
     , m_notifier(notifier)
 {
-    Q_ASSERT(notifier);
-    connect(m_configurationManager, SIGNAL(onlineStateChanged(bool)), this, SLOT(onlineStateChanged(bool)));
+    ASSERT(notifier);
+
+    // Initialization is delayed because QNetworkConfigurationManager starts a new thread that causes
+    // deadlock on Mac because all the static initializers share the same lock. Both NetworkStateNotifier and Qt internals
+    // triggered in new thread use static initializer. See also: http://openradar.appspot.com/11217150.
+    QTimer::singleShot(0, this, SLOT(initialize()));
 }
 
-void NetworkStateNotifierPrivate::onlineStateChanged(bool isOnline)
+void NetworkStateNotifierPrivate::setNetworkAccessAllowed(bool isAllowed)
 {
-    if (m_online == isOnline)
+    if (isAllowed == m_networkAccessAllowed)
         return;
 
-    m_online = isOnline;
-    if (m_networkAccessAllowed)
+    m_networkAccessAllowed = isAllowed;
+    if (m_online)
         m_notifier->updateState();
 }
 
-void NetworkStateNotifierPrivate::networkAccessPermissionChanged(bool isAllowed)
+void NetworkStateNotifierPrivate::setOnlineState(bool isOnline)
 {
-    if (isAllowed == m_networkAccessAllowed)
+    if (m_online == isOnline)
         return;
 
-    m_networkAccessAllowed = isAllowed;
-    if (m_online)
+    m_online = isOnline;
+    if (m_networkAccessAllowed)
         m_notifier->updateState();
 }
 
+void NetworkStateNotifierPrivate::initialize()
+{
+    m_configurationManager = adoptPtr(new QNetworkConfigurationManager());
+    setOnlineState(m_configurationManager->isOnline());
+    connect(m_configurationManager.get(), SIGNAL(onlineStateChanged(bool)), this, SLOT(setOnlineState(bool)));
+}
+
 NetworkStateNotifierPrivate::~NetworkStateNotifierPrivate()
 {
-    delete m_configurationManager;
 }
 
 void NetworkStateNotifier::updateState()
 {
-    if (m_isOnLine == (p->m_online && p->m_networkAccessAllowed))
+    if (m_isOnLine == p->effectivelyOnline())
         return;
 
-    m_isOnLine = p->m_online && p->m_networkAccessAllowed;
+    m_isOnLine = p->effectivelyOnline();
     if (m_networkStateChangedFunction)
         m_networkStateChangedFunction();
 }
@@ -77,12 +88,12 @@ NetworkStateNotifier::NetworkStateNotifier()
     , m_networkStateChangedFunction(0)
 {
     p = new NetworkStateNotifierPrivate(this);
-    m_isOnLine = p->m_online && p->m_networkAccessAllowed;
+    m_isOnLine = p->effectivelyOnline();
 }
 
 void NetworkStateNotifier::setNetworkAccessAllowed(bool isAllowed)
 {
-    p->networkAccessPermissionChanged(isAllowed);
+    p->setNetworkAccessAllowed(isAllowed);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index d30ffce92..116acb2d4 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -420,6 +420,10 @@ QNetworkReply* QNetworkReplyHandler::release()
 
 static bool shouldIgnoreHttpError(QNetworkReply* reply, bool receivedData)
 {
+    // An HEAD XmlHTTPRequest shouldn't be marked as failure for HTTP errors.
+    if (reply->operation() == QNetworkAccessManager::HeadOperation)
+        return true;
+
     int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
     if (httpStatusCode == 401 || httpStatusCode == 407)
diff --git a/Source/WebCore/platform/qt/RunLoopQt.cpp b/Source/WebCore/platform/qt/RunLoopQt.cpp
index 28ab67bde..2a87e2fc8 100644
--- a/Source/WebCore/platform/qt/RunLoopQt.cpp
+++ b/Source/WebCore/platform/qt/RunLoopQt.cpp
@@ -39,30 +39,13 @@ namespace WebCore {
 class RunLoop::TimerObject : public QObject {
     Q_OBJECT
 public:
-    TimerObject(RunLoop* runLoop)
-        : m_runLoop(runLoop)
-        , m_pendingPerformWorkInvocations(0)
+    TimerObject(RunLoop* runLoop) : m_runLoop(runLoop)
     {
         int methodIndex = metaObject()->indexOfMethod("performWork()");
         m_method = metaObject()->method(methodIndex);
     }
 
-    Q_SLOT void performWork() {
-        // It may happen that a secondary thread adds more method invocations via
-        // RunLoop::dispatch(), which will schedule a call to this function. If during
-        // performWork() event loop messages get processed, it may happen that this
-        // function is called again. In this case we should protected ourselves against
-        // recursive - and thus out-of-order - message dispatching and instead perform
-        // the work serially.
-        m_pendingPerformWorkInvocations++;
-        if (m_pendingPerformWorkInvocations > 1)
-            return;
-
-        while (m_pendingPerformWorkInvocations) {
-            m_runLoop->performWork();
-            m_pendingPerformWorkInvocations--;
-        }
-    }
+    Q_SLOT void performWork() { m_runLoop->performWork(); }
     inline void wakeUp() { m_method.invoke(this, Qt::QueuedConnection); }
 
 protected:
@@ -74,7 +57,6 @@ protected:
 private:
     RunLoop* m_runLoop;
     QMetaMethod m_method;
-    int m_pendingPerformWorkInvocations;
 };
 
 static QEventLoop* currentEventLoop;
diff --git a/Source/WebCore/platform/text/LocaleICU.cpp b/Source/WebCore/platform/text/LocaleICU.cpp
index f27c4e014..56d6a7760 100644
--- a/Source/WebCore/platform/text/LocaleICU.cpp
+++ b/Source/WebCore/platform/text/LocaleICU.cpp
@@ -371,7 +371,7 @@ void LocaleICU::initializeLocalizedDateFormatText()
 {
     if (!m_localizedDateFormatText.isNull())
         return;
-    m_localizedDateFormatText = String("");
+    m_localizedDateFormatText = emptyString();
     if (!initializeShortDateFormat())
         return;
     UErrorCode status = U_ZERO_ERROR;
diff --git a/Source/WebCore/platform/text/TextCheckerClient.h b/Source/WebCore/platform/text/TextCheckerClient.h
index 6b0fa8053..eb95bd1de 100644
--- a/Source/WebCore/platform/text/TextCheckerClient.h
+++ b/Source/WebCore/platform/text/TextCheckerClient.h
@@ -58,6 +58,7 @@ class TextCheckerClient {
 public:
     virtual ~TextCheckerClient() {}
 
+    virtual bool shouldEraseMarkersAfterChangeSelection(TextCheckingType) const = 0;
     virtual void ignoreWordInSpellDocument(const String&) = 0;
     virtual void learnWord(const String&) = 0;
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength) = 0;
diff --git a/Source/WebCore/platform/win/DragImageCairoWin.cpp b/Source/WebCore/platform/win/DragImageCairoWin.cpp
index f65211f80..a2aa975c6 100644
--- a/Source/WebCore/platform/win/DragImageCairoWin.cpp
+++ b/Source/WebCore/platform/win/DragImageCairoWin.cpp
@@ -31,6 +31,7 @@
 #include "GraphicsContext.h"
 #include "GraphicsContextPlatformPrivateCairo.h"
 #include "Image.h"
+#include "NativeImageCairo.h"
 #include <wtf/RetainPtr.h>
 #include <cairo-win32.h>
 #include <windows.h>
@@ -172,7 +173,7 @@ DragImageRef createDragImageFromImage(Image* img, RespectImageOrientationEnum)
     cairo_set_source_rgb(cr, 1.0, 0.0, 1.0);
     cairo_fill_preserve(cr);
 
-    cairo_surface_t* srcImage = img->nativeImageForCurrentFrame();
+    cairo_surface_t* srcImage = img->nativeImageForCurrentFrame()->surface();
 
     // Draw the image.
     cairo_set_source_surface(cr, srcImage, 0.0, 0.0);
diff --git a/Source/WebCore/platform/wx/PasteboardWx.cpp b/Source/WebCore/platform/wx/PasteboardWx.cpp
index 49936646c..2bd7177f8 100644
--- a/Source/WebCore/platform/wx/PasteboardWx.cpp
+++ b/Source/WebCore/platform/wx/PasteboardWx.cpp
@@ -74,7 +74,15 @@ bool Pasteboard::canSmartReplace()
 
 String Pasteboard::plainText(Frame* frame)
 {
-    notImplemented();
+    if (wxTheClipboard->Open()) {
+        if (wxTheClipboard->IsSupported(wxDF_TEXT)) {
+            wxTextDataObject data;
+            wxTheClipboard->GetData(data);
+            wxTheClipboard->Close();
+            return data.GetText();
+        }
+    }
+    
     return String();
 }
 
diff --git a/Source/WebCore/plugins/PluginData.h b/Source/WebCore/plugins/PluginData.h
index c6cde81ba..150273904 100644
--- a/Source/WebCore/plugins/PluginData.h
+++ b/Source/WebCore/plugins/PluginData.h
@@ -33,6 +33,16 @@ struct MimeClassInfo {
     String type;
     String desc;
     Vector<String> extensions;
+
+    MimeClassInfo isolatedCopy() const
+    {
+        MimeClassInfo clone;
+        clone.type = type.isolatedCopy();
+        clone.desc = desc.isolatedCopy();
+        for (unsigned i = 0; i < extensions.size(); ++i)
+            clone.extensions.append(extensions[i].isolatedCopy());
+        return clone;
+    }
 };
 
 inline bool operator==(const MimeClassInfo& a, const MimeClassInfo& b)
@@ -45,6 +55,17 @@ struct PluginInfo {
     String file;
     String desc;
     Vector<MimeClassInfo> mimes;
+
+    PluginInfo isolatedCopy() const
+    {
+        PluginInfo clone;
+        clone.name = name.isolatedCopy();
+        clone.file = file.isolatedCopy();
+        clone.desc = desc.isolatedCopy();
+        for (unsigned i = 0; i < mimes.size(); ++i)
+            clone.mimes.append(mimes[i].isolatedCopy());
+        return clone;
+    }
 };
 
 // FIXME: merge with PluginDatabase in the future
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index 6bafe0122..323c55156 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -84,7 +84,7 @@
 #if HAVE(QT5)
 #include "QtX11ImageConversion.h"
 #include <QGuiApplication>
-#include <QPlatformNativeInterface>
+#include <qpa/qplatformnativeinterface.h>
 #include <QWindow>
 #else
 #include "PluginContainerQt.h"
diff --git a/Source/WebCore/rendering/EllipsisBox.cpp b/Source/WebCore/rendering/EllipsisBox.cpp
index 5969a3222..8254784f5 100644
--- a/Source/WebCore/rendering/EllipsisBox.cpp
+++ b/Source/WebCore/rendering/EllipsisBox.cpp
@@ -23,6 +23,7 @@
 #include "Document.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
+#include "InlineTextBox.h"
 #include "PaintInfo.h"
 #include "RenderBlock.h"
 #include "RootInlineBox.h"
@@ -96,10 +97,11 @@ void EllipsisBox::paintSelection(GraphicsContext* context, const LayoutPoint& pa
     GraphicsContextStateSaver stateSaver(*context);
     LayoutUnit top = root()->selectionTop();
     LayoutUnit h = root()->selectionHeight();
-    // FIXME: We'll need to apply the correct clip rounding here: https://bugs.webkit.org/show_bug.cgi?id=63656
-    context->clip(IntRect(x() + paintOffset.x(), top + paintOffset.y(), m_logicalWidth, h));
+    LayoutRect clipRect(x() + paintOffset.x(), top + paintOffset.y(), m_logicalWidth, h);
+    alignSelectionRectToDevicePixels(clipRect);
+    context->clip(clipRect);
     // FIXME: Why is this always LTR? Fix by passing correct text run flags below.
-    context->drawHighlightForText(font, RenderBlock::constructTextRun(renderer(), font, m_str, style, TextRun::AllowTrailingExpansion), IntPoint(x() + paintOffset.x(), y() + paintOffset.y() + top), h, c, style->colorSpace());
+    context->drawHighlightForText(font, RenderBlock::constructTextRun(renderer(), font, m_str, style, TextRun::AllowTrailingExpansion), roundedIntPoint(LayoutPoint(x() + paintOffset.x(), y() + paintOffset.y() + top)), h, c, style->colorSpace());
 }
 
 bool EllipsisBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom)
diff --git a/Source/WebCore/rendering/HitTestResult.cpp b/Source/WebCore/rendering/HitTestResult.cpp
index c19f1222f..66e1da96b 100644
--- a/Source/WebCore/rendering/HitTestResult.cpp
+++ b/Source/WebCore/rendering/HitTestResult.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2008, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -47,53 +48,109 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HitTestResult::HitTestResult()
-    : m_isOverWidget(false)
-    , m_isRectBased(false)
-    , m_topPadding(0)
+HitTestPoint::HitTestPoint()
+    : m_topPadding(0)
     , m_rightPadding(0)
     , m_bottomPadding(0)
     , m_leftPadding(0)
-    , m_shadowContentFilterPolicy(DoNotAllowShadowContent)
-    , m_region(0)
+    , m_isRectBased(false)
 {
 }
 
-HitTestResult::HitTestResult(const LayoutPoint& point)
+HitTestPoint::HitTestPoint(const LayoutPoint& point)
     : m_point(point)
-    , m_isOverWidget(false)
-    , m_isRectBased(false)
     , m_topPadding(0)
     , m_rightPadding(0)
     , m_bottomPadding(0)
     , m_leftPadding(0)
-    , m_shadowContentFilterPolicy(DoNotAllowShadowContent)
-    , m_region(0)
+    , m_isRectBased(false)
 {
 }
 
-HitTestResult::HitTestResult(const LayoutPoint& centerPoint, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding, ShadowContentFilterPolicy allowShadowContent)
+HitTestPoint::HitTestPoint(const LayoutPoint& centerPoint, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
     : m_point(centerPoint)
-    , m_isOverWidget(false)
     , m_topPadding(topPadding)
     , m_rightPadding(rightPadding)
     , m_bottomPadding(bottomPadding)
     , m_leftPadding(leftPadding)
-    , m_shadowContentFilterPolicy(allowShadowContent)
-    , m_region(0)
 {
     // If all padding values passed in are zero then it is not a rect based hit test.
     m_isRectBased = topPadding || rightPadding || bottomPadding || leftPadding;
+}
+
+HitTestPoint::HitTestPoint(const HitTestPoint& other)
+    : m_point(other.m_point)
+    , m_topPadding(other.m_topPadding)
+    , m_rightPadding(other.m_rightPadding)
+    , m_bottomPadding(other.m_bottomPadding)
+    , m_leftPadding(other.m_leftPadding)
+    , m_isRectBased(other.m_isRectBased)
+{
+}
+
+HitTestPoint::~HitTestPoint()
+{
+}
+
+HitTestPoint& HitTestPoint::operator=(const HitTestPoint& other)
+{
+    m_point = other.m_point;
+    m_topPadding = other.m_topPadding;
+    m_rightPadding = other.m_rightPadding;
+    m_bottomPadding = other.m_bottomPadding;
+    m_leftPadding = other.m_leftPadding;
+    m_isRectBased = other.m_isRectBased;
+
+    return *this;
+}
+
+IntRect HitTestPoint::rectForPoint(const LayoutPoint& point, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
+{
+    IntPoint actualPoint(roundedIntPoint(point));
+    actualPoint -= IntSize(leftPadding, topPadding);
+
+    IntSize actualPadding(leftPadding + rightPadding, topPadding + bottomPadding);
+    // As IntRect is left inclusive and right exclusive (seeing IntRect::contains(x, y)), adding "1".
+    // FIXME: Remove this once non-rect based hit-detection stops using IntRect:intersects.
+    actualPadding += IntSize(1, 1);
+
+    return IntRect(actualPoint, actualPadding);
+}
 
-    // Make sure all padding values are clamped to zero if it is not a rect hit test.
-    if (!m_isRectBased)
-        m_topPadding = m_rightPadding = m_bottomPadding = m_leftPadding = 0;
+HitTestResult::HitTestResult() : HitTestPoint()
+    , m_isOverWidget(false)
+    , m_shadowContentFilterPolicy(DoNotAllowShadowContent)
+    , m_region(0)
+{
+}
+
+HitTestResult::HitTestResult(const LayoutPoint& point) : HitTestPoint(point)
+    , m_isOverWidget(false)
+    , m_shadowContentFilterPolicy(DoNotAllowShadowContent)
+    , m_region(0)
+{
+}
+
+HitTestResult::HitTestResult(const LayoutPoint& centerPoint, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding, ShadowContentFilterPolicy allowShadowContent)
+    : HitTestPoint(centerPoint, topPadding, rightPadding, bottomPadding, leftPadding)
+    , m_isOverWidget(false)
+    , m_shadowContentFilterPolicy(allowShadowContent)
+    , m_region(0)
+{
+}
+
+HitTestResult::HitTestResult(const HitTestPoint& other, ShadowContentFilterPolicy allowShadowContent)
+    : HitTestPoint(other)
+    , m_isOverWidget(false)
+    , m_shadowContentFilterPolicy(allowShadowContent)
+    , m_region(0)
+{
 }
 
 HitTestResult::HitTestResult(const HitTestResult& other)
-    : m_innerNode(other.innerNode())
+    : HitTestPoint(other)
+    , m_innerNode(other.innerNode())
     , m_innerNonSharedNode(other.innerNonSharedNode())
-    , m_point(other.point())
     , m_localPoint(other.localPoint())
     , m_innerURLElement(other.URLElement())
     , m_scrollbar(other.scrollbar())
@@ -101,16 +158,7 @@ HitTestResult::HitTestResult(const HitTestResult& other)
     , m_shadowContentFilterPolicy(other.shadowContentFilterPolicy())
     , m_region(other.region())
 {
-    // Only copy the padding and NodeSet in case of rect hit test.
-    // Copying the later is rather expensive.
-    if ((m_isRectBased = other.isRectBasedTest())) {
-        m_topPadding = other.m_topPadding;
-        m_rightPadding = other.m_rightPadding;
-        m_bottomPadding = other.m_bottomPadding;
-        m_leftPadding = other.m_leftPadding;
-    } else
-        m_topPadding = m_rightPadding = m_bottomPadding = m_leftPadding = 0;
-
+    // Only copy the NodeSet in case of rect hit test.
     m_rectBasedTestResult = adoptPtr(other.m_rectBasedTestResult ? new NodeSet(*other.m_rectBasedTestResult) : 0);
 }
 
@@ -120,25 +168,17 @@ HitTestResult::~HitTestResult()
 
 HitTestResult& HitTestResult::operator=(const HitTestResult& other)
 {
+    HitTestPoint::operator=(other);
     m_innerNode = other.innerNode();
     m_innerNonSharedNode = other.innerNonSharedNode();
-    m_point = other.point();
     m_localPoint = other.localPoint();
     m_innerURLElement = other.URLElement();
     m_scrollbar = other.scrollbar();
     m_isOverWidget = other.isOverWidget();
-    // Only copy the padding and NodeSet in case of rect hit test.
-    // Copying the later is rather expensive.
-    if ((m_isRectBased = other.isRectBasedTest())) {
-        m_topPadding = other.m_topPadding;
-        m_rightPadding = other.m_rightPadding;
-        m_bottomPadding = other.m_bottomPadding;
-        m_leftPadding = other.m_leftPadding;
-    } else
-        m_topPadding = m_rightPadding = m_bottomPadding = m_leftPadding = 0;
 
+    // Only copy the NodeSet in case of rect hit test.
     m_rectBasedTestResult = adoptPtr(other.m_rectBasedTestResult ? new NodeSet(*other.m_rectBasedTestResult) : 0);
-    m_shadowContentFilterPolicy = other.shadowContentFilterPolicy();
+    m_shadowContentFilterPolicy  = other.shadowContentFilterPolicy();
 
     m_region = other.m_region;
 
@@ -198,7 +238,7 @@ bool HitTestResult::isSelected() const
     if (!frame)
         return false;
 
-    return frame->selection()->contains(m_point);
+    return frame->selection()->contains(point());
 }
 
 String HitTestResult::spellingToolTip(TextDirection& dir) const
@@ -209,7 +249,7 @@ String HitTestResult::spellingToolTip(TextDirection& dir) const
     if (!m_innerNonSharedNode)
         return String();
     
-    DocumentMarker* marker = m_innerNonSharedNode->document()->markers()->markerContainingPoint(m_point, DocumentMarker::Grammar);
+    DocumentMarker* marker = m_innerNonSharedNode->document()->markers()->markerContainingPoint(point(), DocumentMarker::Grammar);
     if (!marker)
         return String();
 
@@ -225,7 +265,7 @@ String HitTestResult::replacedString() const
     if (!m_innerNonSharedNode)
         return String();
     
-    DocumentMarker* marker = m_innerNonSharedNode->document()->markers()->markerContainingPoint(m_point, DocumentMarker::Replacement);
+    DocumentMarker* marker = m_innerNonSharedNode->document()->markers()->markerContainingPoint(point(), DocumentMarker::Replacement);
     if (!marker)
         return String();
     
@@ -652,18 +692,6 @@ void HitTestResult::append(const HitTestResult& other)
     }
 }
 
-IntRect HitTestResult::rectForPoint(const LayoutPoint& point, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
-{
-    IntPoint actualPoint(roundedIntPoint(point));
-    actualPoint -= IntSize(leftPadding, topPadding);
-
-    IntSize actualPadding(leftPadding + rightPadding, topPadding + bottomPadding);
-    // As IntRect is left inclusive and right exclusive (seeing IntRect::contains(x, y)), adding "1".
-    actualPadding += IntSize(1, 1);
-
-    return IntRect(actualPoint, actualPadding);
-}
-
 const HitTestResult::NodeSet& HitTestResult::rectBasedTestResult() const
 {
     if (!m_rectBasedTestResult)
diff --git a/Source/WebCore/rendering/HitTestResult.h b/Source/WebCore/rendering/HitTestResult.h
index e919472b2..a18fdb5a2 100644
--- a/Source/WebCore/rendering/HitTestResult.h
+++ b/Source/WebCore/rendering/HitTestResult.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,6 +23,7 @@
 #define HitTestResult_h
 
 #include "FloatRect.h"
+#include "HitTestRequest.h"
 #include "LayoutTypes.h"
 #include "TextDirection.h"
 #include <wtf/Forward.h>
@@ -44,7 +46,42 @@ class Scrollbar;
 
 enum ShadowContentFilterPolicy { DoNotAllowShadowContent, AllowShadowContent };
 
-class HitTestResult {
+class HitTestPoint {
+public:
+
+    HitTestPoint();
+    HitTestPoint(const LayoutPoint&);
+    // Pass non-negative padding values to perform a rect-based hit test.
+    HitTestPoint(const LayoutPoint& centerPoint, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding);
+    HitTestPoint(const HitTestPoint&);
+    ~HitTestPoint();
+    HitTestPoint& operator=(const HitTestPoint&);
+
+    LayoutPoint point() const { return m_point; }
+    IntPoint roundedPoint() const { return roundedIntPoint(m_point); }
+
+    void setPoint(const LayoutPoint& p) { m_point = p; }
+
+    // Rect-based hit test related methods.
+    bool isRectBasedTest() const { return m_isRectBased; }
+    IntRect rectForPoint(const LayoutPoint&) const;
+    static IntRect rectForPoint(const LayoutPoint&, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding);
+    int topPadding() const { return m_topPadding; }
+    int rightPadding() const { return m_rightPadding; }
+    int bottomPadding() const { return m_bottomPadding; }
+    int leftPadding() const { return m_leftPadding; }
+
+private:
+    LayoutPoint m_point;
+
+    int m_topPadding;
+    int m_rightPadding;
+    int m_bottomPadding;
+    int m_leftPadding;
+    bool m_isRectBased;
+};
+
+class HitTestResult : public HitTestPoint {
 public:
     typedef ListHashSet<RefPtr<Node> > NodeSet;
 
@@ -52,14 +89,13 @@ public:
     HitTestResult(const LayoutPoint&);
     // Pass non-negative padding values to perform a rect-based hit test.
     HitTestResult(const LayoutPoint& centerPoint, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding, ShadowContentFilterPolicy);
+    HitTestResult(const HitTestPoint&, ShadowContentFilterPolicy);
     HitTestResult(const HitTestResult&);
     ~HitTestResult();
     HitTestResult& operator=(const HitTestResult&);
 
     Node* innerNode() const { return m_innerNode.get(); }
     Node* innerNonSharedNode() const { return m_innerNonSharedNode.get(); }
-    LayoutPoint point() const { return m_point; }
-    IntPoint roundedPoint() const { return roundedIntPoint(m_point); }
     LayoutPoint localPoint() const { return m_localPoint; }
     Element* URLElement() const { return m_innerURLElement.get(); }
     Scrollbar* scrollbar() const { return m_scrollbar.get(); }
@@ -70,11 +106,11 @@ public:
 
     void setToNonShadowAncestor();
 
+    const HitTestPoint& hitTestPoint() const { return *this; }
     ShadowContentFilterPolicy shadowContentFilterPolicy() const { return m_shadowContentFilterPolicy; }
 
     void setInnerNode(Node*);
     void setInnerNonSharedNode(Node*);
-    void setPoint(const LayoutPoint& p) { m_point = p; }
     void setLocalPoint(const LayoutPoint& p) { m_localPoint = p; }
     void setURLElement(Element*);
     void setScrollbar(Scrollbar*);
@@ -110,15 +146,6 @@ public:
     bool mediaMuted() const;
     void toggleMediaMuteState() const;
 
-    // Rect-based hit test related methods.
-    bool isRectBasedTest() const { return m_isRectBased; }
-    IntRect rectForPoint(const LayoutPoint&) const;
-    static IntRect rectForPoint(const LayoutPoint&, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding);
-    int topPadding() const { return m_topPadding; }
-    int rightPadding() const { return m_rightPadding; }
-    int bottomPadding() const { return m_bottomPadding; }
-    int leftPadding() const { return m_leftPadding; }
-
     // Returns true if it is rect-based hit test and needs to continue until the rect is fully
     // enclosed by the boundaries of a node.
     bool addNodeToRectBasedTestResult(Node*, const LayoutPoint& pointInContainer, const IntRect& = IntRect());
@@ -139,19 +166,14 @@ private:
 
     RefPtr<Node> m_innerNode;
     RefPtr<Node> m_innerNonSharedNode;
-    LayoutPoint m_point;
     LayoutPoint m_localPoint; // A point in the local coordinate space of m_innerNonSharedNode's renderer. Allows us to efficiently
                               // determine where inside the renderer we hit on subsequent operations.
     RefPtr<Element> m_innerURLElement;
     RefPtr<Scrollbar> m_scrollbar;
     bool m_isOverWidget; // Returns true if we are over a widget (and not in the border/padding area of a RenderWidget for example).
-    bool m_isRectBased;
-    int m_topPadding;
-    int m_rightPadding;
-    int m_bottomPadding;
-    int m_leftPadding;
+
     ShadowContentFilterPolicy m_shadowContentFilterPolicy;
-    
+
     RenderRegion* m_region; // The region we're inside.
 
     mutable OwnPtr<NodeSet> m_rectBasedTestResult;
@@ -162,7 +184,7 @@ private:
 // y = p.y() - topPadding
 // width = leftPadding + rightPadding + 1
 // height = topPadding + bottomPadding + 1
-inline IntRect HitTestResult::rectForPoint(const LayoutPoint& point) const
+inline IntRect HitTestPoint::rectForPoint(const LayoutPoint& point) const
 {
     return rectForPoint(point, m_topPadding, m_rightPadding, m_bottomPadding, m_leftPadding);
 }
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index cbd685d69..58c97dd69 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -517,8 +517,8 @@ void InlineFlowBox::computeLogicalBoxHeights(RootInlineBox* rootBox, LayoutUnit&
     
     if (isRootInlineBox()) {
         // Examine our root box.
-        LayoutUnit ascent = 0;
-        LayoutUnit descent = 0;
+        int ascent = 0;
+        int descent = 0;
         rootBox->ascentAndDescentForBox(rootBox, textBoxDataMap, ascent, descent, affectsAscent, affectsDescent);
         if (strictMode || hasTextChildren() || (!checkChildren && hasTextDescendants())) {
             if (maxAscent < ascent || !setMaxAscent) {
@@ -549,8 +549,8 @@ void InlineFlowBox::computeLogicalBoxHeights(RootInlineBox* rootBox, LayoutUnit&
         // root box's baseline, and it is positive if the child box's baseline is below the root box's baseline.
         curr->setLogicalTop(rootBox->verticalPositionForBox(curr, verticalPositionCache));
         
-        LayoutUnit ascent = 0;
-        LayoutUnit descent = 0;
+        int ascent = 0;
+        int descent = 0;
         rootBox->ascentAndDescentForBox(curr, textBoxDataMap, ascent, descent, affectsAscent, affectsDescent);
 
         LayoutUnit boxHeight = ascent + descent;
diff --git a/Source/WebCore/rendering/InlineTextBox.cpp b/Source/WebCore/rendering/InlineTextBox.cpp
index 9550edb59..aafecbf6e 100644
--- a/Source/WebCore/rendering/InlineTextBox.cpp
+++ b/Source/WebCore/rendering/InlineTextBox.cpp
@@ -807,6 +807,22 @@ void InlineTextBox::selectionStartEnd(int& sPos, int& ePos)
     ePos = min(endPos - m_start, (int)m_len);
 }
 
+void alignSelectionRectToDevicePixels(LayoutRect& rect)
+{
+    LayoutUnit maxX = floorToInt(rect.maxX());
+    rect.setX(floorToInt(rect.x()));
+    rect.setWidth(maxX - rect.x());
+}
+
+#if !ENABLE(SUBPIXEL_LAYOUT)
+void alignSelectionRectToDevicePixels(FloatRect& rect)
+{
+    float maxX = floorf(rect.maxX());
+    rect.setX(floorf(rect.x()));
+    rect.setWidth(roundf(maxX - rect.x()));
+}
+#endif
+
 void InlineTextBox::paintSelection(GraphicsContext* context, const FloatPoint& boxOrigin, RenderStyle* style, const Font& font, Color textColor)
 {
     if (context->paintingDisabled())
@@ -844,15 +860,18 @@ void InlineTextBox::paintSelection(GraphicsContext* context, const FloatPoint& b
     LayoutUnit selectionBottom = root()->selectionBottom();
     LayoutUnit selectionTop = root()->selectionTopAdjustedForPrecedingBlock();
 
-    int deltaY = renderer()->style()->isFlippedLinesWritingMode() ? selectionBottom - logicalBottom() : logicalTop() - selectionTop;
-    int selHeight = max<LayoutUnit>(0, selectionBottom - selectionTop);
+    LayoutUnit deltaY = renderer()->style()->isFlippedLinesWritingMode() ? selectionBottom - logicalBottom() : logicalTop() - selectionTop;
+    LayoutUnit selHeight = max<LayoutUnit>(0, selectionBottom - selectionTop);
 
+#if ENABLE(SUBPIXEL_LAYOUT)
+    LayoutPoint localOrigin(boxOrigin.x(), boxOrigin.y() - deltaY);
+    LayoutRect clipRect(localOrigin, LayoutSize(m_logicalWidth, selHeight));
+    alignSelectionRectToDevicePixels(clipRect);
+#else
     FloatPoint localOrigin(boxOrigin.x(), boxOrigin.y() - deltaY);
-
     FloatRect clipRect(localOrigin, FloatSize(m_logicalWidth, selHeight));
-    float maxX = floorf(clipRect.maxX());
-    clipRect.setX(floorf(clipRect.x()));
-    clipRect.setWidth(maxX - clipRect.x());
+    alignSelectionRectToDevicePixels(clipRect);
+#endif
     context->clip(clipRect);
 
     context->drawHighlightForText(font, textRun, localOrigin, selHeight, c, style->colorSpace(), sPos, ePos);
diff --git a/Source/WebCore/rendering/InlineTextBox.h b/Source/WebCore/rendering/InlineTextBox.h
index 1b7a3ad03..a3c08987c 100644
--- a/Source/WebCore/rendering/InlineTextBox.h
+++ b/Source/WebCore/rendering/InlineTextBox.h
@@ -213,6 +213,11 @@ inline RenderText* InlineTextBox::textRenderer() const
     return toRenderText(renderer());
 }
 
+void alignSelectionRectToDevicePixels(LayoutRect&);
+#if !ENABLE(SUBPIXEL_LAYOUT)
+void alignSelectionRectToDevicePixels(FloatRect&);
+#endif
+
 } // namespace WebCore
 
 #endif // InlineTextBox_h
diff --git a/Source/WebCore/rendering/LayoutState.cpp b/Source/WebCore/rendering/LayoutState.cpp
index 1fbfc0cdd..5f780dca0 100644
--- a/Source/WebCore/rendering/LayoutState.cpp
+++ b/Source/WebCore/rendering/LayoutState.cpp
@@ -196,16 +196,18 @@ void LayoutState::clearPaginationInformation()
     m_columnInfo = m_next->m_columnInfo;
 }
 
-LayoutUnit LayoutState::pageLogicalOffset(LayoutUnit childLogicalOffset) const
+LayoutUnit LayoutState::pageLogicalOffset(RenderBox* child, LayoutUnit childLogicalOffset) const
 {
-    return m_layoutOffset.height() + childLogicalOffset - m_pageOffset.height();
+    if (child->isHorizontalWritingMode())
+        return m_layoutOffset.height() + childLogicalOffset - m_pageOffset.height();
+    return m_layoutOffset.width() + childLogicalOffset - m_pageOffset.width();
 }
 
-void LayoutState::addForcedColumnBreak(LayoutUnit childLogicalOffset)
+void LayoutState::addForcedColumnBreak(RenderBox* child, LayoutUnit childLogicalOffset)
 {
     if (!m_columnInfo || m_columnInfo->columnHeight())
         return;
-    m_columnInfo->addForcedBreak(pageLogicalOffset(childLogicalOffset));
+    m_columnInfo->addForcedBreak(pageLogicalOffset(child, childLogicalOffset));
 }
 
 void LayoutState::propagateLineGridInfo(RenderBox* renderer)
diff --git a/Source/WebCore/rendering/LayoutState.h b/Source/WebCore/rendering/LayoutState.h
index e1df24b4e..81d61e9cd 100644
--- a/Source/WebCore/rendering/LayoutState.h
+++ b/Source/WebCore/rendering/LayoutState.h
@@ -74,9 +74,9 @@ public:
     
     // The page logical offset is the object's offset from the top of the page in the page progression
     // direction (so an x-offset in vertical text and a y-offset for horizontal text).
-    LayoutUnit pageLogicalOffset(LayoutUnit childLogicalOffset) const;
+    LayoutUnit pageLogicalOffset(RenderBox*, LayoutUnit childLogicalOffset) const;
 
-    void addForcedColumnBreak(LayoutUnit childLogicalOffset);
+    void addForcedColumnBreak(RenderBox*, LayoutUnit childLogicalOffset);
     
     LayoutUnit pageLogicalHeight() const { return m_pageLogicalHeight; }
     bool pageLogicalHeightChanged() const { return m_pageLogicalHeightChanged; }
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 4c2899e0f..c3017a425 100755
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -932,6 +932,14 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
     }
 
     RenderBox::addChild(newChild, beforeChild);
+ 
+    // Handle positioning of run-ins.
+    if (newChild->isRunIn())
+        moveRunInUnderSiblingBlockIfNeeded(newChild);
+    else if (RenderObject* prevSibling = newChild->previousSibling()) {
+        if (prevSibling->isRunIn())
+            moveRunInUnderSiblingBlockIfNeeded(prevSibling);
+    }
 
     if (madeBoxesNonInline && parent() && isAnonymousBlock() && parent()->isRenderBlock())
         toRenderBlock(parent())->removeLeftoverAnonymousBlock(this);
@@ -1038,6 +1046,13 @@ void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
     if (!child)
         return;
 
+    // Since we are going to have block children, we have to move
+    // back the run-in to its original place.
+    if (child->isRunIn()) {
+        moveRunInToOriginalPosition(child);
+        child = firstChild();
+    }
+
     deleteLineBoxTree();
 
     while (child) {
@@ -1503,7 +1518,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
     statePusher.pop();
 
     if (renderView->layoutState()->m_pageLogicalHeight)
-        setPageLogicalOffset(renderView->layoutState()->pageLogicalOffset(logicalTop()));
+        setPageLogicalOffset(renderView->layoutState()->pageLogicalOffset(this, logicalTop()));
 
     updateLayerTransform();
 
@@ -1724,8 +1739,7 @@ bool RenderBlock::handleSpecialChild(RenderBox* child, const MarginInfo& marginI
 {
     // Handle in the given order
     return handlePositionedChild(child, marginInfo)
-        || handleFloatingChild(child, marginInfo)
-        || handleRunInChild(child);
+        || handleFloatingChild(child, marginInfo);
 }
 
 
@@ -1749,77 +1763,115 @@ bool RenderBlock::handleFloatingChild(RenderBox* child, const MarginInfo& margin
     return false;
 }
 
-bool RenderBlock::handleRunInChild(RenderBox* child)
+static void destroyRunIn(RenderBoxModelObject* runIn)
 {
-    // See if we have a run-in element with inline children.  If the
-    // children aren't inline, then just treat the run-in as a normal
-    // block.
-    if (!child->isRunIn() || !child->childrenInline())
-        return false;
+    ASSERT(runIn->isRunIn());
+    ASSERT(!runIn->firstChild());
+
+    // If it is a block run-in, delete its line box tree as well. This is needed as our
+    // children got moved and our line box tree is no longer valid.
+    if (runIn->isRenderBlock())
+        toRenderBlock(runIn)->deleteLineBoxTree();
+    runIn->destroy();
+}
+
+RenderBoxModelObject* RenderBlock::createReplacementRunIn(RenderBoxModelObject* runIn)
+{
+    ASSERT(runIn->isRunIn());
+
+    // First we destroy any :before/:after content. It will be regenerated by the new run-in.
+    // Exception is if the run-in itself is generated.
+    if (runIn->style()->styleType() != BEFORE && runIn->style()->styleType() != AFTER) {
+        RenderObject* generatedContent;
+        if (runIn->getCachedPseudoStyle(BEFORE) && (generatedContent = runIn->beforePseudoElementRenderer()))
+            generatedContent->destroy();
+        if (runIn->getCachedPseudoStyle(AFTER) && (generatedContent = runIn->afterPseudoElementRenderer()))
+            generatedContent->destroy();
+    }
+
+    bool newRunInShouldBeBlock = !runIn->isRenderBlock();
+    Node* runInNode = runIn->node();
+    RenderBoxModelObject* newRunIn = 0;
+    if (newRunInShouldBeBlock)
+        newRunIn = new (renderArena()) RenderBlock(runInNode ? runInNode : document());
+    else
+        newRunIn = new (renderArena()) RenderInline(runInNode ? runInNode : document());
+    newRunIn->setStyle(runIn->style());
+ 
+    runIn->moveAllChildrenTo(newRunIn, true);
+
+    // If the run-in had an element, we need to set the new renderer.
+    if (runInNode)
+        runInNode->setRenderer(newRunIn);
+
+    return newRunIn;
+}
+
+void RenderBlock::moveRunInUnderSiblingBlockIfNeeded(RenderObject* runIn)
+{
+    ASSERT(runIn->isRunIn());
+
+    // See if we have inline children. If the children aren't inline,
+    // then just treat the run-in as a normal block.
+    if (!runIn->childrenInline())
+        return;
 
     // FIXME: We don't handle non-block elements with run-in for now.
-    if (!child->isRenderBlock())
-        return false;
+    if (!runIn->isRenderBlock())
+        return;
 
-    // Run-in child shouldn't intrude into the sibling block if it is part of a
+    // We shouldn't run in into the sibling block if we are part of a
     // continuation chain. In that case, treat it as a normal block.
-    if (child->isElementContinuation() || child->virtualContinuation())
-        return false;
+    if (runIn->isElementContinuation() || runIn->virtualContinuation())
+        return;
 
     // Check if this node is allowed to run-in. E.g. <select> expects its renderer to
     // be a RenderListBox or RenderMenuList, and hence cannot be a RenderInline run-in.
-    Node* runInNode = child->node();
+    Node* runInNode = runIn->node();
     if (runInNode && runInNode->hasTagName(selectTag))
-        return false;
+        return;
 
-    RenderBlock* blockRunIn = toRenderBlock(child);
-    RenderObject* curr = blockRunIn->nextSibling();
-    if (!curr || !curr->isRenderBlock() || !curr->childrenInline() || curr->isRunIn() || curr->isAnonymous() || curr->isFloatingOrPositioned())
-        return false;
+    RenderObject* curr = runIn->nextSibling();
+    if (!curr || !curr->isRenderBlock() || !curr->childrenInline())
+        return;
 
-    RenderBlock* currBlock = toRenderBlock(curr);
+    // Per CSS3, "A run-in cannot run in to a block that already starts with a
+    // run-in or that itself is a run-in".
+    if (curr->isRunIn() || (curr->firstChild() && curr->firstChild()->isRunIn()))
+        return;
 
-    // First we destroy any :before/:after content. It will be regenerated by the new inline.
-    // Exception is if the run-in itself is generated.
-    if (child->style()->styleType() != BEFORE && child->style()->styleType() != AFTER) {
-        RenderObject* generatedContent;
-        if (child->getCachedPseudoStyle(BEFORE) && (generatedContent = child->beforePseudoElementRenderer()))
-            generatedContent->destroy();
-        if (child->getCachedPseudoStyle(AFTER) && (generatedContent = child->afterPseudoElementRenderer()))
-            generatedContent->destroy();
-    }
+    if (curr->isAnonymous() || curr->isFloatingOrPositioned())
+        return;
 
-    // Remove the old child.
-    children()->removeChildNode(this, blockRunIn);
+    RenderBoxModelObject* oldRunIn = toRenderBoxModelObject(runIn);
+    RenderBoxModelObject* newRunIn = createReplacementRunIn(oldRunIn);
+    destroyRunIn(oldRunIn);
 
-    // Create an inline.
-    RenderInline* inlineRunIn = new (renderArena()) RenderInline(runInNode ? runInNode : document());
-    inlineRunIn->setStyle(blockRunIn->style());
+    // Now insert the new child under |curr| block. Use addChild instead of insertChildNode
+    // since it handles correct placement of the children, especially where we cannot insert
+    // anything before the first child. e.g. details tag. See https://bugs.webkit.org/show_bug.cgi?id=58228.
+    curr->addChild(newRunIn, curr->firstChild());
+}
 
-    // Move the nodes from the old child to the new child
-    for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild;) {
-        RenderObject* nextSibling = runInChild->nextSibling();
-        blockRunIn->children()->removeChildNode(blockRunIn, runInChild);
-        inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
-        runInChild = nextSibling;
-    }
+void RenderBlock::moveRunInToOriginalPosition(RenderObject* runIn)
+{
+    ASSERT(runIn->isRunIn());
 
-    // Now insert the new child under |currBlock|. Use addChild instead of insertChildNode since it handles correct placement of the children, esp where we cannot insert
-    // anything before the first child. e.g. details tag. See https://bugs.webkit.org/show_bug.cgi?id=58228.
-    currBlock->addChild(inlineRunIn, currBlock->firstChild());
-    
-    // If the run-in had an element, we need to set the new renderer.
-    if (runInNode)
-        runInNode->setRenderer(inlineRunIn);
+    // If we don't have a parent, there is nothing to move. This might
+    // happen if |this| got detached from parent after |runIn| run into |this|.
+    if (!parent())
+        return;
+
+    // An intruded run-in needs to be an inline.
+    if (!runIn->isRenderInline())
+        return;
 
-    // Destroy the block run-in, which includes deleting its line box tree.
-    blockRunIn->deleteLineBoxTree();
-    blockRunIn->destroy();
+    RenderBoxModelObject* oldRunIn = toRenderBoxModelObject(runIn);
+    RenderBoxModelObject* newRunIn = createReplacementRunIn(oldRunIn);
+    destroyRunIn(oldRunIn);
 
-    // The block acts like an inline, so just null out its
-    // position.
-    
-    return true;
+    // Add the run-in block as our previous sibling.
+    parent()->addChild(newRunIn, this);
 }
 
 LayoutUnit RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
@@ -2478,7 +2530,7 @@ void RenderBlock::markForPaginationRelayoutIfNeeded()
     if (needsLayout())
         return;
 
-    if (view()->layoutState()->pageLogicalHeightChanged() || (view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(logicalTop()) != pageLogicalOffset()))
+    if (view()->layoutState()->pageLogicalHeightChanged() || (view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(this, logicalTop()) != pageLogicalOffset()))
         setChildNeedsLayout(true, MarkOnlyThis);
 }
 
@@ -2621,6 +2673,7 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, const LayoutPoint& p
     if (!colCount)
         return;
     LayoutUnit currLogicalTopOffset = 0;
+    LayoutUnit colGap = columnGap();
     for (unsigned i = 0; i < colCount; i++) {
         // For each rect, we clip to the rect, and then we adjust our coords.
         LayoutRect colRect = columnRectAt(colInfo, i);
@@ -2639,10 +2692,19 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, const LayoutPoint& p
         
         if (!info.rect.isEmpty()) {
             GraphicsContextStateSaver stateSaver(*context);
+            LayoutRect clipRect(colRect);
             
+            if (i < colCount - 1) {
+                if (isHorizontalWritingMode())
+                    clipRect.expand(colGap / 2, 0);
+                else
+                    clipRect.expand(0, colGap / 2);
+            }
             // Each strip pushes a clip, since column boxes are specified as being
             // like overflow:hidden.
-            context->clip(colRect);
+            // FIXME: Content and column rules that extend outside column boxes at the edges of the multi-column element
+            // are clipped according to the 'overflow' property.
+            context->clip(clipRect);
 
             // Adjust our x and y when painting.
             LayoutPoint adjustedPaintOffset = paintOffset + offset;
@@ -3295,6 +3357,7 @@ LayoutRect RenderBlock::logicalLeftSelectionGap(RenderBlock* rootBlock, const La
         return LayoutRect();
 
     LayoutRect gapRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, LayoutRect(rootBlockLogicalLeft, rootBlockLogicalTop, rootBlockLogicalWidth, logicalHeight));
+    alignSelectionRectToDevicePixels(gapRect);
     if (paintInfo)
         paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
@@ -3311,6 +3374,7 @@ LayoutRect RenderBlock::logicalRightSelectionGap(RenderBlock* rootBlock, const L
         return LayoutRect();
 
     LayoutRect gapRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, LayoutRect(rootBlockLogicalLeft, rootBlockLogicalTop, rootBlockLogicalWidth, logicalHeight));
+    alignSelectionRectToDevicePixels(gapRect);
     if (paintInfo)
         paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
@@ -4168,9 +4232,8 @@ LayoutUnit RenderBlock::addOverhangingFloats(RenderBlock* child, bool makeChildP
         if (logicalBottom > logicalHeight()) {
             // If the object is not in the list, we add it now.
             if (!containsFloat(r->m_renderer)) {
-                LayoutUnit leftOffset = isHorizontalWritingMode() ? -childLogicalLeft : -childLogicalTop;
-                LayoutUnit topOffset = isHorizontalWritingMode() ? -childLogicalTop : -childLogicalLeft;
-                FloatingObject* floatingObj = new FloatingObject(r->type(), LayoutRect(r->x() - leftOffset, r->y() - topOffset, r->width(), r->height()));
+                LayoutSize offset = isHorizontalWritingMode() ? LayoutSize(-childLogicalLeft, -childLogicalTop) : LayoutSize(-childLogicalTop, -childLogicalLeft);
+                FloatingObject* floatingObj = new FloatingObject(r->type(), LayoutRect(r->frameRect().location() - offset, r->frameRect().size()));
                 floatingObj->m_renderer = r->m_renderer;
 
                 // The nearest enclosing layer always paints the float (so that zindex and stacking
@@ -4237,10 +4300,8 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, LayoutUnit logicalLeftOf
         FloatingObject* r = *prevIt;
         if (logicalBottomForFloat(r) > logicalTopOffset) {
             if (!m_floatingObjects || !m_floatingObjects->set().contains(r)) {
-                LayoutUnit leftOffset = isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
-                LayoutUnit topOffset = isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
-                
-                FloatingObject* floatingObj = new FloatingObject(r->type(), LayoutRect(r->x() - leftOffset, r->y() - topOffset, r->width(), r->height()));
+                LayoutSize offset = isHorizontalWritingMode() ? LayoutSize(logicalLeftOffset, logicalTopOffset) : LayoutSize(logicalTopOffset, logicalLeftOffset);
+                FloatingObject* floatingObj = new FloatingObject(r->type(), LayoutRect(r->frameRect().location() - offset, r->frameRect().size()));
 
                 // Applying the child's margin makes no sense in the case where the child was passed in.
                 // since this margin was added already through the modification of the |logicalLeftOffset| variable
@@ -4931,7 +4992,7 @@ bool RenderBlock::layoutColumns(bool hasSpecifiedPageLogicalHeight, LayoutUnit p
             // maximum page break distance.
             if (!pageLogicalHeight) {
                 LayoutUnit distanceBetweenBreaks = max<LayoutUnit>(colInfo->maximumDistanceBetweenForcedBreaks(),
-                                                                   view()->layoutState()->pageLogicalOffset(borderBefore() + paddingBefore() + contentLogicalHeight()) - colInfo->forcedBreakOffset());
+                                                                   view()->layoutState()->pageLogicalOffset(this, borderBefore() + paddingBefore() + contentLogicalHeight()) - colInfo->forcedBreakOffset());
                 columnHeight = max(colInfo->minimumColumnHeight(), distanceBetweenBreaks);
             }
         } else if (contentLogicalHeight() > boundedMultiply(pageLogicalHeight, desiredColumnCount)) {
@@ -5167,7 +5228,8 @@ void RenderBlock::computePreferredLogicalWidths()
     updateFirstLetter();
 
     RenderStyle* styleToUse = style();
-    if (!isTableCell() && styleToUse->logicalWidth().isFixed() && styleToUse->logicalWidth().value() >= 0 && style()->marqueeBehavior() != MALTERNATE)
+    if (!isTableCell() && styleToUse->logicalWidth().isFixed() && styleToUse->logicalWidth().value() >= 0 
+       && style()->marqueeBehavior() != MALTERNATE && !(isDeprecatedFlexItem() && !styleToUse->logicalWidth().intValue()))
         m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = computeContentBoxLogicalWidth(styleToUse->logicalWidth().value());
     else {
         m_minPreferredLogicalWidth = 0;
@@ -5701,7 +5763,7 @@ bool RenderBlock::hasLineIfEmpty() const
     if (!node())
         return false;
     
-    if (node()->rendererIsEditable() && node()->rootEditableElement() == node())
+    if (node()->isRootEditableElement())
         return true;
     
     if (node()->isShadowRoot() && (node()->shadowHost()->hasTagName(inputTag)))
@@ -5890,58 +5952,6 @@ static inline bool shouldSkipForFirstLetter(UChar c)
     return isSpaceOrNewline(c) || c == noBreakSpace || isPunctuationForFirstLetter(c);
 }
 
-RenderObject* RenderBlock::findLastObjectWithFirstLetterText(RenderObject* child, RenderObject* &firstLetterBlock)
-{
-    while (child) {
-        RenderObject* nextChild = child->nextSibling();
-        // Style and skip over any objects such as quotes or punctuation
-        child = findLastObjectAfterFirstLetterPunctuation(child, firstLetterBlock);
-        if (child)
-            break;
-        child = nextChild;
-    }
-    return child;
-}
-
-RenderObject* RenderBlock::findLastObjectAfterFirstLetterPunctuation(RenderObject* child, RenderObject* &firstLetterBlock)
-{
-    if (child->isText()) {
-        // CSS 2.1 http://www.w3.org/TR/CSS21/selector.html#first-letter
-        // "The first letter must occur on the first formatted line."
-        if (child->isBR())
-            return child;
-        
-        // If child is a single punctuation mark or a Render Quote then style it as first-letter now and keep looking for further text,
-        bool textQuote = toRenderText(child)->textLength() == 1 && isPunctuationForFirstLetter(toRenderText(child)->characters()[0]);
-        if (child->isQuote() || textQuote)
-            addFirstLetter(child, firstLetterBlock);
-        else if (!toRenderText(child)->isAllCollapsibleWhitespace())
-            return child;
-        return 0;
-    }
-    
-    if (child->isListMarker())
-        return 0;
-    
-    if (child->isFloatingOrPositioned()) {
-        // Floats and positioned objects do not inherit their style from parents so if it is styled
-        // inspect its children for text, otherwise move on to its sibling.
-        if (child->style()->styleType() == FIRST_LETTER)
-            return findLastObjectWithFirstLetterText(child->firstChild(), firstLetterBlock);
-        return 0;
-    }
-    
-    if (child->isReplaced() || child->isRenderButton() || child->isMenuList())
-        return child;
-    
-    if (child->style()->hasPseudoStyle(FIRST_LETTER) && child->canHaveChildren())  {
-        // We found a lower-level node with first-letter, which supersedes the higher-level style.
-        firstLetterBlock = child;
-        return findLastObjectWithFirstLetterText(child->firstChild(), firstLetterBlock);
-    }
-    return findLastObjectWithFirstLetterText(child->firstChild(), firstLetterBlock);
-}
-
 static inline RenderObject* findFirstLetterBlock(RenderBlock* start)
 {
     RenderObject* firstLetterBlock = start;
@@ -6091,36 +6101,47 @@ void RenderBlock::updateFirstLetter()
     if (!firstLetterBlock)
         return;
 
-    // Check each sibling and drill into its inlines until we find a text node that is not all whitespace
-    // or is a line break.
-    RenderObject* firstLetterObject = firstLetterBlock->firstChild();
-    
-    firstLetterObject = findLastObjectWithFirstLetterText(firstLetterObject, firstLetterBlock);
+    // Drill into inlines looking for our first text child.
+    RenderObject* currChild = firstLetterBlock->firstChild();
+    while (currChild) {
+        if (currChild->isText())
+            break;
+        if (currChild->isListMarker())
+            currChild = currChild->nextSibling();
+        else if (currChild->isFloatingOrPositioned()) {
+            if (currChild->style()->styleType() == FIRST_LETTER) {
+                currChild = currChild->firstChild();
+                break;
+            }
+            currChild = currChild->nextSibling();
+        } else if (currChild->isReplaced() || currChild->isRenderButton() || currChild->isMenuList())
+            break;
+        else if (currChild->style()->hasPseudoStyle(FIRST_LETTER) && canHaveGeneratedChildren(currChild))  {
+            // We found a lower-level node with first-letter, which supersedes the higher-level style
+            firstLetterBlock = currChild;
+            currChild = currChild->firstChild();
+        } else
+            currChild = currChild->firstChild();
+    }
 
-    if (!firstLetterObject)
+    if (!currChild)
         return;
-    
-    addFirstLetter(firstLetterObject, firstLetterBlock);
-}
-
-void RenderBlock::addFirstLetter(RenderObject* firstLetterObject, RenderObject* &firstLetterBlock)
-{
 
     // If the child already has style, then it has already been created, so we just want
     // to update it.
-    if (firstLetterObject->parent()->style()->styleType() == FIRST_LETTER) {
-        updateFirstLetterStyle(firstLetterBlock, firstLetterObject);
+    if (currChild->parent()->style()->styleType() == FIRST_LETTER) {
+        updateFirstLetterStyle(firstLetterBlock, currChild);
         return;
     }
 
-    if (!firstLetterObject->isText() || firstLetterObject->isBR())
+    if (!currChild->isText() || currChild->isBR())
         return;
 
     // Our layout state is not valid for the repaints we are going to trigger by
     // adding and removing children of firstLetterContainer.
     LayoutStateDisabler layoutStateDisabler(view());
 
-    createFirstLetterRenderer(firstLetterBlock, firstLetterObject);
+    createFirstLetterRenderer(firstLetterBlock, currChild);
 }
 
 // Helper methods for obtaining the last line, computing line counts and heights for line counts
@@ -6635,7 +6656,7 @@ LayoutUnit RenderBlock::applyBeforeBreak(RenderBox* child, LayoutUnit logicalOff
                              || (checkRegionBreaks && child->style()->regionBreakBefore() == PBALWAYS);
     if (checkBeforeAlways && inNormalFlow(child) && hasNextPage(logicalOffset, IncludePageBoundary)) {
         if (checkColumnBreaks)
-            view()->layoutState()->addForcedColumnBreak(logicalOffset);
+            view()->layoutState()->addForcedColumnBreak(child, logicalOffset);
         return nextPageLogicalTop(logicalOffset, IncludePageBoundary);
     }
     return logicalOffset;
@@ -6652,7 +6673,7 @@ LayoutUnit RenderBlock::applyAfterBreak(RenderBox* child, LayoutUnit logicalOffs
     if (checkAfterAlways && inNormalFlow(child) && hasNextPage(logicalOffset, IncludePageBoundary)) {
         marginInfo.setMarginAfterQuirk(true); // Cause margins to be discarded for any following content.
         if (checkColumnBreaks)
-            view()->layoutState()->addForcedColumnBreak(logicalOffset);
+            view()->layoutState()->addForcedColumnBreak(child, logicalOffset);
         return nextPageLogicalTop(logicalOffset, IncludePageBoundary);
     }
     return logicalOffset;
@@ -6776,7 +6797,9 @@ void RenderBlock::adjustLinePositionForPagination(RootInlineBox* lineBox, Layout
     lineBox->setPaginationStrut(0);
     LayoutUnit pageLogicalHeight = pageLogicalHeightForOffset(logicalOffset);
     bool hasUniformPageLogicalHeight = !inRenderFlowThread() || enclosingRenderFlowThread()->regionsHaveUniformLogicalHeight();
-    if (!pageLogicalHeight || (hasUniformPageLogicalHeight && lineHeight > pageLogicalHeight)
+    // If lineHeight is greater than pageLogicalHeight, but logicalVisualOverflow.height() still fits, we are
+    // still going to add a strut, so that the visible overflow fits on a single page.
+    if (!pageLogicalHeight || (hasUniformPageLogicalHeight && logicalVisualOverflow.height() > pageLogicalHeight)
         || !hasNextPage(logicalOffset))
         return;
     LayoutUnit remainingLogicalHeight = pageRemainingLogicalHeightForOffset(logicalOffset, ExcludePageBoundary);
@@ -6784,6 +6807,10 @@ void RenderBlock::adjustLinePositionForPagination(RootInlineBox* lineBox, Layout
         // If we have a non-uniform page height, then we have to shift further possibly.
         if (!hasUniformPageLogicalHeight && !pushToNextPageWithMinimumLogicalHeight(remainingLogicalHeight, logicalOffset, lineHeight))
             return;
+        if (lineHeight > pageLogicalHeight) {
+            // Split the top margin in order to avoid splitting the visible part of the line.
+            remainingLogicalHeight -= min(lineHeight - pageLogicalHeight, max(ZERO_LAYOUT_UNIT, logicalVisualOverflow.y() - lineBox->lineTopWithLeading()));
+        }
         LayoutUnit totalLogicalHeight = lineHeight + max(ZERO_LAYOUT_UNIT, logicalOffset);
         LayoutUnit pageLogicalHeightAtNewOffset = hasUniformPageLogicalHeight ? pageLogicalHeight : pageLogicalHeightForOffset(logicalOffset + remainingLogicalHeight);
         if (lineBox == firstRootBox() && totalLogicalHeight < pageLogicalHeightAtNewOffset && !isPositioned() && !isTableCell())
@@ -7197,8 +7224,8 @@ inline void RenderBlock::FloatingObjects::decreaseObjectsCount(FloatingObject::T
 inline RenderBlock::FloatingObjectInterval RenderBlock::FloatingObjects::intervalForFloatingObject(FloatingObject* floatingObject)
 {
     if (m_horizontalWritingMode)
-        return RenderBlock::FloatingObjectInterval(floatingObject->pixelSnappedY(), floatingObject->pixelSnappedMaxY(), floatingObject);
-    return RenderBlock::FloatingObjectInterval(floatingObject->pixelSnappedX(), floatingObject->pixelSnappedMaxX(), floatingObject);
+        return RenderBlock::FloatingObjectInterval(floatingObject->frameRect().pixelSnappedY(), floatingObject->frameRect().pixelSnappedMaxY(), floatingObject);
+    return RenderBlock::FloatingObjectInterval(floatingObject->frameRect().pixelSnappedX(), floatingObject->frameRect().pixelSnappedMaxX(), floatingObject);
 }
 
 void RenderBlock::FloatingObjects::addPlacedObject(FloatingObject* floatingObject)
@@ -7342,7 +7369,7 @@ String ValueToString<int>::string(const int value)
 
 String ValueToString<RenderBlock::FloatingObject*>::string(const RenderBlock::FloatingObject* floatingObject)
 {
-    return String::format("%p (%dx%d %dx%d)", floatingObject, floatingObject->pixelSnappedX(), floatingObject->pixelSnappedY(), floatingObject->pixelSnappedMaxX(), floatingObject->pixelSnappedMaxY());
+    return String::format("%p (%dx%d %dx%d)", floatingObject, floatingObject->frameRect().pixelSnappedX(), floatingObject->frameRect().pixelSnappedY(), floatingObject->frameRect().pixelSnappedMaxX(), floatingObject->frameRect().pixelSnappedMaxY());
 }
 
 #endif
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index a3cc33ea6..df4a6a2f0 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -505,9 +505,6 @@ private:
 
     void createFirstLetterRenderer(RenderObject* firstLetterBlock, RenderObject* currentChild);
     void updateFirstLetterStyle(RenderObject* firstLetterBlock, RenderObject* firstLetterContainer);
-    RenderObject* findLastObjectWithFirstLetterText(RenderObject* child, RenderObject* &firstLetterBlock);
-    RenderObject* findLastObjectAfterFirstLetterPunctuation(RenderObject* child, RenderObject* &firstLetterBlock);
-    void addFirstLetter(RenderObject* firstLetterObject, RenderObject* &firstLetterBlock);
 
     struct FloatWithRect {
         FloatWithRect(RenderBox* f)
@@ -574,13 +571,6 @@ private:
         inline LayoutUnit width() const { return m_frameRect.width(); }
         inline LayoutUnit height() const { return m_frameRect.height(); }
 
-        inline int pixelSnappedX() const { ASSERT(isPlaced()); return m_frameRect.pixelSnappedX(); }
-        inline int pixelSnappedMaxX() const { ASSERT(isPlaced()); return m_frameRect.pixelSnappedMaxX(); }
-        inline int pixelSnappedY() const { ASSERT(isPlaced()); return m_frameRect.pixelSnappedY(); }
-        inline int pixelSnappedMaxY() const { ASSERT(isPlaced()); return m_frameRect.pixelSnappedMaxY(); }
-        inline int pixelSnappedWidth() const { return m_frameRect.pixelSnappedWidth(); }
-        inline int pixelSnappedHeight() const { return m_frameRect.pixelSnappedHeight(); }
-
         void setX(LayoutUnit x) { ASSERT(!isInPlacedTree()); m_frameRect.setX(x); }
         void setY(LayoutUnit y) { ASSERT(!isInPlacedTree()); m_frameRect.setY(y); }
         void setWidth(LayoutUnit width) { ASSERT(!isInPlacedTree()); m_frameRect.setWidth(width); }
@@ -622,11 +612,10 @@ private:
     LayoutUnit logicalRightForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->maxX() : child->maxY(); }
     LayoutUnit logicalWidthForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->width() : child->height(); }
 
-    int pixelSnappedLogicalTopForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedY() : child->pixelSnappedX(); }
-    int pixelSnappedLogicalBottomForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedMaxY() : child->pixelSnappedMaxX(); }
-    int pixelSnappedLogicalLeftForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedX() : child->pixelSnappedY(); }
-    int pixelSnappedLogicalRightForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedMaxX() : child->pixelSnappedMaxY(); }
-    int pixelSnappedLogicalWidthForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedWidth() : child->pixelSnappedHeight(); }
+    int pixelSnappedLogicalTopForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->frameRect().pixelSnappedY() : child->frameRect().pixelSnappedX(); }
+    int pixelSnappedLogicalBottomForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->frameRect().pixelSnappedMaxY() : child->frameRect().pixelSnappedMaxX(); }
+    int pixelSnappedLogicalLeftForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->frameRect().pixelSnappedX() : child->frameRect().pixelSnappedY(); }
+    int pixelSnappedLogicalRightForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->frameRect().pixelSnappedMaxX() : child->frameRect().pixelSnappedMaxY(); }
 
     void setLogicalTopForFloat(FloatingObject* child, LayoutUnit logicalTop)
     {
@@ -911,7 +900,11 @@ private:
     bool handleSpecialChild(RenderBox* child, const MarginInfo&);
     bool handleFloatingChild(RenderBox* child, const MarginInfo&);
     bool handlePositionedChild(RenderBox* child, const MarginInfo&);
-    bool handleRunInChild(RenderBox* child);
+
+    RenderBoxModelObject* createReplacementRunIn(RenderBoxModelObject* runIn);
+    void moveRunInUnderSiblingBlockIfNeeded(RenderObject* runIn);
+    void moveRunInToOriginalPosition(RenderObject* runIn);
+
     LayoutUnit collapseMargins(RenderBox* child, MarginInfo&);
     LayoutUnit clearFloatsIfNeeded(RenderBox* child, MarginInfo&, LayoutUnit oldTopPosMargin, LayoutUnit oldTopNegMargin, LayoutUnit yPos);
     LayoutUnit estimateLogicalTopPosition(RenderBox* child, const MarginInfo&, LayoutUnit& estimateWithoutPagination);
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 362d31fc7..922e72fa5 100755
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -2668,7 +2668,7 @@ void RenderBlock::addOverflowFromInlineChildren()
 {
     LayoutUnit endPadding = hasOverflowClip() ? paddingEnd() : ZERO_LAYOUT_UNIT;
     // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
-    if (hasOverflowClip() && !endPadding && node() && node()->rendererIsEditable() && node() == node()->rootEditableElement() && style()->isLeftToRightDirection())
+    if (hasOverflowClip() && !endPadding && node() && node()->isRootEditableElement() && style()->isLeftToRightDirection())
         endPadding = 1;
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
         addLayoutOverflow(curr->paddedLayoutOverflowRect(endPadding));
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index 199deb6b2..cf6615b22 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -4019,29 +4019,6 @@ bool RenderBox::hasRelativeLogicalHeight() const
             || style()->logicalMaxHeight().isPercent();
 }
 
-void RenderBox::moveChildTo(RenderBox* toBox, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
-{
-    ASSERT(this == child->parent());
-    ASSERT(!beforeChild || toBox == beforeChild->parent());
-    if (fullRemoveInsert && toBox->isRenderBlock()) {
-        // Takes care of adding the new child correctly if toBlock and fromBlock
-        // have different kind of children (block vs inline).
-        toBox->addChild(virtualChildren()->removeChildNode(this, child), beforeChild);
-    } else
-        toBox->virtualChildren()->insertChildNode(toBox, virtualChildren()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
-}
-
-void RenderBox::moveChildrenTo(RenderBox* toBox, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
-{
-    ASSERT(!beforeChild || toBox == beforeChild->parent());
-    for (RenderObject* child = startChild; child && child != endChild; ) {
-        // Save our next sibling as moveChildTo will clear it.
-        RenderObject* nextSibling = child->nextSibling();
-        moveChildTo(toBox, child, beforeChild, fullRemoveInsert);
-        child = nextSibling;
-    }
-}
-
 static void markBoxForRelayoutAfterSplit(RenderBox* box)
 {
     // FIXME: The table code should handle that automatically. If not,
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index 9f00a44e3..94fc105a6 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -73,6 +73,9 @@ public:
     LayoutUnit logicalWidth() const { return style()->isHorizontalWritingMode() ? width() : height(); }
     LayoutUnit logicalHeight() const { return style()->isHorizontalWritingMode() ? height() : width(); }
 
+    int pixelSnappedLogicalHeight() const { return style()->isHorizontalWritingMode() ? pixelSnappedHeight() : pixelSnappedWidth(); }
+    int pixelSnappedLogicalWidth() const { return style()->isHorizontalWritingMode() ? pixelSnappedWidth() : pixelSnappedHeight(); }
+
     void setLogicalLeft(LayoutUnit left)
     {
         if (style()->isHorizontalWritingMode())
@@ -524,30 +527,6 @@ protected:
 
     void paintRootBoxFillLayers(const PaintInfo&);
 
-    // These functions are only used internally to manipulate the render tree structure via remove/insert/appendChildNode.
-    // Since they are typically called only to move objects around within anonymous blocks (which only have layers in
-    // the case of column spans), the default for fullRemoveInsert is false rather than true.
-    void moveChildTo(RenderBox* toBox, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
-    void moveChildTo(RenderBox* to, RenderObject* child, bool fullRemoveInsert = false)
-    {
-        moveChildTo(to, child, 0, fullRemoveInsert);
-    }
-    void moveAllChildrenTo(RenderBox* toBox, bool fullRemoveInsert = false)
-    {
-        moveAllChildrenTo(toBox, 0, fullRemoveInsert);
-    }
-    void moveAllChildrenTo(RenderBox* toBox, RenderObject* beforeChild, bool fullRemoveInsert = false)
-    {
-        moveChildrenTo(toBox, firstChild(), 0, beforeChild, fullRemoveInsert);
-    }
-    // Move all of the kids from |startChild| up to but excluding |endChild|. 0 can be passed as the |endChild| to denote
-    // that all the kids from |startChild| onwards should be moved.
-    void moveChildrenTo(RenderBox* toBox, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
-    {
-        moveChildrenTo(toBox, startChild, endChild, 0, fullRemoveInsert);
-    }
-    void moveChildrenTo(RenderBox* toBox, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
-   
     RenderObject* splitAnonymousBoxesAroundChild(RenderObject* beforeChild);
  
 private:
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index fcca1b3d5..b23ad9980 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -3017,4 +3017,27 @@ void RenderBoxModelObject::mapAbsoluteToLocalPoint(bool fixed, bool useTransform
         transformState.move(containerOffset.width(), containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
 }
 
+void RenderBoxModelObject::moveChildTo(RenderBoxModelObject* toBoxModelObject, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
+{
+    ASSERT(this == child->parent());
+    ASSERT(!beforeChild || toBoxModelObject == beforeChild->parent());
+    if (fullRemoveInsert && (toBoxModelObject->isRenderBlock() || toBoxModelObject->isRenderInline())) {
+        // Takes care of adding the new child correctly if toBlock and fromBlock
+        // have different kind of children (block vs inline).
+        toBoxModelObject->addChild(virtualChildren()->removeChildNode(this, child), beforeChild);
+    } else
+        toBoxModelObject->virtualChildren()->insertChildNode(toBoxModelObject, virtualChildren()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
+}
+
+void RenderBoxModelObject::moveChildrenTo(RenderBoxModelObject* toBoxModelObject, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
+{
+    ASSERT(!beforeChild || toBoxModelObject == beforeChild->parent());
+    for (RenderObject* child = startChild; child && child != endChild; ) {
+        // Save our next sibling as moveChildTo will clear it.
+        RenderObject* nextSibling = child->nextSibling();
+        moveChildTo(toBoxModelObject, child, beforeChild, fullRemoveInsert);
+        child = nextSibling;
+    }
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.h b/Source/WebCore/rendering/RenderBoxModelObject.h
index 6c88f0fbf..d0883a5ee 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.h
+++ b/Source/WebCore/rendering/RenderBoxModelObject.h
@@ -246,6 +246,30 @@ public:
     RenderObject* firstLetterRemainingText() const;
     void setFirstLetterRemainingText(RenderObject*);
 
+    // These functions are only used internally to manipulate the render tree structure via remove/insert/appendChildNode.
+    // Since they are typically called only to move objects around within anonymous blocks (which only have layers in
+    // the case of column spans), the default for fullRemoveInsert is false rather than true.
+    void moveChildTo(RenderBoxModelObject* toBoxModelObject, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
+    void moveChildTo(RenderBoxModelObject* toBoxModelObject, RenderObject* child, bool fullRemoveInsert = false)
+    {
+        moveChildTo(toBoxModelObject, child, 0, fullRemoveInsert);
+    }
+    void moveAllChildrenTo(RenderBoxModelObject* toBoxModelObject, bool fullRemoveInsert = false)
+    {
+        moveAllChildrenTo(toBoxModelObject, 0, fullRemoveInsert);
+    }
+    void moveAllChildrenTo(RenderBoxModelObject* toBoxModelObject, RenderObject* beforeChild, bool fullRemoveInsert = false)
+    {
+        moveChildrenTo(toBoxModelObject, firstChild(), 0, beforeChild, fullRemoveInsert);
+    }
+    // Move all of the kids from |startChild| up to but excluding |endChild|. 0 can be passed as the |endChild| to denote
+    // that all the kids from |startChild| onwards should be moved.
+    void moveChildrenTo(RenderBoxModelObject* toBoxModelObject, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
+    {
+        moveChildrenTo(toBoxModelObject, startChild, endChild, 0, fullRemoveInsert);
+    }
+    void moveChildrenTo(RenderBoxModelObject* toBoxModelObject, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
+
 private:
     virtual bool isBoxModelObject() const { return true; }
 
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
index b956d3946..7fae3c40f 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
@@ -301,7 +301,7 @@ void RenderDeprecatedFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit)
     updateLayerTransform();
 
     if (view()->layoutState()->pageLogicalHeight())
-        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(logicalTop()));
+        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(this, logicalTop()));
 
     // Update our scrollbars if we're overflow:auto/scroll/hidden now that we know if
     // we overflow or not.
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.cpp b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
index 55cfcfd4d..315c16f8a 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -102,11 +102,28 @@ bool RenderEmbeddedObject::allowsAcceleratedCompositing() const
 }
 #endif
 
+static String unavailablePluginReplacementText(RenderEmbeddedObject::PluginUnavailabilityReason pluginUnavailabilityReason)
+{
+    switch (pluginUnavailabilityReason) {
+    case RenderEmbeddedObject::PluginMissing:
+        return missingPluginText();
+    case RenderEmbeddedObject::PluginCrashed:
+        return crashedPluginText();
+    case RenderEmbeddedObject::InsecurePluginVersion:
+        return insecurePluginVersionText();
+    }
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
 void RenderEmbeddedObject::setPluginUnavailabilityReason(PluginUnavailabilityReason pluginUnavailabilityReason)
 {
     ASSERT(!m_showsUnavailablePluginIndicator);
     m_showsUnavailablePluginIndicator = true;
     m_pluginUnavailabilityReason = pluginUnavailabilityReason;
+
+    m_unavailablePluginReplacementText = unavailablePluginReplacementText(pluginUnavailabilityReason);
 }
 
 bool RenderEmbeddedObject::showsUnavailablePluginIndicator() const
@@ -193,8 +210,8 @@ bool RenderEmbeddedObject::getReplacementTextGeometry(const LayoutPoint& accumul
     fontDescription.setComputedSize(fontDescription.specifiedSize());
     font = Font(fontDescription, 0, 0);
     font.update(0);
-    
-    run = TextRun(unavailablePluginReplacementText());
+
+    run = TextRun(m_unavailablePluginReplacementText);
     textWidth = font.width(run);
     
     replacementTextRect.setSize(FloatSize(textWidth + replacementTextRoundedRectLeftRightTextMargin * 2, replacementTextRoundedRectHeight));
@@ -207,21 +224,6 @@ bool RenderEmbeddedObject::getReplacementTextGeometry(const LayoutPoint& accumul
     return true;
 }
 
-String RenderEmbeddedObject::unavailablePluginReplacementText() const
-{
-    switch (m_pluginUnavailabilityReason) {
-    case PluginMissing:
-        return missingPluginText();
-    case PluginCrashed:
-        return crashedPluginText();
-    case InsecurePluginVersion:
-        return insecurePluginVersionText();
-    }
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
 void RenderEmbeddedObject::layout()
 {
     ASSERT(needsLayout());
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.h b/Source/WebCore/rendering/RenderEmbeddedObject.h
index 3564ff287..1e0bffb30 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.h
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.h
@@ -78,12 +78,12 @@ private:
     bool isInUnavailablePluginIndicator(MouseEvent*) const;
     bool isInUnavailablePluginIndicator(const LayoutPoint&) const;
     bool getReplacementTextGeometry(const LayoutPoint& accumulatedOffset, FloatRect& contentRect, Path&, FloatRect& replacementTextRect, Font&, TextRun&, float& textWidth) const;
-    String unavailablePluginReplacementText() const;
 
     bool m_hasFallbackContent; // FIXME: This belongs on HTMLObjectElement.
 
     bool m_showsUnavailablePluginIndicator;
     PluginUnavailabilityReason m_pluginUnavailabilityReason;
+    String m_unavailablePluginReplacementText;
     bool m_unavailablePluginIndicatorIsPressed;
     bool m_mouseDownWasInUnavailablePluginIndicator;
 };
diff --git a/Source/WebCore/rendering/RenderFlowThread.cpp b/Source/WebCore/rendering/RenderFlowThread.cpp
index 393964ade..2e04a6bf9 100644
--- a/Source/WebCore/rendering/RenderFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderFlowThread.cpp
@@ -292,16 +292,16 @@ void RenderFlowThread::paintIntoRegion(PaintInfo& paintInfo, RenderRegion* regio
         // RenderFlowThread should start painting its content in a position that is offset
         // from the region rect's current position. The amount of offset is equal to the location of
         // region in flow coordinates.
-        LayoutPoint renderFlowThreadOffset;
+        IntPoint renderFlowThreadOffset;
         if (style()->isFlippedBlocksWritingMode()) {
             LayoutRect flippedRegionRect(regionRect);
             flipForWritingMode(flippedRegionRect);
-            renderFlowThreadOffset = LayoutPoint(paintOffset - flippedRegionRect.location());
+            renderFlowThreadOffset = roundedIntPoint(paintOffset - flippedRegionRect.location());
         } else
-            renderFlowThreadOffset = LayoutPoint(paintOffset - regionRect.location());
+            renderFlowThreadOffset = roundedIntPoint(paintOffset - regionRect.location());
 
         context->translate(renderFlowThreadOffset.x(), renderFlowThreadOffset.y());
-        info.rect.moveBy(-roundedIntPoint(renderFlowThreadOffset));
+        info.rect.moveBy(-renderFlowThreadOffset);
         
         layer()->paint(context, info.rect, 0, 0, region, RenderLayer::PaintLayerTemporaryClipRects);
 
diff --git a/Source/WebCore/rendering/RenderFrameBase.cpp b/Source/WebCore/rendering/RenderFrameBase.cpp
index 046288bff..aa82870d4 100644
--- a/Source/WebCore/rendering/RenderFrameBase.cpp
+++ b/Source/WebCore/rendering/RenderFrameBase.cpp
@@ -38,13 +38,26 @@ RenderFrameBase::RenderFrameBase(Element* element)
 {
 }
 
-void RenderFrameBase::layoutWithFlattening(bool fixedWidth, bool fixedHeight)
+inline bool shouldExpandFrame(LayoutUnit width, LayoutUnit height, bool hasFixedWidth, bool hasFixedHeight)
+{
+    // If the size computed to zero never expand.
+    if (!width || !height)
+        return false;
+    // Really small fixed size frames can't be meant to be scrolled and are there probably by mistake. Avoid expanding.
+    static unsigned smallestUsefullyScrollableDimension = 8;
+    if (hasFixedWidth && width < LayoutUnit(smallestUsefullyScrollableDimension))
+        return false;
+    if (hasFixedHeight && height < LayoutUnit(smallestUsefullyScrollableDimension))
+        return false;
+    return true;
+}
+
+void RenderFrameBase::layoutWithFlattening(bool hasFixedWidth, bool hasFixedHeight)
 {
     FrameView* childFrameView = static_cast<FrameView*>(widget());
     RenderView* childRoot = childFrameView ? static_cast<RenderView*>(childFrameView->frame()->contentRenderer()) : 0;
 
-    // Do not expand frames which has zero width or height
-    if (!width() || !height() || !childRoot) {
+    if (!childRoot || !shouldExpandFrame(width(), height(), hasFixedWidth, hasFixedHeight)) {
         updateWidgetPosition();
         if (childFrameView)
             childFrameView->layout();
@@ -69,7 +82,7 @@ void RenderFrameBase::layoutWithFlattening(bool fixedWidth, bool fixedHeight)
     int vBorder = borderTop() + borderBottom();
 
     // make sure minimum preferred width is enforced
-    if (isScrollable || !fixedWidth) {
+    if (isScrollable || !hasFixedWidth) {
         setWidth(max(width(), childRoot->minPreferredLogicalWidth() + hBorder));
         // update again to pass the new width to the child frame
         updateWidgetPosition();
@@ -77,9 +90,9 @@ void RenderFrameBase::layoutWithFlattening(bool fixedWidth, bool fixedHeight)
     }
 
     // expand the frame by setting frame height = content height
-    if (isScrollable || !fixedHeight || childRoot->isFrameSet())
+    if (isScrollable || !hasFixedHeight || childRoot->isFrameSet())
         setHeight(max<LayoutUnit>(height(), childFrameView->contentsHeight() + vBorder));
-    if (isScrollable || !fixedWidth || childRoot->isFrameSet())
+    if (isScrollable || !hasFixedWidth || childRoot->isFrameSet())
         setWidth(max<LayoutUnit>(width(), childFrameView->contentsWidth() + hBorder));
 
     updateWidgetPosition();
diff --git a/Source/WebCore/rendering/RenderFrameSet.cpp b/Source/WebCore/rendering/RenderFrameSet.cpp
index ac449a240..7c89d8db8 100644
--- a/Source/WebCore/rendering/RenderFrameSet.cpp
+++ b/Source/WebCore/rendering/RenderFrameSet.cpp
@@ -667,7 +667,7 @@ bool RenderFrameSet::flattenFrameSet() const
 void RenderFrameSet::startResizing(GridAxis& axis, int position)
 {
     int split = hitTestSplit(axis, position);
-    if (split == noSplit || !axis.m_allowBorder[split] || axis.m_preventResize[split]) {
+    if (split == noSplit || axis.m_preventResize[split]) {
         axis.m_splitBeingResized = noSplit;
         return;
     }
@@ -746,13 +746,13 @@ bool RenderFrameSet::isResizingColumn() const
 bool RenderFrameSet::canResizeRow(const IntPoint& p) const
 {
     int r = hitTestSplit(m_rows, p.y());
-    return r != noSplit && m_rows.m_allowBorder[r] && !m_rows.m_preventResize[r];
+    return r != noSplit && !m_rows.m_preventResize[r];
 }
 
 bool RenderFrameSet::canResizeColumn(const IntPoint& p) const
 {
     int c = hitTestSplit(m_cols, p.x());
-    return c != noSplit && m_cols.m_allowBorder[c] && !m_cols.m_preventResize[c];
+    return c != noSplit && !m_cols.m_preventResize[c];
 }
 
 int RenderFrameSet::splitPosition(const GridAxis& axis, int split) const
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index 09d4e0d31..7049f8b50 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -141,7 +141,10 @@ void RenderImage::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
 
 void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
 {
-    if (documentBeingDestroyed())
+    // FIXME (86669): Instead of the RenderImage determining whether its document is in the page
+    // cache, the RenderImage should remove itself as a client when its document is put into the
+    // page cache.
+    if (documentBeingDestroyed() || document()->inPageCache())
         return;
 
     if (hasBoxDecorations() || hasMask())
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 6804383ed..38a874b4a 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -932,14 +932,7 @@ LayoutRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
     if (!firstLineBoxIncludingCulling() && !continuation())
         return LayoutRect();
 
-    // Find our leftmost position.
-    LayoutRect boundingBox(linesVisualOverflowBoundingBox());
-    LayoutUnit left = boundingBox.x();
-    LayoutUnit top = boundingBox.y();
-
-    // Now invalidate a rectangle.
-    LayoutUnit ow = style() ? style()->outlineSize() : 0;
-
+    LayoutRect repaintRect(linesVisualOverflowBoundingBox());
     bool hitRepaintContainer = false;
 
     // We need to add in the relative position offsets of any inlines (including us) up to our
@@ -952,45 +945,41 @@ LayoutRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
             break;
         }
         if (inlineFlow->style()->position() == RelativePosition && inlineFlow->hasLayer())
-            toRenderInline(inlineFlow)->layer()->relativePositionOffset(left, top);
+            repaintRect.move(toRenderInline(inlineFlow)->layer()->relativePositionOffset());
     }
 
-    LayoutRect r(-ow + left, -ow + top, boundingBox.width() + ow * 2, boundingBox.height() + ow * 2);
+    LayoutUnit outlineSize = style()->outlineSize();
+    repaintRect.inflate(outlineSize);
 
     if (hitRepaintContainer || !cb)
-        return r;
+        return repaintRect;
 
     if (cb->hasColumns())
-        cb->adjustRectForColumns(r);
+        cb->adjustRectForColumns(repaintRect);
 
     if (cb->hasOverflowClip()) {
         // cb->height() is inaccurate if we're in the middle of a layout of |cb|, so use the
         // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
         // anyway if its size does change.
-        LayoutRect repaintRect(r);
         repaintRect.move(-cb->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
 
         LayoutRect boxRect(LayoutPoint(), cb->cachedSizeForOverflowClip());
-        r = intersection(repaintRect, boxRect);
+        repaintRect.intersect(boxRect);
     }
 
-    cb->computeRectForRepaint(repaintContainer, r);
+    cb->computeRectForRepaint(repaintContainer, repaintRect);
 
-    if (ow) {
+    if (outlineSize) {
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
-            if (!curr->isText()) {
-                LayoutRect childRect = curr->rectWithOutlineForRepaint(repaintContainer, ow);
-                r.unite(childRect);
-            }
+            if (!curr->isText())
+                repaintRect.unite(curr->rectWithOutlineForRepaint(repaintContainer, outlineSize));
         }
 
-        if (continuation() && !continuation()->isInline() && continuation()->parent()) {
-            LayoutRect contRect = continuation()->rectWithOutlineForRepaint(repaintContainer, ow);
-            r.unite(contRect);
-        }
+        if (continuation() && !continuation()->isInline() && continuation()->parent())
+            repaintRect.unite(continuation()->rectWithOutlineForRepaint(repaintContainer, outlineSize));
     }
 
-    return r;
+    return repaintRect;
 }
 
 LayoutRect RenderInline::rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, LayoutUnit outlineWidth) const
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 1c1103ce9..a82d9369d 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -452,11 +452,16 @@ void RenderLayer::updateLayerPositions(LayoutPoint* offsetFromRoot, UpdateLayerP
         *offsetFromRoot = oldOffsetFromRoot;
 }
 
-LayoutRect RenderLayer::repaintRectIncludingDescendants() const
+LayoutRect RenderLayer::repaintRectIncludingNonCompositingDescendants() const
 {
     LayoutRect repaintRect = m_repaintRect;
-    for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
-        repaintRect.unite(child->repaintRectIncludingDescendants());
+    for (RenderLayer* child = firstChild(); child; child = child->nextSibling()) {
+        // Don't include repaint rects for composited child layers; they will paint themselves and have a different origin.
+        if (child->isComposited())
+            continue;
+
+        repaintRect.unite(child->repaintRectIncludingNonCompositingDescendants());
+    }
     return repaintRect;
 }
 
@@ -736,17 +741,19 @@ bool RenderLayer::update3DTransformedDescendantStatus()
     if (m_3DTransformedDescendantStatusDirty) {
         m_has3DTransformedDescendant = false;
 
+        updateZOrderLists();
+
         // Transformed or preserve-3d descendants can only be in the z-order lists, not
         // in the normal flow list, so we only need to check those.
-        if (m_posZOrderList) {
-            for (unsigned i = 0; i < m_posZOrderList->size(); ++i)
-                m_has3DTransformedDescendant |= m_posZOrderList->at(i)->update3DTransformedDescendantStatus();
+        if (Vector<RenderLayer*>* positiveZOrderList = posZOrderList()) {
+            for (unsigned i = 0; i < positiveZOrderList->size(); ++i)
+                m_has3DTransformedDescendant |= positiveZOrderList->at(i)->update3DTransformedDescendantStatus();
         }
 
         // Now check our negative z-index children.
-        if (m_negZOrderList) {
-            for (unsigned i = 0; i < m_negZOrderList->size(); ++i)
-                m_has3DTransformedDescendant |= m_negZOrderList->at(i)->update3DTransformedDescendantStatus();
+        if (Vector<RenderLayer*>* negativeZOrderList = negZOrderList()) {
+            for (unsigned i = 0; i < negativeZOrderList->size(); ++i)
+                m_has3DTransformedDescendant |= negativeZOrderList->at(i)->update3DTransformedDescendantStatus();
         }
         
         m_3DTransformedDescendantStatusDirty = false;
@@ -2211,16 +2218,19 @@ PassRefPtr<Scrollbar> RenderLayer::createScrollbar(ScrollbarOrientation orientat
 void RenderLayer::destroyScrollbar(ScrollbarOrientation orientation)
 {
     RefPtr<Scrollbar>& scrollbar = orientation == HorizontalScrollbar ? m_hBar : m_vBar;
-    if (scrollbar) {
+    if (!scrollbar)
+        return;
+
+    if (!scrollbar->isCustomScrollbar()) {
         if (orientation == HorizontalScrollbar)
             willRemoveHorizontalScrollbar(scrollbar.get());
         else
             willRemoveVerticalScrollbar(scrollbar.get());
-
-        scrollbar->removeFromParent();
-        scrollbar->disconnectFromScrollableArea();
-        scrollbar = 0;
     }
+
+    scrollbar->removeFromParent();
+    scrollbar->disconnectFromScrollableArea();
+    scrollbar = 0;
 }
 
 bool RenderLayer::scrollsOverflow() const
@@ -2432,13 +2442,12 @@ void RenderLayer::computeScrollDimensions()
 
     m_scrollDimensionsDirty = false;
 
-    m_scrollOverflow.setWidth(overflowLeft() - box->borderLeft());
-    m_scrollOverflow.setHeight(overflowTop() - box->borderTop());
-
     m_scrollSize.setWidth(overflowRight() - overflowLeft());
     m_scrollSize.setHeight(overflowBottom() - overflowTop());
 
-    setScrollOrigin(IntPoint(-m_scrollOverflow.width(), -m_scrollOverflow.height()));
+    int scrollableLeftOverflow = overflowLeft() - box->borderLeft();
+    int scrollableTopOverflow = overflowTop() - box->borderTop();
+    setScrollOrigin(IntPoint(-scrollableLeftOverflow, -scrollableTopOverflow));
 }
 
 bool RenderLayer::hasHorizontalOverflow() const
@@ -2887,7 +2896,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* context,
         // but we need to ensure that we don't cache clip rects computed with the wrong root in this case.
         if (context->updatingControlTints() || (paintBehavior & PaintBehaviorFlattenCompositingLayers))
             paintFlags |= PaintLayerTemporaryClipRects;
-        else if (!backing()->paintsIntoWindow() && !backing()->paintsIntoCompositedAncestor() && !shouldDoSoftwarePaint(this, paintFlags & PaintLayerPaintingReflection) && !rootLayer->containsDirtyOverlayScrollbars()) {
+        else if (!backing()->paintsIntoWindow() && !backing()->paintsIntoCompositedAncestor() && !shouldDoSoftwarePaint(this, paintFlags & PaintLayerPaintingReflection) && !(rootLayer->containsDirtyOverlayScrollbars() && (paintFlags & PaintLayerPaintingOverlayScrollbars))) {
             // If this RenderLayer should paint into its backing, that will be done via RenderLayerBacking::paintIntoLayer().
             return;
         }
@@ -3080,7 +3089,7 @@ void RenderLayer::paintLayerContents(RenderLayer* rootLayer, GraphicsContext* co
         }
 
         // Now walk the sorted list of children with negative z-indices.
-        paintList(m_negZOrderList, rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot, region, overlapTestRequests, localPaintFlags);
+        paintList(negZOrderList(), rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot, region, overlapTestRequests, localPaintFlags);
     }
     
     if (localPaintFlags & PaintLayerPaintingCompositingForegroundPhase) {
@@ -3127,7 +3136,7 @@ void RenderLayer::paintLayerContents(RenderLayer* rootLayer, GraphicsContext* co
         paintList(m_normalFlowList, rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot, region, overlapTestRequests, localPaintFlags);
     
         // Now walk the sorted list of children with positive z-indices.
-        paintList(m_posZOrderList, rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot, region, overlapTestRequests, localPaintFlags);
+        paintList(posZOrderList(), rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot, region, overlapTestRequests, localPaintFlags);
     }
     
     if ((localPaintFlags & PaintLayerPaintingCompositingMaskPhase) && shouldPaintContent && renderer()->hasMask() && !selectionOnly) {
@@ -3546,7 +3555,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     RenderLayer* candidateLayer = 0;
 
     // Begin by walking our list of positive layers from highest z-index down to the lowest z-index.
-    RenderLayer* hitLayer = hitTestList(m_posZOrderList, rootLayer, request, result, hitTestRect, hitTestPoint,
+    RenderLayer* hitLayer = hitTestList(posZOrderList(), rootLayer, request, result, hitTestRect, hitTestPoint,
                                         localTransformState.get(), zOffsetForDescendantsPtr, zOffset, unflattenedTransformState.get(), depthSortDescendants);
     if (hitLayer) {
         if (!depthSortDescendants)
@@ -3566,7 +3575,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     // Next we want to see if the mouse pos is inside the child RenderObjects of the layer.
     if (fgRect.intersects(hitTestArea) && isSelfPaintingLayer()) {
         // Hit test with a temporary HitTestResult, because we only want to commit to 'result' if we know we're frontmost.
-        HitTestResult tempResult(result.point(), result.topPadding(), result.rightPadding(), result.bottomPadding(), result.leftPadding(), result.shadowContentFilterPolicy());
+        HitTestResult tempResult(result.hitTestPoint(), result.shadowContentFilterPolicy());
         if (hitTestContents(request, tempResult, layerBounds, hitTestPoint, HitTestDescendants) &&
             isHitCandidate(this, false, zOffsetForContentsPtr, unflattenedTransformState.get())) {
             if (result.isRectBasedTest())
@@ -3582,7 +3591,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     }
 
     // Now check our negative z-index children.
-    hitLayer = hitTestList(m_negZOrderList, rootLayer, request, result, hitTestRect, hitTestPoint,
+    hitLayer = hitTestList(negZOrderList(), rootLayer, request, result, hitTestRect, hitTestPoint,
                                         localTransformState.get(), zOffsetForDescendantsPtr, zOffset, unflattenedTransformState.get(), depthSortDescendants);
     if (hitLayer) {
         if (!depthSortDescendants)
@@ -3595,7 +3604,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
         return candidateLayer;
 
     if (bgRect.intersects(hitTestArea) && isSelfPaintingLayer()) {
-        HitTestResult tempResult(result.point(), result.topPadding(), result.rightPadding(), result.bottomPadding(), result.leftPadding(), result.shadowContentFilterPolicy());
+        HitTestResult tempResult(result.hitTestPoint(), result.shadowContentFilterPolicy());
         if (hitTestContents(request, tempResult, layerBounds, hitTestPoint, HitTestSelf) &&
             isHitCandidate(this, false, zOffsetForContentsPtr, unflattenedTransformState.get())) {
             if (result.isRectBasedTest())
@@ -3651,7 +3660,7 @@ RenderLayer* RenderLayer::hitTestList(Vector<RenderLayer*>* list, RenderLayer* r
     for (int i = list->size() - 1; i >= 0; --i) {
         RenderLayer* childLayer = list->at(i);
         RenderLayer* hitLayer = 0;
-        HitTestResult tempResult(result.point(), result.topPadding(), result.rightPadding(), result.bottomPadding(), result.leftPadding(), result.shadowContentFilterPolicy());
+        HitTestResult tempResult(result.hitTestPoint(), result.shadowContentFilterPolicy());
         if (childLayer->isPaginated())
             hitLayer = hitTestPaginatedChildLayer(childLayer, rootLayer, request, tempResult, hitTestRect, hitTestPoint, transformState, zOffsetForDescendants);
         else
@@ -4140,8 +4149,13 @@ IntRect RenderLayer::calculateLayerBounds(const RenderLayer* layer, const Render
 {
     if (!layer->isSelfPaintingLayer())
         return IntRect();
-    
+
     LayoutRect boundingBoxRect = layer->localBoundingBox();
+    if (layer->renderer()->isBox())
+        layer->renderBox()->flipForWritingMode(boundingBoxRect);
+    else
+        layer->renderer()->containingBlock()->flipForWritingMode(boundingBoxRect);
+
     if (layer->renderer()->isRoot()) {
         // If the root layer becomes composited (e.g. because some descendant with negative z-index is composited),
         // then it has to be big enough to cover the viewport in order to display the background. This is akin
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 9b34e7f66..860a37290 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -369,7 +369,6 @@ public:
 
     void updateTransform();
 
-    void relativePositionOffset(LayoutUnit& relX, LayoutUnit& relY) const { relX += m_relativeOffset.width(); relY += m_relativeOffset.height(); }
     const LayoutSize& relativePositionOffset() const { return m_relativeOffset; }
 
     void clearClipRectsIncludingDescendants();
@@ -394,6 +393,8 @@ public:
         return m_posZOrderList;
     }
 
+    bool hasNegativeZOrderList() const { return negZOrderList() && negZOrderList()->size(); }
+
     Vector<RenderLayer*>* negZOrderList() const
     {
         ASSERT(!m_zOrderListsDirty);
@@ -511,7 +512,7 @@ public:
 
     // Return a cached repaint rect, computed relative to the layer renderer's containerForRepaint.
     LayoutRect repaintRect() const { return m_repaintRect; }
-    LayoutRect repaintRectIncludingDescendants() const;
+    LayoutRect repaintRectIncludingNonCompositingDescendants() const;
 
     enum UpdateLayerPositionsAfterScrollFlag {
         NoFlag = 0,
@@ -635,7 +636,7 @@ private:
     void updateScrollbarsAfterLayout();
 
     friend IntSize RenderBox::scrolledContentOffset() const;
-    IntSize scrolledContentOffset() const { return scrollOffset() + m_scrollOverflow; }
+    IntSize scrolledContentOffset() const { return m_scrollOffset; }
 
     // The normal operator new is disallowed on all render objects.
     void* operator new(size_t) throw();
@@ -883,11 +884,9 @@ protected:
     // The layer's width/height
     IntSize m_layerSize;
 
-    // Our scroll offsets if the view is scrolled.
+    // This is the (scroll) offset from scrollOrigin().
     IntSize m_scrollOffset;
 
-    IntSize m_scrollOverflow;
-    
     // The width/height of our scrolled area.
     LayoutSize m_scrollSize;
 
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index 524aaf30a..ee39912a9 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -54,6 +54,8 @@
 #include "StyleResolver.h"
 #include "TiledBacking.h"
 
+#include <wtf/CurrentTime.h>
+
 #if ENABLE(CSS_FILTERS)
 #include "FilterEffectRenderer.h"
 #endif
@@ -323,6 +325,8 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     RenderLayerCompositor* compositor = this->compositor();
     RenderObject* renderer = this->renderer();
 
+    m_owningLayer->updateZOrderLists();
+
     bool layerConfigChanged = false;
     if (updateForegroundLayer(compositor->needsContentsCompositingLayer(m_owningLayer)))
         layerConfigChanged = true;
@@ -1206,6 +1210,9 @@ void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, Graph
         // We have to use the same root as for hit testing, because both methods can compute and cache clipRects.
         paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintBehaviorNormal, paintingPhase, renderer());
 
+        if (m_usingTiledCacheLayer)
+            m_owningLayer->renderer()->frame()->view()->setLastPaintTime(currentTime());
+
         InspectorInstrumentation::didPaint(cookie);
     } else if (graphicsLayer == layerForHorizontalScrollbar()) {
         paintScrollbar(m_owningLayer->horizontalScrollbar(), context, clip);
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index fbed9ae9a..06c62c342 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -576,7 +576,7 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
 {
     if (!canBeComposited(layer))
         return IntRect();
-    return pixelSnappedIntRect(RenderLayer::calculateLayerBounds(layer, ancestorLayer));
+    return RenderLayer::calculateLayerBounds(layer, ancestorLayer);
 }
 
 void RenderLayerCompositor::layerWasAdded(RenderLayer* /*parent*/, RenderLayer* /*child*/)
@@ -1748,7 +1748,7 @@ bool RenderLayerCompositor::isRunningAcceleratedTransformAnimation(RenderObject*
 // object.
 bool RenderLayerCompositor::needsContentsCompositingLayer(const RenderLayer* layer) const
 {
-    return (layer->m_negZOrderList && layer->m_negZOrderList->size() > 0);
+    return layer->hasNegativeZOrderList();
 }
 
 bool RenderLayerCompositor::requiresScrollLayer(RootLayerAttachment attachment) const
@@ -1982,6 +1982,9 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     #ifndef NDEBUG
             m_layerForHorizontalScrollbar->setName("horizontal scrollbar");
     #endif
+    #if PLATFORM(MAC) && USE(CA)
+            m_layerForHorizontalScrollbar->setAcceleratesDrawing(acceleratedDrawingEnabled());
+    #endif
             m_overflowControlsHostLayer->addChild(m_layerForHorizontalScrollbar.get());
 
             if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
@@ -2001,6 +2004,9 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     #ifndef NDEBUG
             m_layerForVerticalScrollbar->setName("vertical scrollbar");
     #endif
+    #if PLATFORM(MAC) && USE(CA)
+            m_layerForVerticalScrollbar->setAcceleratesDrawing(acceleratedDrawingEnabled());
+    #endif
             m_overflowControlsHostLayer->addChild(m_layerForVerticalScrollbar.get());
 
             if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
@@ -2020,6 +2026,9 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     #ifndef NDEBUG
             m_layerForScrollCorner->setName("scroll corner");
     #endif
+    #if PLATFORM(MAC) && USE(CA)
+            m_layerForScrollCorner->setAcceleratesDrawing(acceleratedDrawingEnabled());
+    #endif
             m_overflowControlsHostLayer->addChild(m_layerForScrollCorner.get());
         }
     } else if (m_layerForScrollCorner) {
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index 13f62f431..8a3094443 100755
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -56,6 +56,7 @@
 #include "RenderRegion.h"
 #include "RenderRuby.h"
 #include "RenderRubyText.h"
+#include "RenderScrollbarPart.h"
 #include "RenderTableCaption.h"
 #include "RenderTableCell.h"
 #include "RenderTableCol.h"
@@ -189,8 +190,8 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
     case BOX:
     case INLINE_BOX:
         return new (arena) RenderDeprecatedFlexibleBox(node);
-    case FLEXBOX:
-    case INLINE_FLEXBOX:
+    case FLEX:
+    case INLINE_FLEX:
         return new (arena) RenderFlexibleBox(node);
     }
 
@@ -698,6 +699,8 @@ void RenderObject::setLayerNeedsFullRepaintForPositionedMovementLayout()
 RenderBlock* RenderObject::containingBlock() const
 {
     RenderObject* o = parent();
+    if (!o && isRenderScrollbarPart())
+        o = toRenderScrollbarPart(this)->rendererOwningScrollbar();
     if (!isText() && m_style->position() == FixedPosition) {
         while (o && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock()))
             o = o->parent();
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 6af6e9a2f..9269df1a9 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -355,6 +355,7 @@ public:
 
     virtual bool isRenderFlowThread() const { return false; }
     virtual bool isRenderNamedFlowThread() const { return false; }
+    virtual bool isRenderScrollbarPart() const { return false; }
     bool canHaveRegionStyle() const { return isRenderBlock() && !isAnonymous() && !isRenderFlowThread(); }
 
     bool isRoot() const { return document()->documentElement() == m_node; }
@@ -840,7 +841,7 @@ public:
     virtual bool isFlexingChildren() const { return false; }
     virtual bool isStretchingChildren() const { return false; }
 
-    // Virtual function helper for the new FlexibleBox Layout (display: -webkit-flexbox).
+    // Virtual function helper for the new FlexibleBox Layout (display: -webkit-flex).
     virtual bool isFlexibleBox() const { return false; }
 
     bool isFlexibleBoxIncludingDeprecated() const
diff --git a/Source/WebCore/rendering/RenderQuote.cpp b/Source/WebCore/rendering/RenderQuote.cpp
index 45e5991e7..c4dd0c9d8 100644
--- a/Source/WebCore/rendering/RenderQuote.cpp
+++ b/Source/WebCore/rendering/RenderQuote.cpp
@@ -250,7 +250,7 @@ PassRefPtr<StringImpl> RenderQuote::originalText() const
     switch (m_type) {
     case NO_OPEN_QUOTE:
     case NO_CLOSE_QUOTE:
-        return String("").impl();
+        return emptyString().impl();
     case CLOSE_QUOTE:
         if (index)
             --index;
diff --git a/Source/WebCore/rendering/RenderScrollbar.cpp b/Source/WebCore/rendering/RenderScrollbar.cpp
index 68d4a3bee..f8e33c650 100644
--- a/Source/WebCore/rendering/RenderScrollbar.cpp
+++ b/Source/WebCore/rendering/RenderScrollbar.cpp
@@ -270,11 +270,9 @@ void RenderScrollbar::updateScrollbarPart(ScrollbarPart partType, bool destroy)
     RenderScrollbarPart* partRenderer = m_parts.get(partType);
     if (!partRenderer && needRenderer) {
         partRenderer = new (owningRenderer()->renderArena()) RenderScrollbarPart(owningRenderer()->document(), this, partType);
-        partRenderer->setParent(owningRenderer());
         m_parts.set(partType, partRenderer);
     } else if (partRenderer && !needRenderer) {
         m_parts.remove(partType);
-        partRenderer->setParent(0);
         partRenderer->destroy();
         partRenderer = 0;
     }
diff --git a/Source/WebCore/rendering/RenderScrollbarPart.cpp b/Source/WebCore/rendering/RenderScrollbarPart.cpp
index 1a45be2de..0343ea21d 100644
--- a/Source/WebCore/rendering/RenderScrollbarPart.cpp
+++ b/Source/WebCore/rendering/RenderScrollbarPart.cpp
@@ -184,4 +184,11 @@ void RenderScrollbarPart::paintIntoRect(GraphicsContext* graphicsContext, const
     paint(paintInfo, paintOffset);
 }
 
+RenderObject* RenderScrollbarPart::rendererOwningScrollbar() const
+{
+    if (!m_scrollbar)
+        return 0;
+    return m_scrollbar->owningRenderer();
+}
+
 }
diff --git a/Source/WebCore/rendering/RenderScrollbarPart.h b/Source/WebCore/rendering/RenderScrollbarPart.h
index f481f5a2c..8c7a871fc 100644
--- a/Source/WebCore/rendering/RenderScrollbarPart.h
+++ b/Source/WebCore/rendering/RenderScrollbarPart.h
@@ -35,8 +35,6 @@ class RenderScrollbar;
 
 class RenderScrollbarPart : public RenderBlock {
 public:
-    friend class RenderScrollbar;
-
     RenderScrollbarPart(Node*, RenderScrollbar* = 0, ScrollbarPart = NoPart);
     virtual ~RenderScrollbarPart();
 
@@ -55,6 +53,9 @@ public:
     virtual LayoutUnit marginLeft() const { ASSERT(isIntegerValue(m_marginLeft)); return m_marginLeft; }
     virtual LayoutUnit marginRight() const { ASSERT(isIntegerValue(m_marginRight)); return m_marginRight; }
 
+    virtual bool isRenderScrollbarPart() const { return true; }
+    RenderObject* rendererOwningScrollbar() const;
+
 protected:
     virtual void styleWillChange(StyleDifference diff, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
@@ -71,6 +72,21 @@ private:
     ScrollbarPart m_part;
 };
 
+inline RenderScrollbarPart* toRenderScrollbarPart(RenderObject* object)
+{
+    ASSERT(!object || object->isRenderScrollbarPart());
+    return static_cast<RenderScrollbarPart*>(object);
+}
+
+inline const RenderScrollbarPart* toRenderScrollbarPart(const RenderObject* object)
+{
+    ASSERT(!object || object->isRenderScrollbarPart());
+    return static_cast<const RenderScrollbarPart*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderScrollbarPart(const RenderScrollbarPart*);
+
 } // namespace WebCore
 
 #endif // RenderScrollbarPart_h
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index e7ada7044..28172ef94 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -456,7 +456,7 @@ void RenderTable::layout()
     statePusher.pop();
 
     if (view()->layoutState()->pageLogicalHeight())
-        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(logicalTop()));
+        setPageLogicalOffset(view()->layoutState()->pageLogicalOffset(this, logicalTop()));
 
     bool didFullRepaint = repainter.repaintAfterLayout();
     // Repaint with our new bounds if they are different from our old bounds.
@@ -1215,18 +1215,41 @@ void RenderTable::updateFirstLetter()
 {
 }
 
-LayoutUnit RenderTable::firstLineBoxBaseline() const
+enum LineBox { FirstLineBox, LastLineBox };
+
+static LayoutUnit getLineBoxBaseline(const RenderTable* table, LineBox lineBox)
 {
-    if (isWritingModeRoot())
+    if (table->isWritingModeRoot())
         return -1;
 
-    recalcSectionsIfNeeded();
+    table->recalcSectionsIfNeeded();
 
-    const RenderTableSection* topNonEmptySection = this->topNonEmptySection();
+    const RenderTableSection* topNonEmptySection = table->topNonEmptySection();
     if (!topNonEmptySection)
         return -1;
 
-    return topNonEmptySection->logicalTop() + topNonEmptySection->firstLineBoxBaseline();
+    LayoutUnit baseline = topNonEmptySection->firstLineBoxBaseline();
+    if (baseline > 0)
+        return topNonEmptySection->logicalTop() + baseline;
+
+    // The 'first' linebox baseline in a table in the absence of any text in the first section
+    // is the top of the table.
+    if (lineBox == FirstLineBox)
+        return topNonEmptySection->logicalTop();
+
+    // The 'last' linebox baseline in a table is the baseline of text in the first
+    // cell in the first row/section, so if there is no text do not return a baseline.
+    return -1;
+}
+
+LayoutUnit RenderTable::lastLineBoxBaseline() const
+{
+    return getLineBoxBaseline(this, LastLineBox);
+}
+
+LayoutUnit RenderTable::firstLineBoxBaseline() const
+{
+    return getLineBoxBaseline(this, FirstLineBox);
 }
 
 LayoutRect RenderTable::overflowClipRect(const LayoutPoint& location, RenderRegion* region, OverlayScrollbarSizeRelevancy relevancy)
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index b61c95dc1..1396eeb57 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -237,7 +237,8 @@ private:
     virtual void computePreferredLogicalWidths();
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
     
-    virtual LayoutUnit firstLineBoxBaseline() const;
+    virtual LayoutUnit firstLineBoxBaseline() const OVERRIDE;
+    virtual LayoutUnit lastLineBoxBaseline() const OVERRIDE;
 
     virtual RenderBlock* firstLineBlock() const;
     virtual void updateFirstLetter();
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index ec33a7c9f..fb0fe9200 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -186,6 +186,7 @@ void RenderTableCell::updateLogicalWidth(LayoutUnit w)
 
 void RenderTableCell::layout()
 {
+    updateFirstLetter();
     layoutBlock(cellWidthChanged());
     setCellWidthChanged(false);
 }
@@ -604,7 +605,7 @@ CollapsedBorderValue RenderTableCell::computeCollapsedBeforeBorder(IncludeBorder
             return result;
         
         // (6) Previous row group's after border.
-        currSection = table->sectionAbove(currSection);
+        currSection = table->sectionAbove(currSection, SkipEmptySections);
         if (currSection) {
             result = chooseBorder(CollapsedBorderValue(currSection->style()->borderAfter(), includeColor ? currSection->style()->visitedDependentColor(afterColorProperty) : Color(), BROWGROUP), result);
             if (!result.exists())
@@ -682,7 +683,7 @@ CollapsedBorderValue RenderTableCell::computeCollapsedAfterBorder(IncludeBorderC
             return result;
         
         // (6) Following row group's before border.
-        currSection = table->sectionBelow(currSection);
+        currSection = table->sectionBelow(currSection, SkipEmptySections);
         if (currSection) {
             result = chooseBorder(result, CollapsedBorderValue(currSection->style()->borderBefore(), includeColor ? currSection->style()->visitedDependentColor(beforeColorProperty) : Color(), BROWGROUP));
             if (!result.exists())
diff --git a/Source/WebCore/rendering/RenderTableRow.cpp b/Source/WebCore/rendering/RenderTableRow.cpp
index d9889008b..3caa7b4f3 100644
--- a/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/Source/WebCore/rendering/RenderTableRow.cpp
@@ -148,7 +148,7 @@ void RenderTableRow::layout()
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableCell()) {
             RenderTableCell* cell = toRenderTableCell(child);
-            if (!cell->needsLayout() && paginated && view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(cell->logicalTop()) != cell->pageLogicalOffset())
+            if (!cell->needsLayout() && paginated && view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(cell, cell->logicalTop()) != cell->pageLogicalOffset())
                 cell->setChildNeedsLayout(true, MarkOnlyThis);
 
             if (child->needsLayout()) {
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index a6f544ab5..7f44a75a0 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -370,7 +370,7 @@ int RenderTableSection::calcRowLogicalHeight()
 
             // find out the baseline
             EVerticalAlign va = cell->style()->verticalAlign();
-            if (va == BASELINE || va == TEXT_BOTTOM || va == TEXT_TOP || va == SUPER || va == SUB) {
+            if (va == BASELINE || va == TEXT_BOTTOM || va == TEXT_TOP || va == SUPER || va == SUB || va == LENGTH) {
                 LayoutUnit baselinePosition = cell->cellBaselinePosition();
                 if (baselinePosition > cell->borderBefore() + cell->paddingBefore()) {
                     m_grid[r].baseline = max(m_grid[r].baseline, baselinePosition - cell->intrinsicPaddingBefore());
@@ -609,7 +609,7 @@ void RenderTableSection::layoutRows()
 
                 // If the baseline moved, we may have to update the data for our row. Find out the new baseline.
                 EVerticalAlign va = cell->style()->verticalAlign();
-                if (va == BASELINE || va == TEXT_BOTTOM || va == TEXT_TOP || va == SUPER || va == SUB) {
+                if (va == BASELINE || va == TEXT_BOTTOM || va == TEXT_TOP || va == SUPER || va == SUB || va == LENGTH) {
                     LayoutUnit baseline = cell->cellBaselinePosition();
                     if (baseline > cell->borderBefore() + cell->paddingBefore())
                         m_grid[r].baseline = max(m_grid[r].baseline, baseline);
@@ -618,7 +618,7 @@ void RenderTableSection::layoutRows()
 
             int oldIntrinsicPaddingBefore = cell->intrinsicPaddingBefore();
             int oldIntrinsicPaddingAfter = cell->intrinsicPaddingAfter();
-            int logicalHeightWithoutIntrinsicPadding = cell->logicalHeight() - oldIntrinsicPaddingBefore - oldIntrinsicPaddingAfter;
+            int logicalHeightWithoutIntrinsicPadding = cell->pixelSnappedLogicalHeight() - oldIntrinsicPaddingBefore - oldIntrinsicPaddingAfter;
 
             int intrinsicPaddingBefore = 0;
             switch (cell->style()->verticalAlign()) {
@@ -626,6 +626,7 @@ void RenderTableSection::layoutRows()
                 case SUPER:
                 case TEXT_TOP:
                 case TEXT_BOTTOM:
+                case LENGTH:
                 case BASELINE: {
                     LayoutUnit b = cell->cellBaselinePosition();
                     if (b > cell->borderBefore() + cell->paddingBefore())
@@ -661,7 +662,7 @@ void RenderTableSection::layoutRows()
             if (intrinsicPaddingBefore != oldIntrinsicPaddingBefore || intrinsicPaddingAfter != oldIntrinsicPaddingAfter)
                 cell->setNeedsLayout(true, MarkOnlyThis);
 
-            if (!cell->needsLayout() && view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(cell->logicalTop()) != cell->pageLogicalOffset())
+            if (!cell->needsLayout() && view()->layoutState()->pageLogicalHeight() && view()->layoutState()->pageLogicalOffset(cell, cell->logicalTop()) != cell->pageLogicalOffset())
                 cell->setChildNeedsLayout(true, MarkOnlyThis);
 
             cell->layoutIfNeeded();
@@ -949,7 +950,8 @@ LayoutUnit RenderTableSection::firstLineBoxBaseline() const
     for (size_t i = 0; i < firstRow.size(); ++i) {
         const CellStruct& cs = firstRow.at(i);
         const RenderTableCell* cell = cs.primaryCell();
-        if (cell)
+        // Only cells with content have a baseline
+        if (cell && cell->contentLogicalHeight())
             firstLineBaseline = max(firstLineBaseline, cell->logicalTop() + cell->paddingBefore() + cell->borderBefore() + cell->contentLogicalHeight());
     }
 
diff --git a/Source/WebCore/rendering/RenderTextControl.cpp b/Source/WebCore/rendering/RenderTextControl.cpp
index ddc647570..8b138352e 100644
--- a/Source/WebCore/rendering/RenderTextControl.cpp
+++ b/Source/WebCore/rendering/RenderTextControl.cpp
@@ -208,6 +208,9 @@ bool RenderTextControl::hasValidAvgCharWidth(AtomicString family)
 {
     static HashSet<AtomicString>* fontFamiliesWithInvalidCharWidthMap = 0;
 
+    if (family.isEmpty())
+        return false;
+
     if (!fontFamiliesWithInvalidCharWidthMap) {
         fontFamiliesWithInvalidCharWidthMap = new HashSet<AtomicString>;
 
diff --git a/Source/WebCore/rendering/RenderThemeMac.h b/Source/WebCore/rendering/RenderThemeMac.h
index 22a614a0c..ebbb2352c 100644
--- a/Source/WebCore/rendering/RenderThemeMac.h
+++ b/Source/WebCore/rendering/RenderThemeMac.h
@@ -219,7 +219,7 @@ private:
     NSMenu* searchMenuTemplate() const;
     NSSliderCell* sliderThumbHorizontal() const;
     NSSliderCell* sliderThumbVertical() const;
-    NSTextFieldCell* textField(bool useNewGradient) const;
+    NSTextFieldCell* textField() const;
 
 #if ENABLE(METER_TAG)
     NSLevelIndicatorStyle levelIndicatorStyleFor(ControlPart) const;
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index 5e2d26738..28096e670 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -734,18 +734,22 @@ bool RenderThemeMac::paintTextField(RenderObject* o, const PaintInfo& paintInfo,
 {
     LocalCurrentGraphicsContext localContext(paintInfo.context);
 
-    bool useNewGradient = true;
 #if defined(BUILDING_ON_LION) || defined(BUILDING_ON_SNOW_LEOPARD)
-    // See comment in RenderThemeMac::textField() for a complete explanation of this.
-    useNewGradient = WebCore::deviceScaleFactor(o->frame()) != 1;
-    if (useNewGradient) {
-        useNewGradient = o->style()->hasAppearance()
-            && o->style()->visitedDependentColor(CSSPropertyBackgroundColor) == Color::white
-            && !o->style()->hasBackgroundImage();
+    bool useNSTextFieldCell = o->style()->hasAppearance()
+        && o->style()->visitedDependentColor(CSSPropertyBackgroundColor) == Color::white
+        && !o->style()->hasBackgroundImage();
+
+    // We do not use NSTextFieldCell to draw styled text fields on Lion and SnowLeopard because
+    // there are a number of bugs on those platforms that require NSTextFieldCell to be in charge
+    // of painting its own background. We need WebCore to paint styled backgrounds, so we'll use
+    // this WebCoreSystemInterface function instead.
+    if (!useNSTextFieldCell) {
+        wkDrawBezeledTextFieldCell(r, isEnabled(o) && !isReadOnlyControl(o));
+        return false;
     }
 #endif
 
-    NSTextFieldCell* textField = this->textField(useNewGradient);
+    NSTextFieldCell *textField = this->textField();
 
     GraphicsContextStateSaver stateSaver(*paintInfo.context);
 
@@ -2164,7 +2168,7 @@ NSSliderCell* RenderThemeMac::sliderThumbVertical() const
     return m_sliderThumbVertical.get();
 }
 
-NSTextFieldCell* RenderThemeMac::textField(bool useNewGradient) const
+NSTextFieldCell* RenderThemeMac::textField() const
 {
     if (!m_textField) {
         m_textField.adoptNS([[WebCoreTextFieldCell alloc] initTextCell:@""]);
@@ -2173,27 +2177,15 @@ NSTextFieldCell* RenderThemeMac::textField(bool useNewGradient) const
         [m_textField.get() setFocusRingType:NSFocusRingTypeExterior];
 #if defined(BUILDING_ON_LION) || defined(BUILDING_ON_SNOW_LEOPARD)
         [m_textField.get() setDrawsBackground:YES];
+        [m_textField.get() setBackgroundColor:[NSColor whiteColor]];
 #else
-        UNUSED_PARAM(useNewGradient);
+        // Post-Lion, WebCore can be in charge of paintinng the background thanks to
+        // the workaround in place for <rdar://problem/11385461>, which is implemented
+        // above as _coreUIDrawOptionsWithFrame.
         [m_textField.get() setDrawsBackground:NO];
 #endif
     }
 
-#if defined(BUILDING_ON_LION) || defined(BUILDING_ON_SNOW_LEOPARD)
-    // This is a workaround for <rdar://problem/11385461> on Lion and SnowLeopard. Newer versions of the
-    // OS can always use the newer version of the text field with the workaround above in
-    // _coreUIDrawOptionsWithFrame. With this workaround for older OS's, when the deviceScaleFactor is 1,
-    // we have an old-school gradient bezel in text fields whether they are styled or not. This is fine and
-    // matches shipping Safari. When the deviceScaleFactor is greater than 1, text fields will have newer,
-    // AppKit-matching gradients that look much more appropriate at the higher resolutions. However, if the
-    // text field is styled  in any way, we'll revert to the old-school bezel, which doesn't look great in
-    // HiDPI, but it looks better than the CSS border, which is the only alternative until 11385461 is resolved.
-    if (useNewGradient)
-        [m_textField.get() setBackgroundColor:[NSColor whiteColor]];
-    else
-        [m_textField.get() setBackgroundColor:[NSColor clearColor]];
-#endif
-
     return m_textField.get();
 }
 
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index 4a3a2bc83..43ac53039 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -400,7 +400,7 @@ IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
 {
     document()->updateStyleIfNeeded();
 
-    typedef HashMap<RenderObject*, RenderSelectionInfo*> SelectionMap;
+    typedef HashMap<RenderObject*, OwnPtr<RenderSelectionInfo> > SelectionMap;
     SelectionMap selectedObjects;
 
     RenderObject* os = m_selectionStart;
@@ -408,13 +408,13 @@ IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
     while (os && os != stop) {
         if ((os->canBeSelectionLeaf() || os == m_selectionStart || os == m_selectionEnd) && os->selectionState() != SelectionNone) {
             // Blocks are responsible for painting line gaps and margin gaps. They must be examined as well.
-            selectedObjects.set(os, new RenderSelectionInfo(os, clipToVisibleContent));
+            selectedObjects.set(os, adoptPtr(new RenderSelectionInfo(os, clipToVisibleContent)));
             RenderBlock* cb = os->containingBlock();
             while (cb && !cb->isRenderView()) {
-                RenderSelectionInfo* blockInfo = selectedObjects.get(cb);
+                OwnPtr<RenderSelectionInfo>& blockInfo = selectedObjects.add(cb, nullptr).iterator->second;
                 if (blockInfo)
                     break;
-                selectedObjects.set(cb, new RenderSelectionInfo(cb, clipToVisibleContent));
+                blockInfo = adoptPtr(new RenderSelectionInfo(cb, clipToVisibleContent));
                 cb = cb->containingBlock();
             }
         }
@@ -426,7 +426,7 @@ IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
     LayoutRect selRect;
     SelectionMap::iterator end = selectedObjects.end();
     for (SelectionMap::iterator i = selectedObjects.begin(); i != end; ++i) {
-        RenderSelectionInfo* info = i->second;
+        RenderSelectionInfo* info = i->second.get();
         // RenderSelectionInfo::rect() is in the coordinates of the repaintContainer, so map to page coordinates.
         LayoutRect currRect = info->rect();
         if (RenderBoxModelObject* repaintContainer = info->repaintContainer()) {
@@ -434,7 +434,6 @@ IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
             currRect = absQuad.enclosingBoundingBox(); 
         }
         selRect.unite(currRect);
-        delete info;
     }
     return pixelSnappedIntRect(selRect);
 }
@@ -472,14 +471,14 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     int oldEndPos = m_selectionEndPos;
 
     // Objects each have a single selection rect to examine.
-    typedef HashMap<RenderObject*, RenderSelectionInfo*> SelectedObjectMap;
+    typedef HashMap<RenderObject*, OwnPtr<RenderSelectionInfo> > SelectedObjectMap;
     SelectedObjectMap oldSelectedObjects;
     SelectedObjectMap newSelectedObjects;
 
     // Blocks contain selected objects and fill gaps between them, either on the left, right, or in between lines and blocks.
     // In order to get the repaint rect right, we have to examine left, middle, and right rects individually, since otherwise
     // the union of those rects might remain the same even when changes have occurred.
-    typedef HashMap<RenderBlock*, RenderBlockSelectionInfo*> SelectedBlockMap;
+    typedef HashMap<RenderBlock*, OwnPtr<RenderBlockSelectionInfo> > SelectedBlockMap;
     SelectedBlockMap oldSelectedBlocks;
     SelectedBlockMap newSelectedBlocks;
 
@@ -488,14 +487,14 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     while (os && os != stop) {
         if ((os->canBeSelectionLeaf() || os == m_selectionStart || os == m_selectionEnd) && os->selectionState() != SelectionNone) {
             // Blocks are responsible for painting line gaps and margin gaps.  They must be examined as well.
-            oldSelectedObjects.set(os, new RenderSelectionInfo(os, true));
+            oldSelectedObjects.set(os, adoptPtr(new RenderSelectionInfo(os, true)));
             if (blockRepaintMode == RepaintNewXOROld) {
                 RenderBlock* cb = os->containingBlock();
                 while (cb && !cb->isRenderView()) {
-                    RenderBlockSelectionInfo* blockInfo = oldSelectedBlocks.get(cb);
+                    OwnPtr<RenderBlockSelectionInfo>& blockInfo = oldSelectedBlocks.add(cb, nullptr).iterator->second;
                     if (blockInfo)
                         break;
-                    oldSelectedBlocks.set(cb, new RenderBlockSelectionInfo(cb));
+                    blockInfo = adoptPtr(new RenderBlockSelectionInfo(cb));
                     cb = cb->containingBlock();
                 }
             }
@@ -542,13 +541,13 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     o = start;
     while (o && o != stop) {
         if ((o->canBeSelectionLeaf() || o == start || o == end) && o->selectionState() != SelectionNone) {
-            newSelectedObjects.set(o, new RenderSelectionInfo(o, true));
+            newSelectedObjects.set(o, adoptPtr(new RenderSelectionInfo(o, true)));
             RenderBlock* cb = o->containingBlock();
             while (cb && !cb->isRenderView()) {
-                RenderBlockSelectionInfo* blockInfo = newSelectedBlocks.get(cb);
+                OwnPtr<RenderBlockSelectionInfo>& blockInfo = newSelectedBlocks.add(cb, nullptr).iterator->second;
                 if (blockInfo)
                     break;
-                newSelectedBlocks.set(cb, new RenderBlockSelectionInfo(cb));
+                blockInfo = adoptPtr(new RenderBlockSelectionInfo(cb));
                 cb = cb->containingBlock();
             }
         }
@@ -556,15 +555,8 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         o = o->nextInPreOrder();
     }
 
-    if (!m_frameView || blockRepaintMode == RepaintNothing) {
-        // We built the maps, but we aren't going to use them.
-        // We need to delete the values, otherwise they'll all leak!
-        deleteAllValues(oldSelectedObjects);
-        deleteAllValues(newSelectedObjects);
-        deleteAllValues(oldSelectedBlocks);
-        deleteAllValues(newSelectedBlocks);
+    if (!m_frameView || blockRepaintMode == RepaintNothing)
         return;
-    }
 
     m_frameView->beginDeferredRepaints();
 
@@ -572,7 +564,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     for (SelectedObjectMap::iterator i = oldSelectedObjects.begin(); i != oldObjectsEnd; ++i) {
         RenderObject* obj = i->first;
         RenderSelectionInfo* newInfo = newSelectedObjects.get(obj);
-        RenderSelectionInfo* oldInfo = i->second;
+        RenderSelectionInfo* oldInfo = i->second.get();
         if (!newInfo || oldInfo->rect() != newInfo->rect() || oldInfo->state() != newInfo->state() ||
             (m_selectionStart == obj && oldStartPos != m_selectionStartPos) ||
             (m_selectionEnd == obj && oldEndPos != m_selectionEndPos)) {
@@ -580,44 +572,34 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
             if (newInfo) {
                 newInfo->repaint();
                 newSelectedObjects.remove(obj);
-                delete newInfo;
             }
         }
-        delete oldInfo;
     }
 
     // Any new objects that remain were not found in the old objects dict, and so they need to be updated.
     SelectedObjectMap::iterator newObjectsEnd = newSelectedObjects.end();
-    for (SelectedObjectMap::iterator i = newSelectedObjects.begin(); i != newObjectsEnd; ++i) {
-        RenderSelectionInfo* newInfo = i->second;
-        newInfo->repaint();
-        delete newInfo;
-    }
+    for (SelectedObjectMap::iterator i = newSelectedObjects.begin(); i != newObjectsEnd; ++i)
+        i->second->repaint();
 
     // Have any of the old blocks changed?
     SelectedBlockMap::iterator oldBlocksEnd = oldSelectedBlocks.end();
     for (SelectedBlockMap::iterator i = oldSelectedBlocks.begin(); i != oldBlocksEnd; ++i) {
         RenderBlock* block = i->first;
         RenderBlockSelectionInfo* newInfo = newSelectedBlocks.get(block);
-        RenderBlockSelectionInfo* oldInfo = i->second;
+        RenderBlockSelectionInfo* oldInfo = i->second.get();
         if (!newInfo || oldInfo->rects() != newInfo->rects() || oldInfo->state() != newInfo->state()) {
             oldInfo->repaint();
             if (newInfo) {
                 newInfo->repaint();
                 newSelectedBlocks.remove(block);
-                delete newInfo;
             }
         }
-        delete oldInfo;
     }
 
     // Any new blocks that remain were not found in the old blocks dict, and so they need to be updated.
     SelectedBlockMap::iterator newBlocksEnd = newSelectedBlocks.end();
-    for (SelectedBlockMap::iterator i = newSelectedBlocks.begin(); i != newBlocksEnd; ++i) {
-        RenderBlockSelectionInfo* newInfo = i->second;
-        newInfo->repaint();
-        delete newInfo;
-    }
+    for (SelectedBlockMap::iterator i = newSelectedBlocks.begin(); i != newBlocksEnd; ++i)
+        i->second->repaint();
 
     m_frameView->endDeferredRepaints();
 }
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index 9b973b3b2..bcbe7bd89 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -708,7 +708,7 @@ LayoutRect RootInlineBox::paddedLayoutOverflowRect(LayoutUnit endPadding) const
     return lineLayoutOverflow;
 }
 
-static void setAscentAndDescent(LayoutUnit& ascent, LayoutUnit& descent, LayoutUnit newAscent, LayoutUnit newDescent, bool& ascentDescentSet)
+static void setAscentAndDescent(int& ascent, int& descent, int newAscent, int newDescent, bool& ascentDescentSet)
 {
     if (!ascentDescentSet) {
         ascentDescentSet = true;
@@ -720,7 +720,7 @@ static void setAscentAndDescent(LayoutUnit& ascent, LayoutUnit& descent, LayoutU
     }
 }
 
-void RootInlineBox::ascentAndDescentForBox(InlineBox* box, GlyphOverflowAndFallbackFontsMap& textBoxDataMap, LayoutUnit& ascent, LayoutUnit& descent,
+void RootInlineBox::ascentAndDescentForBox(InlineBox* box, GlyphOverflowAndFallbackFontsMap& textBoxDataMap, int& ascent, int& descent,
                                            bool& affectsAscent, bool& affectsDescent) const
 {
     bool ascentDescentSet = false;
@@ -757,11 +757,11 @@ void RootInlineBox::ascentAndDescentForBox(InlineBox* box, GlyphOverflowAndFallb
         usedFonts->append(box->renderer()->style(isFirstLineStyle())->font().primaryFont());
         for (size_t i = 0; i < usedFonts->size(); ++i) {
             const FontMetrics& fontMetrics = usedFonts->at(i)->fontMetrics();
-            LayoutUnit usedFontAscent = fontMetrics.ascent(baselineType());
-            LayoutUnit usedFontDescent = fontMetrics.descent(baselineType());
-            LayoutUnit halfLeading = (fontMetrics.lineSpacing() - fontMetrics.height()) / 2;
-            LayoutUnit usedFontAscentAndLeading = usedFontAscent + halfLeading;
-            LayoutUnit usedFontDescentAndLeading = fontMetrics.lineSpacing() - usedFontAscentAndLeading;
+            int usedFontAscent = fontMetrics.ascent(baselineType());
+            int usedFontDescent = fontMetrics.descent(baselineType());
+            int halfLeading = (fontMetrics.lineSpacing() - fontMetrics.height()) / 2;
+            int usedFontAscentAndLeading = usedFontAscent + halfLeading;
+            int usedFontDescentAndLeading = fontMetrics.lineSpacing() - usedFontAscentAndLeading;
             if (includeFont) {
                 setAscentAndDescent(ascent, descent, usedFontAscent, usedFontDescent, ascentDescentSet);
                 setUsedFont = true;
@@ -779,8 +779,8 @@ void RootInlineBox::ascentAndDescentForBox(InlineBox* box, GlyphOverflowAndFallb
 
     // If leading is included for the box, then we compute that box.
     if (includeLeading && !setUsedFontWithLeading) {
-        LayoutUnit ascentWithLeading = box->baselinePosition(baselineType());
-        LayoutUnit descentWithLeading = box->lineHeight() - ascentWithLeading;
+        int ascentWithLeading = box->baselinePosition(baselineType());
+        int descentWithLeading = box->lineHeight() - ascentWithLeading;
         setAscentAndDescent(ascent, descent, ascentWithLeading, descentWithLeading, ascentDescentSet);
         
         // Examine the font box for inline flows and text boxes to see if any part of it is above the baseline.
@@ -792,8 +792,8 @@ void RootInlineBox::ascentAndDescentForBox(InlineBox* box, GlyphOverflowAndFallb
     }
     
     if (includeFontForBox(box) && !setUsedFont) {
-        LayoutUnit fontAscent = box->renderer()->style(isFirstLineStyle())->fontMetrics().ascent();
-        LayoutUnit fontDescent = box->renderer()->style(isFirstLineStyle())->fontMetrics().descent();
+        int fontAscent = box->renderer()->style(isFirstLineStyle())->fontMetrics().ascent();
+        int fontDescent = box->renderer()->style(isFirstLineStyle())->fontMetrics().descent();
         setAscentAndDescent(ascent, descent, fontAscent, fontDescent, ascentDescentSet);
         affectsAscent = fontAscent - box->logicalTop() > 0;
         affectsDescent = fontDescent + box->logicalTop() > 0; 
diff --git a/Source/WebCore/rendering/RootInlineBox.h b/Source/WebCore/rendering/RootInlineBox.h
index 49aed00da..2edbddb2c 100644
--- a/Source/WebCore/rendering/RootInlineBox.h
+++ b/Source/WebCore/rendering/RootInlineBox.h
@@ -151,7 +151,7 @@ public:
 
     LayoutRect paddedLayoutOverflowRect(LayoutUnit endPadding) const;
 
-    void ascentAndDescentForBox(InlineBox*, GlyphOverflowAndFallbackFontsMap&, LayoutUnit& ascent, LayoutUnit& descent, bool& affectsAscent, bool& affectsDescent) const;
+    void ascentAndDescentForBox(InlineBox*, GlyphOverflowAndFallbackFontsMap&, int& ascent, int& descent, bool& affectsAscent, bool& affectsDescent) const;
     LayoutUnit verticalPositionForBox(InlineBox*, VerticalPositionCache&);
     bool includeLeadingForBox(InlineBox*) const;
     bool includeFontForBox(InlineBox*) const;
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp b/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
index 4297dd7ff..351f99e84 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
@@ -48,6 +48,7 @@ RenderMathMLFenced::RenderMathMLFenced(Element* element)
     : RenderMathMLRow(element)
     , m_open(OpeningBraceChar)
     , m_close(ClosingBraceChar)
+    , m_closeFenceRenderer(0)
 {
 }
 
@@ -94,49 +95,67 @@ void RenderMathMLFenced::makeFences()
     RenderObject* openFence = new (renderArena()) RenderMathMLOperator(node(), m_open);
     openFence->setStyle(createOperatorStyle());
     RenderBlock::addChild(openFence, firstChild());
-    RenderObject* closeFence = new (renderArena()) RenderMathMLOperator(node(), m_close);
-    closeFence->setStyle(createOperatorStyle());
-    RenderBlock::addChild(closeFence);
+    m_closeFenceRenderer = new (renderArena()) RenderMathMLOperator(node(), m_close);
+    m_closeFenceRenderer->setStyle(createOperatorStyle());
+    RenderBlock::addChild(m_closeFenceRenderer);
 }
 
-void RenderMathMLFenced::addChild(RenderObject* child, RenderObject*)
+void RenderMathMLFenced::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     // make the fences if the render object is empty
     if (isEmpty())
         updateFromElement();
     
+    // FIXME: Adding or removing a child should possibly cause all later separators to shift places if they're different,
+    // as later child positions change by +1 or -1.
+    
+    RenderObject* separatorRenderer = 0;
     if (m_separators.get()) {
         unsigned int count = 0;
         for (Node* position = child->node(); position; position = position->previousSibling()) {
-            if (position->nodeType() == Node::ELEMENT_NODE)
+            if (position->isElementNode())
                 count++;
         }
-                
-        if (count > 1) {
+        if (!beforeChild) {
+            // We're adding at the end (before the closing fence), so a new separator would go before the new child, not after it.
+            --count;
+        }
+        // |count| is now the number of element children that will be before our new separator, i.e. it's the 1-based index of the separator.
+        
+        if (count > 0) {
             UChar separator;
             
             // Use the last separator if we've run out of specified separators.
-            if ((count - 1) >= m_separators.get()->length())
+            if (count > m_separators.get()->length())
                 separator = (*m_separators.get())[m_separators.get()->length() - 1];
             else
-                separator = (*m_separators.get())[count - 2];
+                separator = (*m_separators.get())[count - 1];
                 
-            RenderObject* separatorObj = new (renderArena()) RenderMathMLOperator(node(), separator);
-            separatorObj->setStyle(createOperatorStyle());
-            RenderBlock::addChild(separatorObj, lastChild());
+            separatorRenderer = new (renderArena()) RenderMathMLOperator(node(), separator);
+            separatorRenderer->setStyle(createOperatorStyle());
         }
     }
     
     // If we have a block, we'll wrap it in an inline-block.
     if (child->isBlockFlow() && child->style()->display() != INLINE_BLOCK) {
         // Block objects wrapper.
-
         RenderBlock* block = createAlmostAnonymousBlock(INLINE_BLOCK);
         
-        RenderBlock::addChild(block, lastChild());
-        block->addChild(child);    
-    } else
-        RenderBlock::addChild(child, lastChild());
+        block->addChild(child);
+        child = block;
+    }
+    
+    if (beforeChild) {
+        // Adding |x| before an existing |y| e.g. in element (y) - first insert our new child |x|, then its separator, to get (x, y).
+        RenderBlock::addChild(child, beforeChild);
+        if (separatorRenderer)
+            RenderBlock::addChild(separatorRenderer, beforeChild);
+    } else {
+        // Adding |y| at the end of an existing element e.g. (x) - insert the separator first before the closing fence, then |y|, to get (x, y).
+        if (separatorRenderer)
+            RenderBlock::addChild(separatorRenderer, m_closeFenceRenderer);
+        RenderBlock::addChild(child, m_closeFenceRenderer);
+    }
 }
 
 }    
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFenced.h b/Source/WebCore/rendering/mathml/RenderMathMLFenced.h
index b2bca9971..75324dcdc 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFenced.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFenced.h
@@ -47,6 +47,8 @@ private:
     UChar m_open;
     UChar m_close;
     RefPtr<StringImpl> m_separators;
+    
+    RenderObject* m_closeFenceRenderer;
 };
     
 }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
index e6d5165a9..efeed1a1f 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
@@ -31,15 +31,12 @@
 #include "RenderMathMLRoot.h"
 
 #include "GraphicsContext.h"
-#include "MathMLNames.h"
 #include "PaintInfo.h"
 
 using namespace std;
 
 namespace WebCore {
     
-using namespace MathMLNames;
-
 // FIXME: This whole file should be changed to work with various writing modes. See https://bugs.webkit.org/show_bug.cgi?id=48951.
 
 // Threshold above which the radical shape is modified to look nice with big bases (em)
@@ -54,8 +51,10 @@ const float gRadicalBottomPointXFront = 0.5f;
 const int gRadicalBottomPointLower = 3;
 // Horizontal position of the top left point of the radical "dip" (* frontWidth)
 const float gRadicalDipLeftPointXFront = 0.8f;
-// Vertical position of the top left point of the radical "dip" (* baseHeight)
-const float gRadicalDipLeftPointYPos = 0.625f; 
+// Vertical position of the top left point of a sqrt radical "dip" (* baseHeight)
+const float gSqrtRadicalDipLeftPointYPos = 0.5f;
+// Vertical position of the top left point of an nth root radical "dip" (* baseHeight)
+const float gRootRadicalDipLeftPointYPos = 0.625f;
 // Vertical shift of the left end point of the radical (em)
 const float gRadicalLeftEndYShiftEms = 0.05f;
 // Additional bottom root padding if baseHeight > threshold (em)
@@ -81,6 +80,65 @@ RenderBoxModelObject* RenderMathMLRoot::index() const
     return toRenderBoxModelObject(index);
 }
 
+void RenderMathMLRoot::computePreferredLogicalWidths()
+{
+    ASSERT(preferredLogicalWidthsDirty() && needsLayout());
+    
+    computeChildrenPreferredLogicalHeights();
+    
+    int baseHeight = firstChild() ? roundToInt(preferredLogicalHeightAfterSizing(firstChild())) : 0;
+    
+    int frontWidth = lroundf(gFrontWidthEms * style()->fontSize());
+    
+    // Base height above which the shape of the root changes
+    float thresholdHeight = gThresholdBaseHeightEms * style()->fontSize();
+    if (baseHeight > thresholdHeight && thresholdHeight) {
+        float shift = min<float>((baseHeight - thresholdHeight) / thresholdHeight, 1.0f);
+        m_overbarLeftPointShift = static_cast<int>(shift * gRadicalBottomPointXFront * frontWidth);
+        m_intrinsicPaddingAfter = lroundf(gBigRootBottomPaddingEms * style()->fontSize());
+    } else {
+        m_overbarLeftPointShift = 0;
+        m_intrinsicPaddingAfter = 0;
+    }
+    
+    int rootPad = lroundf(gSpaceAboveEms * style()->fontSize());
+    m_intrinsicPaddingBefore = rootPad;
+    m_indexTop = 0;
+    if (RenderBoxModelObject* index = this->index()) {
+        m_intrinsicPaddingStart = roundToInt(index->maxPreferredLogicalWidth()) + m_overbarLeftPointShift;
+        
+        int indexHeight = roundToInt(preferredLogicalHeightAfterSizing(index));
+        int partDipHeight = lroundf((1 - gRootRadicalDipLeftPointYPos) * baseHeight);
+        int rootExtraTop = partDipHeight + indexHeight - (baseHeight + rootPad);
+        if (rootExtraTop > 0)
+            m_intrinsicPaddingBefore += rootExtraTop;
+        else
+            m_indexTop = - rootExtraTop;
+    } else
+        m_intrinsicPaddingStart = frontWidth;
+    
+    RenderMathMLBlock::computePreferredLogicalWidths();
+    
+    // Shrink our logical width to its probable value now without triggering unnecessary relayout of our children.
+    ASSERT(needsLayout() && logicalWidth() >= maxPreferredLogicalWidth());
+    setLogicalWidth(maxPreferredLogicalWidth());
+}
+
+void RenderMathMLRoot::layout()
+{
+    // Our computePreferredLogicalWidths() may change our logical width and then layout our children, which
+    // RenderBlock::layout()'s relayoutChildren logic isn't expecting.
+    if (preferredLogicalWidthsDirty())
+        computePreferredLogicalWidths();
+    
+    RenderMathMLBlock::layout();
+    
+    RenderBoxModelObject* index = this->index();
+    // If |index|, it should be a RenderBlock here, unless the user has overriden its { position: absolute }.
+    if (index && index->isBox())
+        toRenderBox(index)->setLogicalTop(m_indexTop);
+}
+
 void RenderMathMLRoot::paint(PaintInfo& info, const LayoutPoint& paintOffset)
 {
     RenderMathMLBlock::paint(info, paintOffset);
@@ -88,24 +146,21 @@ void RenderMathMLRoot::paint(PaintInfo& info, const LayoutPoint& paintOffset)
     if (info.context->paintingDisabled())
         return;
     
-    if (!index())
-        return;
+    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location() + contentBoxRect().location());
     
-    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location() + computedCSSContentBoxRect().location());
+    int startX = adjustedPaintOffset.x();
+    int frontWidth = lroundf(gFrontWidthEms * style()->fontSize());
+    int overbarWidth = roundToInt(getBoxModelObjectWidth(firstChild())) + m_overbarLeftPointShift;
     
     int baseHeight = roundToInt(getBoxModelObjectHeight(firstChild()));
+    int rootPad = lroundf(gSpaceAboveEms * style()->fontSize());
+    adjustedPaintOffset.setY(adjustedPaintOffset.y() - rootPad);
     
-    int overbarWidth = roundToInt(getBoxModelObjectWidth(firstChild())) + m_overbarLeftPointShift;
-    int indexWidth = index()->pixelSnappedOffsetWidth();
-    int frontWidth = static_cast<int>(roundf(gFrontWidthEms * style()->fontSize()));
-    int startX = adjustedPaintOffset.x() + indexWidth + m_overbarLeftPointShift;
-    
-    int rootPad = static_cast<int>(roundf(gSpaceAboveEms * style()->fontSize()));
-    adjustedPaintOffset.setY(adjustedPaintOffset.y() + m_intrinsicPaddingBefore - rootPad);
+    float radicalDipLeftPointYPos = (index() ? gRootRadicalDipLeftPointYPos : gSqrtRadicalDipLeftPointYPos) * baseHeight;
     
     FloatPoint overbarLeftPoint(startX - m_overbarLeftPointShift, adjustedPaintOffset.y());
     FloatPoint bottomPoint(startX - gRadicalBottomPointXFront * frontWidth, adjustedPaintOffset.y() + baseHeight + gRadicalBottomPointLower);
-    FloatPoint dipLeftPoint(startX - gRadicalDipLeftPointXFront * frontWidth, adjustedPaintOffset.y() + gRadicalDipLeftPointYPos * baseHeight);
+    FloatPoint dipLeftPoint(startX - gRadicalDipLeftPointXFront * frontWidth, adjustedPaintOffset.y() + radicalDipLeftPointYPos);
     FloatPoint leftEnd(startX - frontWidth, dipLeftPoint.y() + gRadicalLeftEndYShiftEms * style()->fontSize());
     
     GraphicsContextStateSaver stateSaver(*info.context);
@@ -153,46 +208,6 @@ void RenderMathMLRoot::paint(PaintInfo& info, const LayoutPoint& paintOffset)
     info.context->strokePath(line);
 }
 
-void RenderMathMLRoot::layout()
-{
-    RenderBlock::layout();
-
-    if (!index())
-        return;
-
-    int baseHeight = roundToInt(getBoxModelObjectHeight(firstChild()));
-    
-    // Base height above which the shape of the root changes
-    float thresholdHeight = gThresholdBaseHeightEms * style()->fontSize();
-    if (baseHeight > thresholdHeight && thresholdHeight) {
-        float shift = min<float>((baseHeight - thresholdHeight) / thresholdHeight, 1.0f);
-        int frontWidth = static_cast<int>(roundf(gFrontWidthEms * style()->fontSize()));
-        m_overbarLeftPointShift = static_cast<int>(shift * gRadicalBottomPointXFront * frontWidth);
-        m_intrinsicPaddingAfter = static_cast<int>(roundf(gBigRootBottomPaddingEms * style()->fontSize()));
-    } else {
-        m_overbarLeftPointShift = 0;
-        m_intrinsicPaddingAfter = 0;
-    }
-    
-    RenderBoxModelObject* index = this->index();
-    
-    m_intrinsicPaddingStart = index->pixelSnappedOffsetWidth() + m_overbarLeftPointShift;
-    
-    int rootPad = static_cast<int>(roundf(gSpaceAboveEms * style()->fontSize()));
-    int partDipHeight = static_cast<int>(roundf((1 - gRadicalDipLeftPointYPos) * baseHeight));
-    int rootExtraTop = partDipHeight + index->pixelSnappedOffsetHeight() - (baseHeight + rootPad);
-    m_intrinsicPaddingBefore = rootPad + max(rootExtraTop, 0);
-    
-    setNeedsLayout(true, MarkOnlyThis);
-    setPreferredLogicalWidthsDirty(true, MarkOnlyThis); // FIXME: Can this really be right?
-    // FIXME: Preferred logical widths are currently wrong the first time through, relying on layout() to set m_intrinsicPaddingStart.
-    RenderBlock::layout();
-    
-    // |index| should be a RenderBlock here, unless the user has overriden its { position: absolute }.
-    if (rootExtraTop < 0 && index->isBox())
-        toRenderBox(index)->setLogicalTop(-rootExtraTop);
-}
-
 }
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.h b/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
index 65ec82dc7..cd5d6e6e2 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
@@ -32,7 +32,7 @@
 
 namespace WebCore {
     
-// Render base^(1/index), using radical notation.
+// Render base^(1/index), or sqrt(base) via the derived class RenderMathMLSquareRoot, using radical notation.
 class RenderMathMLRoot : public RenderMathMLBlock {
 public:
     RenderMathMLRoot(Element*);
@@ -45,10 +45,13 @@ protected:
 private:
     virtual const char* renderName() const { return "RenderMathMLRoot"; }
     
+    virtual void computePreferredLogicalWidths() OVERRIDE;
+    
     // This may return 0 for a non-MathML index (which won't occur in valid MathML).
     RenderBoxModelObject* index() const;
     
     int m_overbarLeftPointShift;
+    int m_indexTop;
 };
     
 }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
index 86975dbfb..b4b07a2cf 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
@@ -30,45 +30,12 @@
 
 #include "RenderMathMLSquareRoot.h"
 
-#include "GraphicsContext.h"
-#include "MathMLNames.h"
-#include "PaintInfo.h"
 #include "RenderMathMLRow.h"
 
-using namespace std;
-
 namespace WebCore {
     
-using namespace MathMLNames;
-
-// FIXME: This whole file should be changed to work with various writing modes. See https://bugs.webkit.org/show_bug.cgi?id=48951.
-
-// Threshold above which the radical shape is modified to look nice with big bases (em)
-const float gThresholdBaseHeightEms = 1.5f;
-// Normal width of the front of the radical sign, before the base & overbar (em)
-const float gFrontWidthEms = 0.75f;
-// Gap between the base and overbar (em)
-const float gSpaceAboveEms = 0.2f;
-// Horizontal position of the bottom point of the radical (* frontWidth)
-const float gRadicalBottomPointXFront = 0.5f;
-// Lower the radical sign's bottom point (px)
-const int gRadicalBottomPointLower = 3;
-// Horizontal position of the top left point of the radical "dip" (* frontWidth)
-const float gRadicalDipLeftPointXFront = 0.8f;
-// Vertical position of the top left point of the radical "dip" (* baseHeight)
-const float gRadicalDipLeftPointYPos = 0.5f; 
-// Vertical shift of the left end point of the radical (em)
-const float gRadicalLeftEndYShiftEms = 0.05f;
-// Additional bottom root padding if baseHeight > threshold (em)
-const float gBigRootBottomPaddingEms = 0.2f;
-
-// Radical line thickness (em)
-const float gRadicalLineThicknessEms = 0.02f;
-// Radical thick line thickness (em)
-const float gRadicalThickLineThicknessEms = 0.1f;
-    
 RenderMathMLSquareRoot::RenderMathMLSquareRoot(Element* element)
-    : RenderMathMLBlock(element)
+    : RenderMathMLRoot(element)
 {
 }
 
@@ -77,7 +44,7 @@ void RenderMathMLSquareRoot::addChild(RenderObject* newChild, RenderObject* befo
     if (!firstChild()) {
         RenderMathMLRow* newMRow = RenderMathMLRow::createAnonymousWithParentRenderer(this);
         
-        RenderMathMLBlock::addChild(newMRow);
+        RenderMathMLRoot::addChild(newMRow);
         
         // newMRow->isAnonymousBlock() is false because newMRow's display is INLINE_BLOCK,
         // so we don't need to worry about removeLeftoverAnonymousBlock().
@@ -88,106 +55,6 @@ void RenderMathMLSquareRoot::addChild(RenderObject* newChild, RenderObject* befo
     firstChild()->addChild(newChild, beforeChild);
 }
 
-void RenderMathMLSquareRoot::computePreferredLogicalWidths()
-{
-    m_intrinsicPaddingStart = static_cast<int>(roundf(gFrontWidthEms * style()->fontSize()));
-    
-    RenderMathMLBlock::computePreferredLogicalWidths();
-}
-
-void RenderMathMLSquareRoot::computeLogicalHeight()
-{
-    int baseHeight = roundToInt(getBoxModelObjectHeight(firstChild()));
-    float thresholdHeight = gThresholdBaseHeightEms * style()->fontSize();
-    m_intrinsicPaddingAfter = baseHeight > thresholdHeight ? static_cast<int>(roundf(gBigRootBottomPaddingEms * style()->fontSize())) : 0;
-    setLogicalHeight(baseHeight + borderAndPaddingLogicalHeight());
-    
-    RenderMathMLBlock::computeLogicalHeight();
-}
-
-void RenderMathMLSquareRoot::layout()
-{
-    m_intrinsicPaddingBefore = static_cast<int>(roundf(gSpaceAboveEms * style()->fontSize()));
-    
-    RenderMathMLBlock::layout();
-}
-
-void RenderMathMLSquareRoot::paint(PaintInfo& info, const LayoutPoint& paintOffset)
-{
-    RenderMathMLBlock::paint(info, paintOffset);
-    
-    if (info.context->paintingDisabled())
-        return;
-
-    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location() + computedCSSContentBoxRect().location());
-    
-    int baseHeight = roundToInt(getBoxModelObjectHeight(firstChild()));
-    int overbarWidth = roundToInt(getBoxModelObjectWidth(firstChild()));
-    
-    int frontWidth = m_intrinsicPaddingStart;
-    int overbarLeftPointShift = 0;
-    // Base height above which the shape of the root changes
-    float thresholdHeight = gThresholdBaseHeightEms * style()->fontSize();
-    
-    if (baseHeight > thresholdHeight && thresholdHeight) {
-        float shift = min<float>((baseHeight - thresholdHeight) / thresholdHeight, 1.0f);
-        overbarLeftPointShift = static_cast<int>(shift * gRadicalBottomPointXFront * frontWidth);
-    }
-    
-    overbarWidth += overbarLeftPointShift;
-    
-    int startX = adjustedPaintOffset.x() + frontWidth;
-    
-    FloatPoint overbarLeftPoint(startX - overbarLeftPointShift, adjustedPaintOffset.y());
-    FloatPoint bottomPoint(startX - gRadicalBottomPointXFront * frontWidth, adjustedPaintOffset.y() + baseHeight + gRadicalBottomPointLower);
-    FloatPoint dipLeftPoint(startX - gRadicalDipLeftPointXFront * frontWidth, adjustedPaintOffset.y() + gRadicalDipLeftPointYPos * baseHeight);
-    FloatPoint leftEnd(startX - frontWidth, dipLeftPoint.y() + gRadicalLeftEndYShiftEms * style()->fontSize());
-    
-    GraphicsContextStateSaver stateSaver(*info.context);
-    
-    info.context->setStrokeThickness(gRadicalLineThicknessEms * style()->fontSize());
-    info.context->setStrokeStyle(SolidStroke);
-    info.context->setStrokeColor(style()->visitedDependentColor(CSSPropertyColor), ColorSpaceDeviceRGB);
-    info.context->setLineJoin(MiterJoin);
-    info.context->setMiterLimit(style()->fontSize());
-    
-    Path root;
-    
-    root.moveTo(FloatPoint(overbarLeftPoint.x() + overbarWidth, adjustedPaintOffset.y()));
-    // draw top
-    root.addLineTo(overbarLeftPoint);
-    // draw from top left corner to bottom point of radical
-    root.addLineTo(bottomPoint);
-    // draw from bottom point to top of left part of radical base "dip"
-    root.addLineTo(dipLeftPoint);
-    // draw to end
-    root.addLineTo(leftEnd);
-    
-    info.context->strokePath(root);
-    
-    GraphicsContextStateSaver maskStateSaver(*info.context);
-    
-    // Build a mask to draw the thick part of the root.
-    Path mask;
-    
-    mask.moveTo(overbarLeftPoint);
-    mask.addLineTo(bottomPoint);
-    mask.addLineTo(dipLeftPoint);
-    mask.addLineTo(FloatPoint(2 * dipLeftPoint.x() - leftEnd.x(), 2 * dipLeftPoint.y() - leftEnd.y()));
-    
-    info.context->clip(mask);
-    
-    // Draw the thick part of the root.
-    info.context->setStrokeThickness(gRadicalThickLineThicknessEms * style()->fontSize());
-    info.context->setLineCap(SquareCap);
-    
-    Path line;
-    line.moveTo(bottomPoint);
-    line.addLineTo(dipLeftPoint);
-    
-    info.context->strokePath(line);
-}
-
 }
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
index ea6d324db..b0270efbb 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
@@ -28,12 +28,12 @@
 
 #if ENABLE(MATHML)
 
-#include "RenderMathMLBlock.h"
+#include "RenderMathMLRoot.h"
 
 namespace WebCore {
     
 // Render sqrt(base), using radical notation.
-class RenderMathMLSquareRoot : public RenderMathMLBlock {
+class RenderMathMLSquareRoot : public RenderMathMLRoot {
 public:
     RenderMathMLSquareRoot(Element*);
     
@@ -43,12 +43,6 @@ private:
     virtual const char* renderName() const { return "RenderMathMLSquareRoot"; }
     
     virtual bool createsAnonymousWrapper() const OVERRIDE { return true; }
-    
-    virtual void computePreferredLogicalWidths() OVERRIDE;
-    virtual void computeLogicalHeight() OVERRIDE;
-    virtual void layout() OVERRIDE;
-    
-    virtual void paint(PaintInfo&, const LayoutPoint&) OVERRIDE;
 };
     
 }
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 741acc6e5..a24ac9dc8 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -410,7 +410,7 @@ enum EDisplay {
     TABLE_HEADER_GROUP, TABLE_FOOTER_GROUP, TABLE_ROW,
     TABLE_COLUMN_GROUP, TABLE_COLUMN, TABLE_CELL,
     TABLE_CAPTION, BOX, INLINE_BOX, 
-    FLEXBOX, INLINE_FLEXBOX,
+    FLEX, INLINE_FLEX,
 #if ENABLE(CSS_GRID_LAYOUT)
     GRID, INLINE_GRID,
 #endif
diff --git a/Source/WebCore/rendering/svg/RenderSVGBlock.h b/Source/WebCore/rendering/svg/RenderSVGBlock.h
index ca000f50b..9ef55a919 100644
--- a/Source/WebCore/rendering/svg/RenderSVGBlock.h
+++ b/Source/WebCore/rendering/svg/RenderSVGBlock.h
@@ -34,13 +34,15 @@ public:
 
     virtual LayoutRect visualOverflowRect() const;
 
+protected:
+    virtual void willBeDestroyed() OVERRIDE;
+
 private:
     virtual void setStyle(PassRefPtr<RenderStyle>);
     virtual void updateBoxModelInfoFromStyle();
 
     virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
 
-    virtual void willBeDestroyed();
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     virtual void updateFromElement();
diff --git a/Source/WebCore/rendering/svg/RenderSVGInline.cpp b/Source/WebCore/rendering/svg/RenderSVGInline.cpp
index 98af8e958..77b4fe956 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInline.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGInline.cpp
@@ -124,7 +124,22 @@ void RenderSVGInline::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     RenderInline::addChild(child, beforeChild);
     if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(this))
-        textRenderer->subtreeChildAdded(child);
+        textRenderer->subtreeChildWasAdded(child);
+}
+
+void RenderSVGInline::removeChild(RenderObject* child)
+{
+    RenderSVGText* textRenderer = child->isSVGInlineText() ? RenderSVGText::locateRenderSVGTextAncestor(this) : 0;
+    if (!textRenderer) {
+        RenderInline::removeChild(child);
+        return;
+    }
+
+    RenderSVGInlineText* text = toRenderSVGInlineText(child);
+    Vector<SVGTextLayoutAttributes*, 2> affectedAttributes;
+    textRenderer->subtreeChildWillBeRemoved(text, affectedAttributes);
+    RenderInline::removeChild(child);
+    textRenderer->subtreeChildWasRemoved(affectedAttributes);
 }
 
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGInline.h b/Source/WebCore/rendering/svg/RenderSVGInline.h
index 8aa4ab875..172062196 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInline.h
+++ b/Source/WebCore/rendering/svg/RenderSVGInline.h
@@ -57,7 +57,9 @@ private:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     virtual void updateFromElement();
+
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject*) OVERRIDE;
 };
 
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
index a0df4113e..eff707724 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
@@ -72,25 +72,11 @@ RenderSVGInlineText::RenderSVGInlineText(Node* n, PassRefPtr<StringImpl> string)
 {
 }
 
-void RenderSVGInlineText::willBeDestroyed()
-{
-    RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(this);
-    if (!textRenderer) {
-        RenderText::willBeDestroyed();
-        return;
-    }
-
-    Vector<SVGTextLayoutAttributes*> affectedAttributes;
-    textRenderer->subtreeChildWillBeDestroyed(this, affectedAttributes);
-    RenderText::willBeDestroyed();
-    textRenderer->subtreeChildWasDestroyed(this, affectedAttributes);
-}
-
 void RenderSVGInlineText::setTextInternal(PassRefPtr<StringImpl> text)
 {
     RenderText::setTextInternal(text);
     if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(this))
-        textRenderer->subtreeTextChanged(this);
+        textRenderer->subtreeTextDidChange(this);
 }
 
 void RenderSVGInlineText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
@@ -115,7 +101,7 @@ void RenderSVGInlineText::styleDidChange(StyleDifference diff, const RenderStyle
 
     // The text metrics may be influenced by style changes.
     if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(this))
-        textRenderer->subtreeStyleChanged(this);
+        textRenderer->subtreeStyleDidChange(this);
 }
 
 InlineTextBox* RenderSVGInlineText::createTextBox()
diff --git a/Source/WebCore/rendering/svg/RenderSVGInlineText.h b/Source/WebCore/rendering/svg/RenderSVGInlineText.h
index 51378fd07..ab81ca99f 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInlineText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGInlineText.h
@@ -48,7 +48,6 @@ public:
 private:
     virtual const char* renderName() const { return "RenderSVGInlineText"; }
 
-    virtual void willBeDestroyed();
     virtual void setTextInternal(PassRefPtr<StringImpl>);
     virtual void styleDidChange(StyleDifference, const RenderStyle*);
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGResource.cpp b/Source/WebCore/rendering/svg/RenderSVGResource.cpp
index 4fc5e2376..fd16ef29d 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResource.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResource.cpp
@@ -27,8 +27,10 @@
 
 #include "Frame.h"
 #include "FrameView.h"
+#include "RenderSVGResourceClipper.h"
 #include "RenderSVGResourceContainer.h"
 #include "RenderSVGResourceFilter.h"
+#include "RenderSVGResourceMasker.h"
 #include "RenderSVGResourceSolidColor.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
@@ -161,15 +163,21 @@ RenderSVGResourceSolidColor* RenderSVGResource::sharedSolidPaintingResource()
     return s_sharedSolidPaintingResource;
 }
 
-static inline void removeFromFilterCacheAndInvalidateDependencies(RenderObject* object, bool needsLayout)
+static inline void removeFromCacheAndInvalidateDependencies(RenderObject* object, bool needsLayout)
 {
     ASSERT(object);
-#if ENABLE(FILTERS)
     if (SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(object)) {
+#if ENABLE(FILTERS)
         if (RenderSVGResourceFilter* filter = resources->filter())
             filter->removeClientFromCache(object);
-    }
 #endif
+        if (RenderSVGResourceMasker* masker = resources->masker())
+            masker->removeClientFromCache(object);
+
+        if (RenderSVGResourceClipper* clipper = resources->clipper())
+            clipper->removeClientFromCache(object);
+    }
+
     if (!object->node() || !object->node()->isSVGElement())
         return;
     HashSet<SVGElement*>* dependencies = object->document()->accessSVGExtensions()->setOfElementsReferencingTarget(static_cast<SVGElement*>(object->node()));
@@ -191,12 +199,12 @@ void RenderSVGResource::markForLayoutAndParentResourceInvalidation(RenderObject*
     if (needsLayout)
         object->setNeedsLayout(true);
 
-    removeFromFilterCacheAndInvalidateDependencies(object, needsLayout);
+    removeFromCacheAndInvalidateDependencies(object, needsLayout);
 
     // Invalidate resources in ancestor chain, if needed.
     RenderObject* current = object->parent();
     while (current) {
-        removeFromFilterCacheAndInvalidateDependencies(current, needsLayout);
+        removeFromCacheAndInvalidateDependencies(current, needsLayout);
 
         if (current->isSVGResourceContainer()) {
             // This will process the rest of the ancestors.
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index f0f0b9c32..2bb583cac 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -57,12 +57,17 @@ namespace WebCore {
 RenderSVGText::RenderSVGText(SVGTextElement* node) 
     : RenderSVGBlock(node)
     , m_needsReordering(false)
-    , m_needsPositioningValuesUpdate(true)
+    , m_needsPositioningValuesUpdate(false)
     , m_needsTransformUpdate(true)
-    , m_needsTextMetricsUpdate(true)
+    , m_needsTextMetricsUpdate(false)
 {
 }
 
+RenderSVGText::~RenderSVGText()
+{
+    ASSERT(m_layoutAttributes.isEmpty());
+}
+
 bool RenderSVGText::isChildAllowed(RenderObject* child, RenderStyle*) const
 {
     return child->isInline();
@@ -110,29 +115,19 @@ void RenderSVGText::mapLocalToContainer(RenderBoxModelObject* repaintContainer,
     SVGRenderSupport::mapLocalToContainer(this, repaintContainer, transformState, wasFixed);
 }
 
-void RenderSVGText::subtreeChildAdded(RenderObject* child)
+static inline void collectLayoutAttributes(RenderObject* text, Vector<SVGTextLayoutAttributes*>& attributes)
 {
-    ASSERT(child);
-    if (m_needsPositioningValuesUpdate)
-        return;
-
-    // The positioning elements cache doesn't include the new 'child' yet. Clear the
-    // cache, as the next buildLayoutAttributesForTextRenderer() call rebuilds it.
-    invalidateTextPositioningElements();
-
-    FontCachePurgePreventer fontCachePurgePreventer;
-    for (RenderObject* descendant = child; descendant; descendant = descendant->nextInPreOrder(child)) {
+    for (RenderObject* descendant = text; descendant; descendant = descendant->nextInPreOrder(text)) {
         if (descendant->isSVGInlineText())
-            m_layoutAttributesBuilder.buildLayoutAttributesForTextRenderer(toRenderSVGInlineText(descendant));
+            attributes.append(toRenderSVGInlineText(descendant)->layoutAttributes());
     }
-
-    rebuildLayoutAttributes();
 }
 
 static inline bool findPreviousAndNextAttributes(RenderObject* start, RenderSVGInlineText* locateElement, bool& stopAfterNext, SVGTextLayoutAttributes*& previous, SVGTextLayoutAttributes*& next)
 {
     ASSERT(start);
     ASSERT(locateElement);
+    // FIXME: Make this iterative.
     for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) {
         if (child->isSVGInlineText()) {
             RenderSVGInlineText* text = toRenderSVGInlineText(child);
@@ -160,53 +155,70 @@ static inline bool findPreviousAndNextAttributes(RenderObject* start, RenderSVGI
     return false;
 }
 
-void RenderSVGText::subtreeChildWillBeDestroyed(RenderSVGInlineText* text, Vector<SVGTextLayoutAttributes*>& affectedAttributes)
+inline bool RenderSVGText::shouldHandleSubtreeMutations() const
 {
-    ASSERT(text);
-
-    // The positioning elements cache depends on the size of each text renderer in the
-    // subtree. If this changes, clear the cache. It's going to be rebuilt below.
-    invalidateTextPositioningElements();
+    if (beingDestroyed() || !everHadLayout()) {
+        ASSERT(m_layoutAttributes.isEmpty());
+        ASSERT(!m_layoutAttributesBuilder.numberOfTextPositioningElements());
+        return false;
+    }
+    return true;
+}
 
-    if (m_needsPositioningValuesUpdate)
+void RenderSVGText::subtreeChildWasAdded(RenderObject* child)
+{
+    ASSERT(child);
+    if (!shouldHandleSubtreeMutations() || documentBeingDestroyed())
         return;
 
-    // This logic requires that the 'text' child is still inserted in the tree.
-    bool stopAfterNext = false;
-    SVGTextLayoutAttributes* previous = 0;
-    SVGTextLayoutAttributes* next = 0;
-    findPreviousAndNextAttributes(this, text, stopAfterNext, previous, next);
-    if (previous)
-        affectedAttributes.append(previous);
-    if (next)
-        affectedAttributes.append(next);
-
-    SVGTextLayoutAttributes* currentLayoutAttributes = text->layoutAttributes();
-
-    size_t position = m_layoutAttributes.find(currentLayoutAttributes);
-    ASSERT(position != notFound);
-    m_layoutAttributes.remove(position);
+    // The positioning elements cache doesn't include the new 'child' yet. Clear the
+    // cache, as the next buildLayoutAttributesForTextRenderer() call rebuilds it.
+    m_layoutAttributesBuilder.clearTextPositioningElements();
 
-    ASSERT(!m_layoutAttributes.contains(currentLayoutAttributes));
-}
+    // Detect changes in layout attributes and only measure those text parts that have changed!
+    Vector<SVGTextLayoutAttributes*> newLayoutAttributes;
+    collectLayoutAttributes(this, newLayoutAttributes);
+    if (newLayoutAttributes.isEmpty()) {
+        ASSERT(m_layoutAttributes.isEmpty());
+        return;
+    }
 
-static inline void recursiveCollectLayoutAttributes(RenderObject* start, Vector<SVGTextLayoutAttributes*>& attributes)
-{
-    for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) {
-        if (child->isSVGInlineText()) {
-            attributes.append(toRenderSVGInlineText(child)->layoutAttributes());
-            continue;
+    // Compare m_layoutAttributes with newLayoutAttributes to figure out which attribute got added.
+    size_t size = newLayoutAttributes.size();
+    SVGTextLayoutAttributes* attributes = 0;
+    for (size_t i = 0; i < size; ++i) {
+        attributes = newLayoutAttributes[i];
+        if (m_layoutAttributes.find(attributes) == notFound) {
+            // Every time this is invoked, there's only a single new entry in the newLayoutAttributes list, compared to the old in m_layoutAttributes.
+            bool stopAfterNext = false;
+            SVGTextLayoutAttributes* previous = 0;
+            SVGTextLayoutAttributes* next = 0;
+            ASSERT_UNUSED(child, attributes->context() == child);
+            findPreviousAndNextAttributes(this, attributes->context(), stopAfterNext, previous, next);
+
+            if (previous)
+                m_layoutAttributesBuilder.buildLayoutAttributesForTextRenderer(previous->context());
+            m_layoutAttributesBuilder.buildLayoutAttributesForTextRenderer(attributes->context());
+            if (next)
+                m_layoutAttributesBuilder.buildLayoutAttributesForTextRenderer(next->context());
+            break;
         }
-
-        recursiveCollectLayoutAttributes(child, attributes);
     }
+
+#ifndef NDEBUG
+    // Verify that m_layoutAttributes only differs by a maximum of one entry.
+    for (size_t i = 0; i < size; ++i)
+        ASSERT(m_layoutAttributes.find(newLayoutAttributes[i]) != notFound || newLayoutAttributes[i] == attributes);
+#endif
+
+    m_layoutAttributes = newLayoutAttributes;
 }
 
 static inline void checkLayoutAttributesConsistency(RenderSVGText* text, Vector<SVGTextLayoutAttributes*>& expectedLayoutAttributes)
 {
 #ifndef NDEBUG
     Vector<SVGTextLayoutAttributes*> newLayoutAttributes;
-    recursiveCollectLayoutAttributes(text, newLayoutAttributes);
+    collectLayoutAttributes(text, newLayoutAttributes);
     ASSERT(newLayoutAttributes == expectedLayoutAttributes);
 #else
     UNUSED_PARAM(text);
@@ -214,24 +226,67 @@ static inline void checkLayoutAttributesConsistency(RenderSVGText* text, Vector<
 #endif
 }
 
-void RenderSVGText::subtreeChildWasDestroyed(RenderSVGInlineText*, Vector<SVGTextLayoutAttributes*>& affectedAttributes)
+void RenderSVGText::willBeDestroyed()
 {
-    if (documentBeingDestroyed() || affectedAttributes.isEmpty())
+    m_layoutAttributes.clear();
+    m_layoutAttributesBuilder.clearTextPositioningElements();
+
+    RenderSVGBlock::willBeDestroyed();
+}
+
+void RenderSVGText::subtreeChildWillBeRemoved(RenderSVGInlineText* text, Vector<SVGTextLayoutAttributes*, 2>& affectedAttributes)
+{
+    ASSERT(text);
+    if (!shouldHandleSubtreeMutations())
         return;
 
     checkLayoutAttributesConsistency(this, m_layoutAttributes);
 
-    size_t size = affectedAttributes.size();
-    for (size_t i = 0; i < size; ++i)
-        m_layoutAttributesBuilder.rebuildMetricsForTextRenderer(affectedAttributes[i]->context());
+    // The positioning elements cache depends on the size of each text renderer in the
+    // subtree. If this changes, clear the cache. It's going to be rebuilt below.
+    m_layoutAttributesBuilder.clearTextPositioningElements();
+    if (m_layoutAttributes.isEmpty())
+        return;
+
+    // This logic requires that the 'text' child is still inserted in the tree.
+    bool stopAfterNext = false;
+    SVGTextLayoutAttributes* previous = 0;
+    SVGTextLayoutAttributes* next = 0;
+    if (!documentBeingDestroyed())
+        findPreviousAndNextAttributes(this, text, stopAfterNext, previous, next);
+
+    if (previous)
+        affectedAttributes.append(previous);
+    if (next)
+        affectedAttributes.append(next);
+
+    size_t position = m_layoutAttributes.find(text->layoutAttributes());
+    ASSERT(position != notFound);
+    m_layoutAttributes.remove(position);
 }
 
-void RenderSVGText::subtreeStyleChanged(RenderSVGInlineText* text)
+void RenderSVGText::subtreeChildWasRemoved(const Vector<SVGTextLayoutAttributes*, 2>& affectedAttributes)
+{
+    if (!shouldHandleSubtreeMutations() || documentBeingDestroyed()) {
+        ASSERT(affectedAttributes.isEmpty());
+        return;
+    }
+
+    // This is called immediately after subtreeChildWillBeDestroyed, once the RenderSVGInlineText::willBeDestroyed() method
+    // passes on to the base class, which removes us from the render tree. At this point we can update the layout attributes.
+    unsigned size = affectedAttributes.size();
+    for (unsigned i = 0; i < size; ++i)
+        m_layoutAttributesBuilder.buildLayoutAttributesForTextRenderer(affectedAttributes[i]->context());
+}
+
+void RenderSVGText::subtreeStyleDidChange(RenderSVGInlineText* text)
 {
     ASSERT(text);
-    if (m_needsPositioningValuesUpdate)
+    if (!shouldHandleSubtreeMutations() || documentBeingDestroyed())
         return;
 
+    checkLayoutAttributesConsistency(this, m_layoutAttributes);
+
     // Only update the metrics cache, but not the text positioning element cache
     // nor the layout attributes cached in the leaf #text renderers.
     FontCachePurgePreventer fontCachePurgePreventer;
@@ -241,31 +296,37 @@ void RenderSVGText::subtreeStyleChanged(RenderSVGInlineText* text)
     }
 }
 
-void RenderSVGText::subtreeTextChanged(RenderSVGInlineText* text)
+void RenderSVGText::subtreeTextDidChange(RenderSVGInlineText* text)
 {
     ASSERT(text);
+    ASSERT(!beingDestroyed());
+    if (!everHadLayout()) {
+        ASSERT(m_layoutAttributes.isEmpty());
+        ASSERT(!m_layoutAttributesBuilder.numberOfTextPositioningElements());
+        return;
+    }
 
     // The positioning elements cache depends on the size of each text renderer in the
     // subtree. If this changes, clear the cache. It's going to be rebuilt below.
-    invalidateTextPositioningElements();
-
-    if (m_needsPositioningValuesUpdate)
-        return;
+    m_layoutAttributesBuilder.clearTextPositioningElements();
 
-    FontCachePurgePreventer fontCachePurgePreventer;
+    checkLayoutAttributesConsistency(this, m_layoutAttributes);
     for (RenderObject* descendant = text; descendant; descendant = descendant->nextInPreOrder(text)) {
         if (descendant->isSVGInlineText())
             m_layoutAttributesBuilder.buildLayoutAttributesForTextRenderer(toRenderSVGInlineText(descendant));
     }
 }
 
-void RenderSVGText::invalidateTextPositioningElements()
+static inline void updateFontInAllDescendants(RenderObject* start, SVGTextLayoutAttributesBuilder* builder = 0)
 {
-    // Clear the text positioning elements. This should be called when either the children
-    // of a DOM text element have changed, or the length of the text in any child element
-    // has changed. Failure to clear may leave us with invalid elements, as other code paths
-    // do not always cause the position elements to be marked invalid before use.
-    m_layoutAttributesBuilder.clearTextPositioningElements();
+    for (RenderObject* descendant = start; descendant; descendant = descendant->nextInPreOrder(start)) {
+        if (!descendant->isSVGInlineText())
+            continue;
+        RenderSVGInlineText* text = toRenderSVGInlineText(descendant);
+        text->updateScaledFont();
+        if (builder)
+            builder->rebuildMetricsForTextRenderer(text);
+    }
 }
 
 void RenderSVGText::layout()
@@ -281,27 +342,43 @@ void RenderSVGText::layout()
         updateCachedBoundariesInParents = true;
     }
 
-    // If the root layout size changed (eg. window size changes) or the positioning values change
-    // or the transform to the root context has changed then recompute the on-screen font size.
-    if (m_needsTextMetricsUpdate || SVGRenderSupport::findTreeRootObject(this)->isLayoutSizeChanged()) {
-        for (RenderObject* descendant = this; descendant; descendant = descendant->nextInPreOrder(this)) {
-            if (descendant->isSVGInlineText())
-                toRenderSVGInlineText(descendant)->updateScaledFont();
-        }
+    if (!everHadLayout()) {
+        // When laying out initially, collect all layout attributes, build the character data map,
+        // and propogate resulting SVGLayoutAttributes to all RenderSVGInlineText children in the subtree.
+        ASSERT(m_layoutAttributes.isEmpty());
+        collectLayoutAttributes(this, m_layoutAttributes);
+        updateFontInAllDescendants(this);
+        m_layoutAttributesBuilder.buildLayoutAttributesForForSubtree(this);
 
-        rebuildAllLayoutAttributes();
-        updateCachedBoundariesInParents = true;
+        m_needsReordering = true;
         m_needsTextMetricsUpdate = false;
-    }
+        m_needsPositioningValuesUpdate = false;
+        updateCachedBoundariesInParents = true;
+    } else if (m_needsPositioningValuesUpdate) {
+        // When the x/y/dx/dy/rotate lists change, recompute the layout attributes, and eventually
+        // update the on-screen font objects as well in all descendants.
+        if (m_needsTextMetricsUpdate) {
+            updateFontInAllDescendants(this);
+            m_needsTextMetricsUpdate = false;
+        }
 
-    if (m_needsPositioningValuesUpdate) {
-        // Perform SVG text layout phase one (see SVGTextLayoutAttributesBuilder for details).
-        m_layoutAttributesBuilder.buildLayoutAttributesForWholeTree(this);
+        m_layoutAttributesBuilder.buildLayoutAttributesForForSubtree(this);
         m_needsReordering = true;
         m_needsPositioningValuesUpdate = false;
         updateCachedBoundariesInParents = true;
+    } else if (m_needsTextMetricsUpdate || SVGRenderSupport::findTreeRootObject(this)->isLayoutSizeChanged()) {
+        // If the root layout size changed (eg. window size changes) or the transform to the root
+        // context has changed then recompute the on-screen font size.
+        updateFontInAllDescendants(this, &m_layoutAttributesBuilder);
+
+        ASSERT(!m_needsReordering);
+        ASSERT(!m_needsPositioningValuesUpdate);
+        m_needsTextMetricsUpdate = false;
+        updateCachedBoundariesInParents = true;
     }
 
+    checkLayoutAttributesConsistency(this, m_layoutAttributes);
+
     // Reduced version of RenderBlock::layoutBlock(), which only takes care of SVG text.
     // All if branches that could cause early exit in RenderBlocks layoutBlock() method are turned into assertions.
     ASSERT(!isInline());
@@ -437,7 +514,21 @@ FloatRect RenderSVGText::repaintRectInLocalCoordinates() const
 void RenderSVGText::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     RenderSVGBlock::addChild(child, beforeChild);
-    subtreeChildAdded(child);
+    subtreeChildWasAdded(child);
+}
+
+void RenderSVGText::removeChild(RenderObject* child)
+{
+    if (!child->isSVGInlineText()) {
+        RenderSVGBlock::removeChild(child);
+        return;
+    }
+
+    RenderSVGInlineText* text = toRenderSVGInlineText(child);
+    Vector<SVGTextLayoutAttributes*, 2> affectedAttributes;
+    subtreeChildWillBeRemoved(text, affectedAttributes);
+    RenderSVGBlock::removeChild(child);
+    subtreeChildWasRemoved(affectedAttributes);
 }
 
 // Fix for <rdar://problem/8048875>. We should not render :first-line CSS Style
@@ -453,42 +544,6 @@ void RenderSVGText::updateFirstLetter()
 {
 }
 
-void RenderSVGText::rebuildAllLayoutAttributes()
-{
-    m_layoutAttributes.clear();
-    recursiveCollectLayoutAttributes(this, m_layoutAttributes);
-    if (m_layoutAttributes.isEmpty())
-        return;
-
-    m_layoutAttributesBuilder.rebuildMetricsForWholeTree(this);
-}
-
-void RenderSVGText::rebuildLayoutAttributes()
-{
-    if (m_layoutAttributes.isEmpty()) {
-        rebuildAllLayoutAttributes();
-        return;
-    }
-
-    // Detect changes in layout attributes and only measure those text parts that have changed!
-    Vector<SVGTextLayoutAttributes*> newLayoutAttributes;
-    recursiveCollectLayoutAttributes(this, newLayoutAttributes);
-    if (newLayoutAttributes.isEmpty()) {
-        m_layoutAttributes.clear();
-        return;
-    }
-
-    // Compare m_layoutAttributes with newLayoutAttributes to figure out which attributes got added.
-    size_t size = newLayoutAttributes.size();
-    for (size_t i = 0; i < size; ++i) {
-        SVGTextLayoutAttributes* attributes = newLayoutAttributes[i];
-        if (m_layoutAttributes.find(attributes) == notFound)
-            m_layoutAttributesBuilder.rebuildMetricsForTextRenderer(attributes->context());
-    }
-
-    m_layoutAttributes = newLayoutAttributes;
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.h b/Source/WebCore/rendering/svg/RenderSVGText.h
index 23a0b6a9a..ee7b3d027 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGText.h
@@ -36,6 +36,7 @@ class RenderSVGInlineText;
 class RenderSVGText : public RenderSVGBlock {
 public:
     RenderSVGText(SVGTextElement*);
+    virtual ~RenderSVGText();
 
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
 
@@ -50,15 +51,11 @@ public:
     bool needsReordering() const { return m_needsReordering; }
     Vector<SVGTextLayoutAttributes*>& layoutAttributes() { return m_layoutAttributes; }
 
-    void subtreeChildAdded(RenderObject*);
-    void subtreeChildWillBeDestroyed(RenderSVGInlineText*, Vector<SVGTextLayoutAttributes*>& affectedAttributes);
-    void subtreeChildWasDestroyed(RenderSVGInlineText*, Vector<SVGTextLayoutAttributes*>& affectedAttributes);
-    void subtreeStyleChanged(RenderSVGInlineText*);
-    void subtreeTextChanged(RenderSVGInlineText*);
-
-    // Call this method when either the children of a DOM text element have changed, or the length of
-    // the text in any child element has changed.
-    void invalidateTextPositioningElements();
+    void subtreeChildWasAdded(RenderObject*);
+    void subtreeChildWillBeRemoved(RenderSVGInlineText*, Vector<SVGTextLayoutAttributes*, 2>& affectedAttributes);
+    void subtreeChildWasRemoved(const Vector<SVGTextLayoutAttributes*, 2>& affectedAttributes);
+    void subtreeStyleDidChange(RenderSVGInlineText*);
+    void subtreeTextDidChange(RenderSVGInlineText*);
 
 private:
     virtual const char* renderName() const { return "RenderSVGText"; }
@@ -80,6 +77,8 @@ private:
 
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject*) OVERRIDE;
+    virtual void willBeDestroyed() OVERRIDE;
 
     virtual FloatRect objectBoundingBox() const { return frameRect(); }
     virtual FloatRect strokeBoundingBox() const;
@@ -91,8 +90,7 @@ private:
     virtual RenderBlock* firstLineBlock() const;
     virtual void updateFirstLetter();
 
-    void rebuildAllLayoutAttributes();
-    void rebuildLayoutAttributes();
+    bool shouldHandleSubtreeMutations() const;
 
     bool m_needsReordering : 1;
     bool m_needsPositioningValuesUpdate : 1;
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
index b206cb6c2..ddc7c9155 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
@@ -197,8 +197,10 @@ void SVGRenderSupport::layoutChildren(RenderObject* start, bool selfNeedsLayout)
                     // When the layout size changed and when using relative values tell the RenderSVGShape to update its shape object
                     if (child->isSVGShape())
                         toRenderSVGShape(child)->setNeedsShapeUpdate();
-                    else if (child->isSVGText())
+                    else if (child->isSVGText()) {
+                        toRenderSVGText(child)->setNeedsTextMetricsUpdate();
                         toRenderSVGText(child)->setNeedsPositioningValuesUpdate();
+                    }
 
                     needsLayout = true;
                 }
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
index 067bf6bb9..be2a12fe9 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
@@ -41,41 +41,27 @@ void SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextRenderer(Render
     if (!textRoot)
         return;
 
-    if (!buildLayoutAttributesIfNeeded(textRoot))
-        return;
-
-    m_metricsBuilder.buildMetricsAndLayoutAttributes(textRoot, text, m_characterDataMap);
-}
+    if (m_textPositions.isEmpty()) {
+        m_characterDataMap.clear();
 
-void SVGTextLayoutAttributesBuilder::buildLayoutAttributesForWholeTree(RenderSVGText* textRoot)
-{
-    ASSERT(textRoot);
+        m_textLength = 0;
+        const UChar* lastCharacter = 0;
+        collectTextPositioningElements(textRoot, lastCharacter);
 
-    if (!buildLayoutAttributesIfNeeded(textRoot))
-        return;
+        if (!m_textLength)
+            return;
 
-    m_metricsBuilder.buildMetricsAndLayoutAttributes(textRoot, 0, m_characterDataMap);
-}
+        buildCharacterDataMap(textRoot);
+    }
 
-void SVGTextLayoutAttributesBuilder::rebuildMetricsForTextRenderer(RenderSVGInlineText* text)
-{
-    ASSERT(text);
-    m_metricsBuilder.measureTextRenderer(text);
+    m_metricsBuilder.buildMetricsAndLayoutAttributes(textRoot, text, m_characterDataMap);
 }
 
-void SVGTextLayoutAttributesBuilder::rebuildMetricsForWholeTree(RenderSVGText* textRoot)
+bool SVGTextLayoutAttributesBuilder::buildLayoutAttributesForForSubtree(RenderSVGText* textRoot)
 {
     ASSERT(textRoot);
-    Vector<SVGTextLayoutAttributes*>& layoutAttributes = textRoot->layoutAttributes();
-
-    size_t layoutAttributesSize = layoutAttributes.size();
-    for (size_t i = 0; i < layoutAttributesSize; ++i)
-        m_metricsBuilder.measureTextRenderer(layoutAttributes[i]->context());
-}
 
-bool SVGTextLayoutAttributesBuilder::buildLayoutAttributesIfNeeded(RenderSVGText* textRoot)
-{
-    ASSERT(textRoot);
+    m_characterDataMap.clear();
 
     if (m_textPositions.isEmpty()) {
         m_textLength = 0;
@@ -83,14 +69,20 @@ bool SVGTextLayoutAttributesBuilder::buildLayoutAttributesIfNeeded(RenderSVGText
         collectTextPositioningElements(textRoot, lastCharacter);
     }
 
-    m_characterDataMap.clear();
     if (!m_textLength)
         return false;
 
-    buildLayoutAttributes(textRoot);
+    buildCharacterDataMap(textRoot);
+    m_metricsBuilder.buildMetricsAndLayoutAttributes(textRoot, 0, m_characterDataMap);
     return true;
 }
 
+void SVGTextLayoutAttributesBuilder::rebuildMetricsForTextRenderer(RenderSVGInlineText* text)
+{
+    ASSERT(text);
+    m_metricsBuilder.measureTextRenderer(text);
+}
+
 static inline void processRenderSVGInlineText(RenderSVGInlineText* text, unsigned& atCharacter, const UChar*& lastCharacter)
 {
     if (text->style()->whiteSpace() == PRE) {
@@ -140,10 +132,8 @@ void SVGTextLayoutAttributesBuilder::collectTextPositioningElements(RenderObject
     }
 }
 
-void SVGTextLayoutAttributesBuilder::buildLayoutAttributes(RenderSVGText* textRoot)
+void SVGTextLayoutAttributesBuilder::buildCharacterDataMap(RenderSVGText* textRoot)
 {
-    ASSERT(m_textLength);
-
     SVGTextPositioningElement* outermostTextElement = SVGTextPositioningElement::elementFromRenderer(textRoot);
     ASSERT(outermostTextElement);
 
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
index 45fad2400..7dac96f4d 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
@@ -43,14 +43,14 @@ class SVGTextLayoutAttributesBuilder {
     WTF_MAKE_NONCOPYABLE(SVGTextLayoutAttributesBuilder);
 public:
     SVGTextLayoutAttributesBuilder();
-    void buildLayoutAttributesForWholeTree(RenderSVGText*);
+    bool buildLayoutAttributesForForSubtree(RenderSVGText*);
     void buildLayoutAttributesForTextRenderer(RenderSVGInlineText*);
 
-    void rebuildMetricsForWholeTree(RenderSVGText*);
     void rebuildMetricsForTextRenderer(RenderSVGInlineText*);
 
     // Invoked whenever the underlying DOM tree changes, so that m_textPositions is rebuild.
     void clearTextPositioningElements() { m_textPositions.clear(); }
+    unsigned numberOfTextPositioningElements() const { return m_textPositions.size(); }
 
 private:
     struct TextPosition {
@@ -66,9 +66,8 @@ private:
         unsigned length;
     };
 
-    bool buildLayoutAttributesIfNeeded(RenderSVGText*);
+    void buildCharacterDataMap(RenderSVGText*);
     void collectTextPositioningElements(RenderObject*, const UChar*& lastCharacter);
-    void buildLayoutAttributes(RenderSVGText*);
     void fillCharacterDataMap(const TextPosition&);
 
 private:
diff --git a/Source/WebCore/rendering/svg/SVGTextMetricsBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextMetricsBuilder.cpp
index c94f0c74a..81fc325a1 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetricsBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextMetricsBuilder.cpp
@@ -48,7 +48,7 @@ bool SVGTextMetricsBuilder::advance()
     if (int(m_textPosition) >= m_run.charactersLength())
         return false;
 
-#if PLATFORM(QT)
+#if PLATFORM(QT) && !HAVE(QRAWFONT)
     advanceComplexText();
 #else
     if (m_isComplexText)
@@ -62,7 +62,7 @@ bool SVGTextMetricsBuilder::advance()
 
 void SVGTextMetricsBuilder::advanceSimpleText()
 {
-#if PLATFORM(QT)
+#if PLATFORM(QT) && !HAVE(QRAWFONT)
     ASSERT_NOT_REACHED();
 #else
     unsigned metricsLength = m_simpleWidthIterator->advance(m_textPosition + 1);
@@ -115,7 +115,7 @@ void SVGTextMetricsBuilder::initializeMeasurementWithTextRenderer(RenderSVGInlin
     m_run = SVGTextMetrics::constructTextRun(text, text->characters(), 0, text->textLength());
     m_isComplexText = scaledFont.codePath(m_run) == Font::Complex;
 
-#if !PLATFORM(QT)
+#if !PLATFORM(QT) || HAVE(QRAWFONT)
     if (m_isComplexText)
         m_simpleWidthIterator.clear();
     else
diff --git a/Source/WebCore/storage/StorageArea.h b/Source/WebCore/storage/StorageArea.h
index 5da1bc150..e2d082eb8 100644
--- a/Source/WebCore/storage/StorageArea.h
+++ b/Source/WebCore/storage/StorageArea.h
@@ -49,9 +49,9 @@ namespace WebCore {
         virtual unsigned length(Frame* sourceFrame) const = 0;
         virtual String key(unsigned index, Frame* sourceFrame) const = 0;
         virtual String getItem(const String& key, Frame* sourceFrame) const = 0;
-        virtual void setItem(const String& key, const String& value, ExceptionCode&, Frame* sourceFrame) = 0;
-        virtual void removeItem(const String& key, Frame* sourceFrame) = 0;
-        virtual void clear(Frame* sourceFrame) = 0;
+        virtual String setItem(const String& key, const String& value, ExceptionCode& ec, Frame* sourceFrame) = 0;
+        virtual String removeItem(const String& key, Frame* sourceFrame) = 0;
+        virtual bool clear(Frame* sourceFrame) = 0;
         virtual bool contains(const String& key, Frame* sourceFrame) const = 0;
 
         virtual bool disabledByPrivateBrowsingInFrame(const Frame* sourceFrame) const = 0;
diff --git a/Source/WebCore/storage/StorageAreaImpl.cpp b/Source/WebCore/storage/StorageAreaImpl.cpp
index 72e865718..07748302b 100644
--- a/Source/WebCore/storage/StorageAreaImpl.cpp
+++ b/Source/WebCore/storage/StorageAreaImpl.cpp
@@ -102,6 +102,13 @@ StorageAreaImpl::StorageAreaImpl(StorageAreaImpl* area)
 
 bool StorageAreaImpl::disabledByPrivateBrowsingInFrame(const Frame* frame) const
 {
+#if PLATFORM(CHROMIUM)
+    // The frame pointer can be NULL in Chromium since this call is made in a different
+    // process from where the Frame object exists.  Luckily, private browseing is
+    // implemented differently in Chromium, so it'd never return true anyway.
+    ASSERT(!frame);
+    return false;
+#else
     if (!frame->page())
         return true;
     if (!frame->page()->settings()->privateBrowsingEnabled())
@@ -109,6 +116,7 @@ bool StorageAreaImpl::disabledByPrivateBrowsingInFrame(const Frame* frame) const
     if (m_storageType != LocalStorage)
         return true;
     return !SchemeRegistry::allowsLocalStorageAccessInPrivateBrowsing(frame->document()->securityOrigin()->protocol());
+#endif
 }
 
 unsigned StorageAreaImpl::length(Frame*) const
@@ -135,7 +143,7 @@ String StorageAreaImpl::getItem(const String& key, Frame*) const
     return m_storageMap->getItem(key);
 }
 
-void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
+String StorageAreaImpl::setItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
 {
     ASSERT(!m_isShutdown);
     ASSERT(!value.isNull());
@@ -143,7 +151,7 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
 
     if (disabledByPrivateBrowsingInFrame(frame)) {
         ec = QUOTA_EXCEEDED_ERR;
-        return;
+        return String();
     }
 
     String oldValue;
@@ -154,24 +162,25 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
 
     if (quotaException) {
         ec = QUOTA_EXCEEDED_ERR;
-        return;
+        return oldValue;
     }
 
     if (oldValue == value)
-        return;
+        return oldValue;
 
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleItemForSync(key, value);
     StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
+    return oldValue;
 }
 
-void StorageAreaImpl::removeItem(const String& key, Frame* frame)
+String StorageAreaImpl::removeItem(const String& key, Frame* frame)
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
 
     if (disabledByPrivateBrowsingInFrame(frame))
-        return;
+        return String();
 
     String oldValue;
     RefPtr<StorageMap> newMap = m_storageMap->removeItem(key, oldValue);
@@ -179,23 +188,24 @@ void StorageAreaImpl::removeItem(const String& key, Frame* frame)
         m_storageMap = newMap.release();
 
     if (oldValue.isNull())
-        return;
+        return oldValue;
 
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleItemForSync(key, String());
     StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
+    return oldValue;
 }
 
-void StorageAreaImpl::clear(Frame* frame)
+bool StorageAreaImpl::clear(Frame* frame)
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
 
     if (disabledByPrivateBrowsingInFrame(frame))
-        return;
+        return false;
 
     if (!m_storageMap->length())
-        return;
+        return false;
 
     unsigned quota = m_storageMap->quota();
     m_storageMap = StorageMap::create(quota);
@@ -203,6 +213,7 @@ void StorageAreaImpl::clear(Frame* frame)
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleClear();
     StorageEventDispatcher::dispatch(String(), String(), String(), m_storageType, m_securityOrigin.get(), frame);
+    return true;
 }
 
 bool StorageAreaImpl::contains(const String& key, Frame*) const
diff --git a/Source/WebCore/storage/StorageAreaImpl.h b/Source/WebCore/storage/StorageAreaImpl.h
index a56361f2e..79b27d60b 100644
--- a/Source/WebCore/storage/StorageAreaImpl.h
+++ b/Source/WebCore/storage/StorageAreaImpl.h
@@ -46,9 +46,9 @@ namespace WebCore {
         virtual unsigned length(Frame* sourceFrame) const;
         virtual String key(unsigned index, Frame* sourceFrame) const;
         virtual String getItem(const String& key, Frame* sourceFrame) const;
-        virtual void setItem(const String& key, const String& value, ExceptionCode&, Frame* sourceFrame);
-        virtual void removeItem(const String& key, Frame* sourceFrame);
-        virtual void clear(Frame* sourceFrame);
+        virtual String setItem(const String& key, const String& value, ExceptionCode& ec, Frame* sourceFrame);
+        virtual String removeItem(const String& key, Frame* sourceFrame);
+        virtual bool clear(Frame* sourceFrame);
         virtual bool contains(const String& key, Frame* sourceFrame) const;
 
         virtual bool disabledByPrivateBrowsingInFrame(const Frame* sourceFrame) const;
diff --git a/Source/WebCore/storage/StorageNamespaceImpl.cpp b/Source/WebCore/storage/StorageNamespaceImpl.cpp
index 54b640ce5..9d1ac517a 100644
--- a/Source/WebCore/storage/StorageNamespaceImpl.cpp
+++ b/Source/WebCore/storage/StorageNamespaceImpl.cpp
@@ -47,7 +47,7 @@ static LocalStorageNamespaceMap& localStorageNamespaceMap()
 
 PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const String& path, unsigned quota)
 {
-    const String lookupPath = path.isNull() ? String("") : path;
+    const String lookupPath = path.isNull() ? emptyString() : path;
     LocalStorageNamespaceMap::iterator it = localStorageNamespaceMap().find(lookupPath);
     if (it == localStorageNamespaceMap().end()) {
         RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespaceImpl(LocalStorage, lookupPath, quota));
diff --git a/Source/WebCore/svg/SVGAElement.cpp b/Source/WebCore/svg/SVGAElement.cpp
index c8ba533e0..a714d7287 100644
--- a/Source/WebCore/svg/SVGAElement.cpp
+++ b/Source/WebCore/svg/SVGAElement.cpp
@@ -99,25 +99,25 @@ bool SVGAElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGAElement::parseAttribute(Attribute* attr)
+void SVGAElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledTransformableElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledTransformableElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::targetAttr) {
-        setSVGTargetBaseValue(attr->value());
+    if (attribute.name() == SVGNames::targetAttr) {
+        setSVGTargetBaseValue(attribute.value());
         return;
     }
 
-    if (SVGURIReference::parseAttribute(attr))
+    if (SVGURIReference::parseAttribute(attribute))
         return;
-    if (SVGTests::parseAttribute(attr))
+    if (SVGTests::parseAttribute(attribute))
         return;
-    if (SVGLangSpace::parseAttribute(attr))
+    if (SVGLangSpace::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
@@ -238,19 +238,6 @@ bool SVGAElement::childShouldCreateRenderer(const NodeRenderingContext& childCon
     return SVGElement::childShouldCreateRenderer(childContext);
 }
 
-void SVGAElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
-{
-    SVGStyledTransformableElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-
-    if (changedByParser || !renderer())
-        return;
-
-    // Invalidate the TextPosition cache in SVGTextLayoutAttributesBuilder as it may now point
-    // to no-longer existing SVGTextPositioningElements and thus needs to be rebuilt.
-    if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer()))
-        textRenderer->invalidateTextPositioningElements();
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGAElement.h b/Source/WebCore/svg/SVGAElement.h
index 72afdec12..60e7b582a 100644
--- a/Source/WebCore/svg/SVGAElement.h
+++ b/Source/WebCore/svg/SVGAElement.h
@@ -40,9 +40,6 @@ class SVGAElement : public SVGStyledTransformableElement,
 public:
     static PassRefPtr<SVGAElement> create(const QualifiedName&, Document*);
 
-protected:
-    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0) OVERRIDE;
-
 private:
     SVGAElement(const QualifiedName&, Document*);
 
@@ -52,7 +49,7 @@ private:
     virtual String target() const { return svgTarget(); }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGAnimateMotionElement.cpp b/Source/WebCore/svg/SVGAnimateMotionElement.cpp
index 34399ee26..5d970923c 100644
--- a/Source/WebCore/svg/SVGAnimateMotionElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateMotionElement.cpp
@@ -95,16 +95,16 @@ bool SVGAnimateMotionElement::isSupportedAttribute(const QualifiedName& attrName
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGAnimateMotionElement::parseAttribute(Attribute* attr)
+void SVGAnimateMotionElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGAnimationElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGAnimationElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::pathAttr) {
+    if (attribute.name() == SVGNames::pathAttr) {
         m_path = Path();
-        buildPathFromString(attr->value(), m_path);
+        buildPathFromString(attribute.value(), m_path);
         return;
     }
 
diff --git a/Source/WebCore/svg/SVGAnimateMotionElement.h b/Source/WebCore/svg/SVGAnimateMotionElement.h
index 9def47303..cc607d2d8 100644
--- a/Source/WebCore/svg/SVGAnimateMotionElement.h
+++ b/Source/WebCore/svg/SVGAnimateMotionElement.h
@@ -37,7 +37,7 @@ private:
     virtual bool hasValidAttributeType();
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual void resetAnimatedType();
     virtual void clearAnimatedType(SVGElement* targetElement);
diff --git a/Source/WebCore/svg/SVGAnimateTransformElement.cpp b/Source/WebCore/svg/SVGAnimateTransformElement.cpp
index e6227c61e..025e778ce 100644
--- a/Source/WebCore/svg/SVGAnimateTransformElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateTransformElement.cpp
@@ -58,15 +58,15 @@ bool SVGAnimateTransformElement::isSupportedAttribute(const QualifiedName& attrN
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGAnimateTransformElement::parseAttribute(Attribute* attr)
+void SVGAnimateTransformElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGAnimateElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGAnimateElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::typeAttr) {
-        m_type = SVGTransformable::parseTransformType(attr->value());
+    if (attribute.name() == SVGNames::typeAttr) {
+        m_type = SVGTransformable::parseTransformType(attribute.value());
         if (m_type == SVGTransform::SVG_TRANSFORM_MATRIX)
             m_type = SVGTransform::SVG_TRANSFORM_UNKNOWN;
         return;
diff --git a/Source/WebCore/svg/SVGAnimateTransformElement.h b/Source/WebCore/svg/SVGAnimateTransformElement.h
index d308e0b62..2008ebc2d 100644
--- a/Source/WebCore/svg/SVGAnimateTransformElement.h
+++ b/Source/WebCore/svg/SVGAnimateTransformElement.h
@@ -43,7 +43,7 @@ private:
     virtual bool hasValidAttributeType();
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     SVGTransform::SVGTransformType m_type;
 };
diff --git a/Source/WebCore/svg/SVGAnimationElement.cpp b/Source/WebCore/svg/SVGAnimationElement.cpp
index 31849c792..34f0dc0fc 100644
--- a/Source/WebCore/svg/SVGAnimationElement.cpp
+++ b/Source/WebCore/svg/SVGAnimationElement.cpp
@@ -149,45 +149,45 @@ bool SVGAnimationElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGAnimationElement::parseAttribute(Attribute* attr)
+void SVGAnimationElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGSMILElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGSMILElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::valuesAttr) {
+    if (attribute.name() == SVGNames::valuesAttr) {
         // Per the SMIL specification, leading and trailing white space,
         // and white space before and after semicolon separators, is allowed and will be ignored.
         // http://www.w3.org/TR/SVG11/animate.html#ValuesAttribute
-        attr->value().string().split(';', m_values);
+        attribute.value().string().split(';', m_values);
         for (unsigned i = 0; i < m_values.size(); ++i)
             m_values[i] = m_values[i].stripWhiteSpace();
         return;
     }
 
-    if (attr->name() == SVGNames::keyTimesAttr) {
-        parseKeyTimes(attr->value(), m_keyTimes, true);
+    if (attribute.name() == SVGNames::keyTimesAttr) {
+        parseKeyTimes(attribute.value(), m_keyTimes, true);
         return;
     }
 
-    if (attr->name() == SVGNames::keyPointsAttr) {
+    if (attribute.name() == SVGNames::keyPointsAttr) {
         if (hasTagName(SVGNames::animateMotionTag)) {
             // This is specified to be an animateMotion attribute only but it is simpler to put it here 
             // where the other timing calculatations are.
-            parseKeyTimes(attr->value(), m_keyPoints, false);
+            parseKeyTimes(attribute.value(), m_keyPoints, false);
         }
         return;
     }
 
-    if (attr->name() == SVGNames::keySplinesAttr) {
-        parseKeySplines(attr->value(), m_keySplines);
+    if (attribute.name() == SVGNames::keySplinesAttr) {
+        parseKeySplines(attribute.value(), m_keySplines);
         return;
     }
 
-    if (SVGTests::parseAttribute(attr))
+    if (SVGTests::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGAnimationElement.h b/Source/WebCore/svg/SVGAnimationElement.h
index 8a662b33f..919a1584c 100644
--- a/Source/WebCore/svg/SVGAnimationElement.h
+++ b/Source/WebCore/svg/SVGAnimationElement.h
@@ -175,7 +175,7 @@ protected:
     virtual void determinePropertyValueTypes(const String& from, const String& to);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&) OVERRIDE;
 
     enum AttributeType {
diff --git a/Source/WebCore/svg/SVGCircleElement.cpp b/Source/WebCore/svg/SVGCircleElement.cpp
index 7da866ef4..a3405c08e 100644
--- a/Source/WebCore/svg/SVGCircleElement.cpp
+++ b/Source/WebCore/svg/SVGCircleElement.cpp
@@ -80,25 +80,25 @@ bool SVGCircleElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGCircleElement::parseAttribute(Attribute* attr)
+void SVGCircleElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledTransformableElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::cxAttr)
-        setCxBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::cyAttr)
-        setCyBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::rAttr)
-        setRBaseValue(SVGLength::construct(LengthModeOther, attr->value(), parseError, ForbidNegativeLengths));
-    else if (SVGTests::parseAttribute(attr)
-             || SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledTransformableElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::cxAttr)
+        setCxBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::cyAttr)
+        setCyBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::rAttr)
+        setRBaseValue(SVGLength::construct(LengthModeOther, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (SVGTests::parseAttribute(attribute)
+             || SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGCircleElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGCircleElement.h b/Source/WebCore/svg/SVGCircleElement.h
index c90b9f77d..2065bea2a 100644
--- a/Source/WebCore/svg/SVGCircleElement.h
+++ b/Source/WebCore/svg/SVGCircleElement.h
@@ -45,7 +45,7 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGClipPathElement.cpp b/Source/WebCore/svg/SVGClipPathElement.cpp
index ba9878ce7..b8fbbf9af 100644
--- a/Source/WebCore/svg/SVGClipPathElement.cpp
+++ b/Source/WebCore/svg/SVGClipPathElement.cpp
@@ -70,25 +70,25 @@ bool SVGClipPathElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGClipPathElement::parseAttribute(Attribute* attr)
+void SVGClipPathElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledTransformableElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledTransformableElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::clipPathUnitsAttr) {
-        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attr->value());
+    if (attribute.name() == SVGNames::clipPathUnitsAttr) {
+        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attribute.value());
         if (propertyValue > 0)
             setClipPathUnitsBaseValue(propertyValue);
         return;
     }
 
-    if (SVGTests::parseAttribute(attr))
+    if (SVGTests::parseAttribute(attribute))
         return;
-    if (SVGLangSpace::parseAttribute(attr))
+    if (SVGLangSpace::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGClipPathElement.h b/Source/WebCore/svg/SVGClipPathElement.h
index 10b609b39..7d25315f4 100644
--- a/Source/WebCore/svg/SVGClipPathElement.h
+++ b/Source/WebCore/svg/SVGClipPathElement.h
@@ -48,7 +48,7 @@ private:
     virtual bool needsPendingResourceHandling() const { return false; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp b/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
index 6ffee35be..56ec56259 100644
--- a/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
+++ b/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
@@ -75,22 +75,22 @@ bool SVGComponentTransferFunctionElement::isSupportedAttribute(const QualifiedNa
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGComponentTransferFunctionElement::parseAttribute(Attribute* attr)
+void SVGComponentTransferFunctionElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGElement::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::typeAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::typeAttr) {
         ComponentTransferType propertyValue = SVGPropertyTraits<ComponentTransferType>::fromString(value);
         if (propertyValue > 0)
             setTypeBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::tableValuesAttr) {
+    if (attribute.name() == SVGNames::tableValuesAttr) {
         SVGNumberList newList;
         newList.parse(value);
         detachAnimatedTableValuesListWrappers(newList.size());
@@ -98,27 +98,27 @@ void SVGComponentTransferFunctionElement::parseAttribute(Attribute* attr)
         return;
     }
 
-    if (attr->name() == SVGNames::slopeAttr) {
+    if (attribute.name() == SVGNames::slopeAttr) {
         setSlopeBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::interceptAttr) {
+    if (attribute.name() == SVGNames::interceptAttr) {
         setInterceptBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::amplitudeAttr) {
+    if (attribute.name() == SVGNames::amplitudeAttr) {
         setAmplitudeBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::exponentAttr) {
+    if (attribute.name() == SVGNames::exponentAttr) {
         setExponentBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::offsetAttr) {
+    if (attribute.name() == SVGNames::offsetAttr) {
         setOffsetBaseValue(value.toFloat());
         return;
     }
diff --git a/Source/WebCore/svg/SVGComponentTransferFunctionElement.h b/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
index 088589096..f44461a44 100644
--- a/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -78,7 +78,7 @@ protected:
     SVGComponentTransferFunctionElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     
 private:
diff --git a/Source/WebCore/svg/SVGCursorElement.cpp b/Source/WebCore/svg/SVGCursorElement.cpp
index a964616ba..f58816b87 100644
--- a/Source/WebCore/svg/SVGCursorElement.cpp
+++ b/Source/WebCore/svg/SVGCursorElement.cpp
@@ -78,23 +78,23 @@ bool SVGCursorElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGCursorElement::parseAttribute(Attribute* attr)
+void SVGCursorElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::xAttr)
-        setXBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::yAttr)
-        setYBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (SVGTests::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)
-             || SVGURIReference::parseAttribute(attr)) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::xAttr)
+        setXBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::yAttr)
+        setYBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (SVGTests::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)
+             || SVGURIReference::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
     
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGCursorElement::addClient(SVGElement* element)
diff --git a/Source/WebCore/svg/SVGCursorElement.h b/Source/WebCore/svg/SVGCursorElement.h
index 486d241c8..68757abb7 100644
--- a/Source/WebCore/svg/SVGCursorElement.h
+++ b/Source/WebCore/svg/SVGCursorElement.h
@@ -51,7 +51,7 @@ private:
     virtual bool isValid() const { return SVGTests::isValid(); }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index de38209de..1d351d9a5 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -51,8 +51,7 @@ using namespace HTMLNames;
 SVGElement::SVGElement(const QualifiedName& tagName, Document* document, ConstructionType constructionType)
     : StyledElement(tagName, document, constructionType)
 {
-    setHasCustomStyleForRenderer();
-    setHasCustomWillOrDidRecalcStyle();
+    setHasCustomCallbacks();
 }
 
 PassRefPtr<SVGElement> SVGElement::create(const QualifiedName& tagName, Document* document)
@@ -120,7 +119,7 @@ bool SVGElement::isOutermostSVGSVGElement() const
     // If we're living in a shadow tree, we're a <svg> element that got created as replacement
     // for a <symbol> element or a cloned <svg> element in the referenced tree. In that case
     // we're always an inner <svg> element.
-    if (isInShadowTree())
+    if (isInShadowTree() && parentOrHostElement() && parentOrHostElement()->isSVGElement())
         return false;
 
     // Element may not be in the document, pretend we're outermost for viewport(), getCTM(), etc.
@@ -135,12 +134,12 @@ bool SVGElement::isOutermostSVGSVGElement() const
     return !parentNode()->isSVGElement();
 }
 
-void SVGElement::reportAttributeParsingError(SVGParsingError error, Attribute* attribute)
+void SVGElement::reportAttributeParsingError(SVGParsingError error, const Attribute& attribute)
 {
     if (error == NoError)
         return;
 
-    String errorString = "<" + tagName() + "> attribute " + attribute->name().toString() + "=\"" + attribute->value() + "\"";
+    String errorString = "<" + tagName() + "> attribute " + attribute.name().toString() + "=\"" + attribute.value() + "\"";
     SVGDocumentExtensions* extensions = document()->accessSVGExtensions();
 
     if (error == NegativeValueForbiddenError) {
@@ -296,7 +295,7 @@ void SVGElement::cursorImageValueRemoved()
 
 SVGElement* SVGElement::correspondingElement()
 {
-    ASSERT(!hasRareSVGData() || !rareSVGData()->correspondingElement() || shadowTreeRootNode());
+    ASSERT(!hasRareSVGData() || !rareSVGData()->correspondingElement() || shadowRoot());
     return hasRareSVGData() ? rareSVGData()->correspondingElement() : 0;
 }
 
@@ -305,31 +304,31 @@ void SVGElement::setCorrespondingElement(SVGElement* correspondingElement)
     ensureRareSVGData()->setCorrespondingElement(correspondingElement);
 }
 
-void SVGElement::parseAttribute(Attribute* attr)
+void SVGElement::parseAttribute(const Attribute& attribute)
 {
     // standard events
-    if (attr->name() == onloadAttr)
-        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onclickAttr)
-        setAttributeEventListener(eventNames().clickEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onmousedownAttr)
-        setAttributeEventListener(eventNames().mousedownEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onmousemoveAttr)
-        setAttributeEventListener(eventNames().mousemoveEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onmouseoutAttr)
-        setAttributeEventListener(eventNames().mouseoutEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onmouseoverAttr)
-        setAttributeEventListener(eventNames().mouseoverEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onmouseupAttr)
-        setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == SVGNames::onfocusinAttr)
-        setAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == SVGNames::onfocusoutAttr)
-        setAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == SVGNames::onactivateAttr)
-        setAttributeEventListener(eventNames().DOMActivateEvent, createAttributeEventListener(this, attr));
+    if (attribute.name() == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onclickAttr)
+        setAttributeEventListener(eventNames().clickEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onmousedownAttr)
+        setAttributeEventListener(eventNames().mousedownEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onmousemoveAttr)
+        setAttributeEventListener(eventNames().mousemoveEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onmouseoutAttr)
+        setAttributeEventListener(eventNames().mouseoutEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onmouseoverAttr)
+        setAttributeEventListener(eventNames().mouseoverEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onmouseupAttr)
+        setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == SVGNames::onfocusinAttr)
+        setAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == SVGNames::onfocusoutAttr)
+        setAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == SVGNames::onactivateAttr)
+        setAttributeEventListener(eventNames().DOMActivateEvent, createAttributeEventListener(this, attribute));
     else
-        StyledElement::parseAttribute(attr);
+        StyledElement::parseAttribute(attribute);
 }
 
 void SVGElement::animatedPropertyTypeForAttribute(const QualifiedName& attributeName, Vector<AnimatedPropertyType>& propertyTypes)
@@ -348,6 +347,96 @@ bool SVGElement::haveLoadedRequiredResources()
     return true;
 }
 
+static inline void collectInstancesForSVGElement(SVGElement* element, HashSet<SVGElementInstance*>& instances)
+{
+    ASSERT(element);
+    if (element->shadowRoot())
+        return;
+
+    if (!element->isStyled())
+        return;
+
+    SVGStyledElement* styledElement = static_cast<SVGStyledElement*>(element);
+    ASSERT(!styledElement->instanceUpdatesBlocked());
+
+    instances = styledElement->instancesForElement();
+}
+
+bool SVGElement::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+{
+    HashSet<SVGElementInstance*> instances;
+    collectInstancesForSVGElement(this, instances);
+    if (instances.isEmpty())
+        return Node::addEventListener(eventType, listener, useCapture);
+
+    RefPtr<EventListener> listenerForRegularTree = listener;
+    RefPtr<EventListener> listenerForShadowTree = listenerForRegularTree;
+
+    // Add event listener to regular DOM element
+    if (!Node::addEventListener(eventType, listenerForRegularTree.release(), useCapture))
+        return false;
+
+    // Add event listener to all shadow tree DOM element instances
+    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
+        ASSERT((*it)->shadowTreeElement());
+        ASSERT((*it)->correspondingElement() == this);
+
+        RefPtr<EventListener> listenerForCurrentShadowTreeElement = listenerForShadowTree;
+        bool result = (*it)->shadowTreeElement()->Node::addEventListener(eventType, listenerForCurrentShadowTreeElement.release(), useCapture);
+        ASSERT_UNUSED(result, result);
+    }
+
+    return true;
+}
+
+bool SVGElement::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+{
+    HashSet<SVGElementInstance*> instances;
+    collectInstancesForSVGElement(this, instances);
+    if (instances.isEmpty())
+        return Node::removeEventListener(eventType, listener, useCapture);
+
+    // EventTarget::removeEventListener creates a PassRefPtr around the given EventListener
+    // object when creating a temporary RegisteredEventListener object used to look up the
+    // event listener in a cache. If we want to be able to call removeEventListener() multiple
+    // times on different nodes, we have to delay its immediate destruction, which would happen
+    // after the first call below.
+    RefPtr<EventListener> protector(listener);
+
+    // Remove event listener from regular DOM element
+    if (!Node::removeEventListener(eventType, listener, useCapture))
+        return false;
+
+    // Remove event listener from all shadow tree DOM element instances
+    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
+        ASSERT((*it)->correspondingElement() == this);
+
+        SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
+        ASSERT(shadowTreeElement);
+
+        if (shadowTreeElement->Node::removeEventListener(eventType, listener, useCapture))
+            continue;
+
+        // This case can only be hit for event listeners created from markup
+        ASSERT(listener->wasCreatedFromMarkup());
+
+        // If the event listener 'listener' has been created from markup and has been fired before
+        // then JSLazyEventListener::parseCode() has been called and m_jsFunction of that listener
+        // has been created (read: it's not 0 anymore). During shadow tree creation, the event
+        // listener DOM attribute has been cloned, and another event listener has been setup in
+        // the shadow tree. If that event listener has not been used yet, m_jsFunction is still 0,
+        // and tryRemoveEventListener() above will fail. Work around that very seldom problem.
+        EventTargetData* data = shadowTreeElement->eventTargetData();
+        ASSERT(data);
+
+        data->eventListenerMap.removeFirstEventListenerCreatedFromMarkup(eventType);
+    }
+
+    return true;
+}
+
 static bool hasLoadListener(Element* element)
 {
     if (element->hasEventListeners(eventNames().loadEvent))
@@ -411,10 +500,9 @@ bool SVGElement::childShouldCreateRenderer(const NodeRenderingContext& childCont
     return false;
 }
 
-void SVGElement::attributeChanged(Attribute* attr)
+void SVGElement::attributeChanged(const Attribute& attribute)
 {
-    ASSERT(attr);
-    StyledElement::attributeChanged(attr);
+    StyledElement::attributeChanged(attribute);
 
     // When an animated SVG property changes through SVG DOM, svgAttributeChanged() is called, not attributeChanged().
     // Next time someone tries to access the XML attributes, the synchronization code starts. During that synchronization
@@ -424,15 +512,15 @@ void SVGElement::attributeChanged(Attribute* attr)
     if (isSynchronizingSVGAttributes())
         return;
 
-    if (isIdAttributeName(attr->name())) {
+    if (isIdAttributeName(attribute.name())) {
         document()->accessSVGExtensions()->removeAllAnimationElementsFromTarget(this);
         document()->accessSVGExtensions()->removeAllElementReferencesForTarget(this);
     }
 
     // Changes to the style attribute are processed lazily (see Element::getAttribute() and related methods),
     // so we don't want changes to the style attribute to result in extra work here.
-    if (attr->name() != HTMLNames::styleAttr)
-        svgAttributeChanged(attr->name());
+    if (attribute.name() != HTMLNames::styleAttr)
+        svgAttributeChanged(attribute.name());
 }
 
 void SVGElement::updateAnimatedSVGAttribute(const QualifiedName& name) const
diff --git a/Source/WebCore/svg/SVGElement.h b/Source/WebCore/svg/SVGElement.h
index 5c9a3dcc3..085fc19c1 100644
--- a/Source/WebCore/svg/SVGElement.h
+++ b/Source/WebCore/svg/SVGElement.h
@@ -91,7 +91,7 @@ public:
 
     virtual void updateAnimatedSVGAttribute(const QualifiedName&) const;
  
-    virtual PassRefPtr<RenderStyle> customStyleForRenderer();
+    virtual PassRefPtr<RenderStyle> customStyleForRenderer() OVERRIDE;
 
     static void synchronizeRequiredFeatures(void* contextElement);
     static void synchronizeRequiredExtensions(void* contextElement);
@@ -113,13 +113,16 @@ public:
 
     virtual bool haveLoadedRequiredResources();
 
+    virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture) OVERRIDE;
+    virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture) OVERRIDE;
+
 protected:
     SVGElement(const QualifiedName&, Document*, ConstructionType = CreateSVGElement);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual void finishParsingChildren();
-    virtual void attributeChanged(Attribute*) OVERRIDE;
+    virtual void attributeChanged(const Attribute&) OVERRIDE;
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     
     virtual void removedFrom(Node*) OVERRIDE;
@@ -127,7 +130,7 @@ protected:
     SVGElementRareData* rareSVGData() const;
     SVGElementRareData* ensureRareSVGData();
 
-    void reportAttributeParsingError(SVGParsingError, Attribute*);
+    void reportAttributeParsingError(SVGParsingError, const Attribute&);
 
 private:
     friend class SVGElementInstance;
diff --git a/Source/WebCore/svg/SVGEllipseElement.cpp b/Source/WebCore/svg/SVGEllipseElement.cpp
index 4371a7a0e..8ac741305 100644
--- a/Source/WebCore/svg/SVGEllipseElement.cpp
+++ b/Source/WebCore/svg/SVGEllipseElement.cpp
@@ -82,27 +82,27 @@ bool SVGEllipseElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGEllipseElement::parseAttribute(Attribute* attr)
+void SVGEllipseElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledTransformableElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::cxAttr)
-        setCxBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::cyAttr)
-        setCyBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::rxAttr)
-        setRxBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError, ForbidNegativeLengths));
-    else if (attr->name() == SVGNames::ryAttr)
-        setRyBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError, ForbidNegativeLengths));
-    else if (SVGTests::parseAttribute(attr)
-             || SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledTransformableElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::cxAttr)
+        setCxBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::cyAttr)
+        setCyBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::rxAttr)
+        setRxBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (attribute.name() == SVGNames::ryAttr)
+        setRyBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (SVGTests::parseAttribute(attribute)
+             || SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGEllipseElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGEllipseElement.h b/Source/WebCore/svg/SVGEllipseElement.h
index caea1e67a..1d43eb335 100644
--- a/Source/WebCore/svg/SVGEllipseElement.h
+++ b/Source/WebCore/svg/SVGEllipseElement.h
@@ -45,7 +45,7 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGExternalResourcesRequired.cpp b/Source/WebCore/svg/SVGExternalResourcesRequired.cpp
index 3d33f0449..469eb8734 100644
--- a/Source/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/Source/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -28,10 +28,10 @@
 
 namespace WebCore {
 
-bool SVGExternalResourcesRequired::parseAttribute(Attribute* attr)
+bool SVGExternalResourcesRequired::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == SVGNames::externalResourcesRequiredAttr) {
-        setExternalResourcesRequiredBaseValue(attr->value() == "true");
+    if (attribute.name() == SVGNames::externalResourcesRequiredAttr) {
+        setExternalResourcesRequiredBaseValue(attribute.value() == "true");
         return true;
     }
 
diff --git a/Source/WebCore/svg/SVGExternalResourcesRequired.h b/Source/WebCore/svg/SVGExternalResourcesRequired.h
index ddc8999af..5b0bf8f31 100644
--- a/Source/WebCore/svg/SVGExternalResourcesRequired.h
+++ b/Source/WebCore/svg/SVGExternalResourcesRequired.h
@@ -39,7 +39,7 @@ class SVGExternalResourcesRequired {
 public:
     virtual ~SVGExternalResourcesRequired() { }
 
-    bool parseAttribute(Attribute*);
+    bool parseAttribute(const Attribute&);
     bool isKnownAttribute(const QualifiedName&);
     void addSupportedAttributes(HashSet<QualifiedName>&);
     bool handleAttributeChange(SVGElement*, const QualifiedName&);
diff --git a/Source/WebCore/svg/SVGFEBlendElement.cpp b/Source/WebCore/svg/SVGFEBlendElement.cpp
index f1fc9fba2..faa0b382b 100644
--- a/Source/WebCore/svg/SVGFEBlendElement.cpp
+++ b/Source/WebCore/svg/SVGFEBlendElement.cpp
@@ -67,27 +67,27 @@ bool SVGFEBlendElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEBlendElement::parseAttribute(Attribute* attr)
+void SVGFEBlendElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::modeAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::modeAttr) {
         BlendModeType propertyValue = SVGPropertyTraits<BlendModeType>::fromString(value);
         if (propertyValue > 0)
             setModeBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::in2Attr) {
+    if (attribute.name() == SVGNames::in2Attr) {
         setIn2BaseValue(value);
         return;
     }
diff --git a/Source/WebCore/svg/SVGFEBlendElement.h b/Source/WebCore/svg/SVGFEBlendElement.h
index 19220a1fc..899132ab4 100644
--- a/Source/WebCore/svg/SVGFEBlendElement.h
+++ b/Source/WebCore/svg/SVGFEBlendElement.h
@@ -77,7 +77,7 @@ private:
     SVGFEBlendElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName& attrName);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
diff --git a/Source/WebCore/svg/SVGFEColorMatrixElement.cpp b/Source/WebCore/svg/SVGFEColorMatrixElement.cpp
index 269d6d38f..2cb4b844b 100644
--- a/Source/WebCore/svg/SVGFEColorMatrixElement.cpp
+++ b/Source/WebCore/svg/SVGFEColorMatrixElement.cpp
@@ -67,27 +67,27 @@ bool SVGFEColorMatrixElement::isSupportedAttribute(const QualifiedName& attrName
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEColorMatrixElement::parseAttribute(Attribute* attr)
+void SVGFEColorMatrixElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::typeAttr) {
-        ColorMatrixType propertyValue = SVGPropertyTraits<ColorMatrixType>::fromString(attr->value());
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::typeAttr) {
+        ColorMatrixType propertyValue = SVGPropertyTraits<ColorMatrixType>::fromString(attribute.value());
         if (propertyValue > 0)
             setTypeBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::valuesAttr) {
+    if (attribute.name() == SVGNames::valuesAttr) {
         SVGNumberList newList;
         newList.parse(value);
         detachAnimatedValuesListWrappers(newList.size());
diff --git a/Source/WebCore/svg/SVGFEColorMatrixElement.h b/Source/WebCore/svg/SVGFEColorMatrixElement.h
index 5edd55244..ed33df001 100644
--- a/Source/WebCore/svg/SVGFEColorMatrixElement.h
+++ b/Source/WebCore/svg/SVGFEColorMatrixElement.h
@@ -74,7 +74,7 @@ private:
     SVGFEColorMatrixElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName&);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
diff --git a/Source/WebCore/svg/SVGFEComponentTransferElement.cpp b/Source/WebCore/svg/SVGFEComponentTransferElement.cpp
index fc69dfc49..16651a9f7 100644
--- a/Source/WebCore/svg/SVGFEComponentTransferElement.cpp
+++ b/Source/WebCore/svg/SVGFEComponentTransferElement.cpp
@@ -62,15 +62,15 @@ bool SVGFEComponentTransferElement::isSupportedAttribute(const QualifiedName& at
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEComponentTransferElement::parseAttribute(Attribute* attr)
+void SVGFEComponentTransferElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::inAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
diff --git a/Source/WebCore/svg/SVGFEComponentTransferElement.h b/Source/WebCore/svg/SVGFEComponentTransferElement.h
index edafcaa5d..79b5dc9fb 100644
--- a/Source/WebCore/svg/SVGFEComponentTransferElement.h
+++ b/Source/WebCore/svg/SVGFEComponentTransferElement.h
@@ -36,7 +36,7 @@ private:
 
     // FIXME: svgAttributeChanged missing.
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGFEComponentTransferElement)
diff --git a/Source/WebCore/svg/SVGFECompositeElement.cpp b/Source/WebCore/svg/SVGFECompositeElement.cpp
index 5108bfc3b..ef59d0d04 100644
--- a/Source/WebCore/svg/SVGFECompositeElement.cpp
+++ b/Source/WebCore/svg/SVGFECompositeElement.cpp
@@ -79,47 +79,47 @@ bool SVGFECompositeElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFECompositeElement::parseAttribute(Attribute* attr)
+void SVGFECompositeElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::operatorAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::operatorAttr) {
         CompositeOperationType propertyValue = SVGPropertyTraits<CompositeOperationType>::fromString(value);
         if (propertyValue > 0)
             set_operatorBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::in2Attr) {
+    if (attribute.name() == SVGNames::in2Attr) {
         setIn2BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::k1Attr) {
+    if (attribute.name() == SVGNames::k1Attr) {
         setK1BaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::k2Attr) {
+    if (attribute.name() == SVGNames::k2Attr) {
         setK2BaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::k3Attr) {
+    if (attribute.name() == SVGNames::k3Attr) {
         setK3BaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::k4Attr) {
+    if (attribute.name() == SVGNames::k4Attr) {
         setK4BaseValue(value.toFloat());
         return;
     }
diff --git a/Source/WebCore/svg/SVGFECompositeElement.h b/Source/WebCore/svg/SVGFECompositeElement.h
index 21786d9fe..cb9867695 100644
--- a/Source/WebCore/svg/SVGFECompositeElement.h
+++ b/Source/WebCore/svg/SVGFECompositeElement.h
@@ -82,7 +82,7 @@ private:
     SVGFECompositeElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName&);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
diff --git a/Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp b/Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp
index 4ffe7d753..9a44ef836 100644
--- a/Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp
+++ b/Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp
@@ -119,20 +119,20 @@ bool SVGFEConvolveMatrixElement::isSupportedAttribute(const QualifiedName& attrN
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEConvolveMatrixElement::parseAttribute(Attribute* attr)
+void SVGFEConvolveMatrixElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::inAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::orderAttr) {
+    if (attribute.name() == SVGNames::orderAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y) && x >= 1 && y >= 1) {
             setOrderXBaseValue(x);
@@ -144,7 +144,7 @@ void SVGFEConvolveMatrixElement::parseAttribute(Attribute* attr)
         return;
     }
 
-    if (attr->name() == SVGNames::edgeModeAttr) {
+    if (attribute.name() == SVGNames::edgeModeAttr) {
         EdgeModeType propertyValue = SVGPropertyTraits<EdgeModeType>::fromString(value);
         if (propertyValue > 0)
             setEdgeModeBaseValue(propertyValue);
@@ -155,7 +155,7 @@ void SVGFEConvolveMatrixElement::parseAttribute(Attribute* attr)
         return;
     }
 
-    if (attr->name() == SVGNames::kernelMatrixAttr) {
+    if (attribute.name() == SVGNames::kernelMatrixAttr) {
         SVGNumberList newList;
         newList.parse(value);
         detachAnimatedKernelMatrixListWrappers(newList.size());
@@ -163,7 +163,7 @@ void SVGFEConvolveMatrixElement::parseAttribute(Attribute* attr)
         return;
     }
 
-    if (attr->name() == SVGNames::divisorAttr) {
+    if (attribute.name() == SVGNames::divisorAttr) {
         float divisor = value.toFloat();
         if (divisor)
             setDivisorBaseValue(divisor);
@@ -174,22 +174,22 @@ void SVGFEConvolveMatrixElement::parseAttribute(Attribute* attr)
         return;
     }
     
-    if (attr->name() == SVGNames::biasAttr) {
+    if (attribute.name() == SVGNames::biasAttr) {
         setBiasBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::targetXAttr) {
+    if (attribute.name() == SVGNames::targetXAttr) {
         setTargetXBaseValue(value.string().toUIntStrict());
         return;
     }
 
-    if (attr->name() == SVGNames::targetYAttr) {
+    if (attribute.name() == SVGNames::targetYAttr) {
         setTargetYBaseValue(value.string().toUIntStrict());
         return;
     }
 
-    if (attr->name() == SVGNames::kernelUnitLengthAttr) {
+    if (attribute.name() == SVGNames::kernelUnitLengthAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y) && x > 0 && y > 0) {
             setKernelUnitLengthXBaseValue(x);
@@ -201,7 +201,7 @@ void SVGFEConvolveMatrixElement::parseAttribute(Attribute* attr)
         return;
     }
 
-    if (attr->name() == SVGNames::preserveAlphaAttr) {
+    if (attribute.name() == SVGNames::preserveAlphaAttr) {
         if (value == "true")
             setPreserveAlphaBaseValue(true);
         else if (value == "false")
diff --git a/Source/WebCore/svg/SVGFEConvolveMatrixElement.h b/Source/WebCore/svg/SVGFEConvolveMatrixElement.h
index 4d5129d49..023865af3 100644
--- a/Source/WebCore/svg/SVGFEConvolveMatrixElement.h
+++ b/Source/WebCore/svg/SVGFEConvolveMatrixElement.h
@@ -75,7 +75,7 @@ private:
     SVGFEConvolveMatrixElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName&);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
diff --git a/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp b/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp
index 3f4993cd1..694785518 100644
--- a/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp
+++ b/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp
@@ -90,30 +90,30 @@ bool SVGFEDiffuseLightingElement::isSupportedAttribute(const QualifiedName& attr
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEDiffuseLightingElement::parseAttribute(Attribute* attr)
+void SVGFEDiffuseLightingElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name()) || attr->name() == SVGNames::lighting_colorAttr) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name()) || attribute.name() == SVGNames::lighting_colorAttr) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::inAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::surfaceScaleAttr) {
+    if (attribute.name() == SVGNames::surfaceScaleAttr) {
         setSurfaceScaleBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::diffuseConstantAttr) {
+    if (attribute.name() == SVGNames::diffuseConstantAttr) {
         setDiffuseConstantBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::kernelUnitLengthAttr) {
+    if (attribute.name() == SVGNames::kernelUnitLengthAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y)) {
             setKernelUnitLengthXBaseValue(x);
diff --git a/Source/WebCore/svg/SVGFEDiffuseLightingElement.h b/Source/WebCore/svg/SVGFEDiffuseLightingElement.h
index 57078d60d..6a894ccc9 100644
--- a/Source/WebCore/svg/SVGFEDiffuseLightingElement.h
+++ b/Source/WebCore/svg/SVGFEDiffuseLightingElement.h
@@ -40,7 +40,7 @@ private:
     SVGFEDiffuseLightingElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName&);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
diff --git a/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp b/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
index cff8dc76e..815b7f855 100644
--- a/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
+++ b/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
@@ -73,39 +73,39 @@ bool SVGFEDisplacementMapElement::isSupportedAttribute(const QualifiedName& attr
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEDisplacementMapElement::parseAttribute(Attribute* attr)
+void SVGFEDisplacementMapElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::xChannelSelectorAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::xChannelSelectorAttr) {
         ChannelSelectorType propertyValue = SVGPropertyTraits<ChannelSelectorType>::fromString(value);
         if (propertyValue > 0)
             setXChannelSelectorBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::yChannelSelectorAttr) {
+    if (attribute.name() == SVGNames::yChannelSelectorAttr) {
         ChannelSelectorType propertyValue = SVGPropertyTraits<ChannelSelectorType>::fromString(value);
         if (propertyValue > 0)
             setYChannelSelectorBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::in2Attr) {
+    if (attribute.name() == SVGNames::in2Attr) {
         setIn2BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::scaleAttr) {
+    if (attribute.name() == SVGNames::scaleAttr) {
         setScaleBaseValue(value.toFloat());
         return;
     }
diff --git a/Source/WebCore/svg/SVGFEDisplacementMapElement.h b/Source/WebCore/svg/SVGFEDisplacementMapElement.h
index a614befcd..0aa84385b 100644
--- a/Source/WebCore/svg/SVGFEDisplacementMapElement.h
+++ b/Source/WebCore/svg/SVGFEDisplacementMapElement.h
@@ -75,7 +75,7 @@ private:
     SVGFEDisplacementMapElement(const QualifiedName& tagName, Document*);
     
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName& attrName);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
diff --git a/Source/WebCore/svg/SVGFEDropShadowElement.cpp b/Source/WebCore/svg/SVGFEDropShadowElement.cpp
index de2d10931..552351a63 100644
--- a/Source/WebCore/svg/SVGFEDropShadowElement.cpp
+++ b/Source/WebCore/svg/SVGFEDropShadowElement.cpp
@@ -95,15 +95,15 @@ bool SVGFEDropShadowElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEDropShadowElement::parseAttribute(Attribute* attr)
+void SVGFEDropShadowElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::stdDeviationAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::stdDeviationAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y)) {
             setStdDeviationXBaseValue(x);
@@ -112,18 +112,18 @@ void SVGFEDropShadowElement::parseAttribute(Attribute* attr)
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::dxAttr) {
-        setDxBaseValue(attr->value().toFloat());
+    if (attribute.name() == SVGNames::dxAttr) {
+        setDxBaseValue(attribute.value().toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::dyAttr) {
-        setDyBaseValue(attr->value().toFloat());
+    if (attribute.name() == SVGNames::dyAttr) {
+        setDyBaseValue(attribute.value().toFloat());
         return;
     }
 
diff --git a/Source/WebCore/svg/SVGFEDropShadowElement.h b/Source/WebCore/svg/SVGFEDropShadowElement.h
index bf0fb1b81..76eb167bd 100644
--- a/Source/WebCore/svg/SVGFEDropShadowElement.h
+++ b/Source/WebCore/svg/SVGFEDropShadowElement.h
@@ -37,7 +37,7 @@ private:
     SVGFEDropShadowElement(const QualifiedName&, Document*);
     
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
     
diff --git a/Source/WebCore/svg/SVGFEGaussianBlurElement.cpp b/Source/WebCore/svg/SVGFEGaussianBlurElement.cpp
index c967e94c5..89fb3a5d8 100644
--- a/Source/WebCore/svg/SVGFEGaussianBlurElement.cpp
+++ b/Source/WebCore/svg/SVGFEGaussianBlurElement.cpp
@@ -85,15 +85,15 @@ bool SVGFEGaussianBlurElement::isSupportedAttribute(const QualifiedName& attrNam
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEGaussianBlurElement::parseAttribute(Attribute* attr)
+void SVGFEGaussianBlurElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::stdDeviationAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::stdDeviationAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y)) {
             setStdDeviationXBaseValue(x);
@@ -102,7 +102,7 @@ void SVGFEGaussianBlurElement::parseAttribute(Attribute* attr)
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
diff --git a/Source/WebCore/svg/SVGFEGaussianBlurElement.h b/Source/WebCore/svg/SVGFEGaussianBlurElement.h
index 5f4146034..5e8aaaf65 100644
--- a/Source/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/Source/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -38,7 +38,7 @@ private:
     SVGFEGaussianBlurElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
diff --git a/Source/WebCore/svg/SVGFEImageElement.cpp b/Source/WebCore/svg/SVGFEImageElement.cpp
index efa22add7..12b4d48b0 100644
--- a/Source/WebCore/svg/SVGFEImageElement.cpp
+++ b/Source/WebCore/svg/SVGFEImageElement.cpp
@@ -126,25 +126,25 @@ bool SVGFEImageElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEImageElement::parseAttribute(Attribute* attr)
+void SVGFEImageElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::preserveAspectRatioAttr) {
+    if (attribute.name() == SVGNames::preserveAspectRatioAttr) {
         SVGPreserveAspectRatio preserveAspectRatio;
-        preserveAspectRatio.parse(attr->value());
+        preserveAspectRatio.parse(attribute.value());
         setPreserveAspectRatioBaseValue(preserveAspectRatio);
         return;
     }
 
-    if (SVGURIReference::parseAttribute(attr))
+    if (SVGURIReference::parseAttribute(attribute))
         return;
-    if (SVGLangSpace::parseAttribute(attr))
+    if (SVGLangSpace::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGFEImageElement.h b/Source/WebCore/svg/SVGFEImageElement.h
index a2aa2484e..a7f9923a7 100644
--- a/Source/WebCore/svg/SVGFEImageElement.h
+++ b/Source/WebCore/svg/SVGFEImageElement.h
@@ -49,7 +49,7 @@ private:
     SVGFEImageElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void notifyFinished(CachedResource*);
 
diff --git a/Source/WebCore/svg/SVGFELightElement.cpp b/Source/WebCore/svg/SVGFELightElement.cpp
index b818a050f..384b2a6e4 100644
--- a/Source/WebCore/svg/SVGFELightElement.cpp
+++ b/Source/WebCore/svg/SVGFELightElement.cpp
@@ -106,60 +106,60 @@ bool SVGFELightElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFELightElement::parseAttribute(Attribute* attr)
+void SVGFELightElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGElement::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::azimuthAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::azimuthAttr) {
         setAzimuthBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::elevationAttr) {
+    if (attribute.name() == SVGNames::elevationAttr) {
         setElevationBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::xAttr) {
+    if (attribute.name() == SVGNames::xAttr) {
         setXBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::yAttr) {
+    if (attribute.name() == SVGNames::yAttr) {
         setYBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::zAttr) {
+    if (attribute.name() == SVGNames::zAttr) {
         setZBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::pointsAtXAttr) {
+    if (attribute.name() == SVGNames::pointsAtXAttr) {
         setPointsAtXBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::pointsAtYAttr) {
+    if (attribute.name() == SVGNames::pointsAtYAttr) {
         setPointsAtYBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::pointsAtZAttr) {
+    if (attribute.name() == SVGNames::pointsAtZAttr) {
         setPointsAtZBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::specularExponentAttr) {
+    if (attribute.name() == SVGNames::specularExponentAttr) {
         setSpecularExponentBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::limitingConeAngleAttr) {
+    if (attribute.name() == SVGNames::limitingConeAngleAttr) {
         setLimitingConeAngleBaseValue(value.toFloat());
         return;
     }
diff --git a/Source/WebCore/svg/SVGFELightElement.h b/Source/WebCore/svg/SVGFELightElement.h
index 39ece3fa3..89d8c2d0c 100644
--- a/Source/WebCore/svg/SVGFELightElement.h
+++ b/Source/WebCore/svg/SVGFELightElement.h
@@ -40,7 +40,7 @@ protected:
 
 private:
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/svg/SVGFEMergeNodeElement.cpp b/Source/WebCore/svg/SVGFEMergeNodeElement.cpp
index b5b5cc513..8cd0ca653 100644
--- a/Source/WebCore/svg/SVGFEMergeNodeElement.cpp
+++ b/Source/WebCore/svg/SVGFEMergeNodeElement.cpp
@@ -60,15 +60,15 @@ bool SVGFEMergeNodeElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEMergeNodeElement::parseAttribute(Attribute* attr)
+void SVGFEMergeNodeElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
-        setIn1BaseValue(attr->value());
+    if (attribute.name() == SVGNames::inAttr) {
+        setIn1BaseValue(attribute.value());
         return;
     }
 
diff --git a/Source/WebCore/svg/SVGFEMergeNodeElement.h b/Source/WebCore/svg/SVGFEMergeNodeElement.h
index e4eab7636..c592ae5f6 100644
--- a/Source/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/Source/WebCore/svg/SVGFEMergeNodeElement.h
@@ -35,7 +35,7 @@ private:
     SVGFEMergeNodeElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGFEMergeNodeElement)
diff --git a/Source/WebCore/svg/SVGFEMorphologyElement.cpp b/Source/WebCore/svg/SVGFEMorphologyElement.cpp
index 13c6ce663..d688d851e 100644
--- a/Source/WebCore/svg/SVGFEMorphologyElement.cpp
+++ b/Source/WebCore/svg/SVGFEMorphologyElement.cpp
@@ -88,27 +88,27 @@ bool SVGFEMorphologyElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEMorphologyElement::parseAttribute(Attribute* attr)
+void SVGFEMorphologyElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::operatorAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::operatorAttr) {
         MorphologyOperatorType propertyValue = SVGPropertyTraits<MorphologyOperatorType>::fromString(value);
         if (propertyValue > 0)
             set_operatorBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::radiusAttr) {
+    if (attribute.name() == SVGNames::radiusAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y)) {
             setRadiusXBaseValue(x);
diff --git a/Source/WebCore/svg/SVGFEMorphologyElement.h b/Source/WebCore/svg/SVGFEMorphologyElement.h
index c12069e38..7449acbaf 100644
--- a/Source/WebCore/svg/SVGFEMorphologyElement.h
+++ b/Source/WebCore/svg/SVGFEMorphologyElement.h
@@ -67,7 +67,7 @@ private:
     SVGFEMorphologyElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName&);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
diff --git a/Source/WebCore/svg/SVGFEOffsetElement.cpp b/Source/WebCore/svg/SVGFEOffsetElement.cpp
index 0bd4ccb21..65f81c823 100644
--- a/Source/WebCore/svg/SVGFEOffsetElement.cpp
+++ b/Source/WebCore/svg/SVGFEOffsetElement.cpp
@@ -66,25 +66,25 @@ bool SVGFEOffsetElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFEOffsetElement::parseAttribute(Attribute* attr)
+void SVGFEOffsetElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::dxAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::dxAttr) {
         setDxBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::dyAttr) {
+    if (attribute.name() == SVGNames::dyAttr) {
         setDyBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
diff --git a/Source/WebCore/svg/SVGFEOffsetElement.h b/Source/WebCore/svg/SVGFEOffsetElement.h
index 20c6ae190..e1fe166b7 100644
--- a/Source/WebCore/svg/SVGFEOffsetElement.h
+++ b/Source/WebCore/svg/SVGFEOffsetElement.h
@@ -36,7 +36,7 @@ private:
     SVGFEOffsetElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
diff --git a/Source/WebCore/svg/SVGFESpecularLightingElement.cpp b/Source/WebCore/svg/SVGFESpecularLightingElement.cpp
index 5fab21490..ceb2fbaa5 100644
--- a/Source/WebCore/svg/SVGFESpecularLightingElement.cpp
+++ b/Source/WebCore/svg/SVGFESpecularLightingElement.cpp
@@ -94,35 +94,35 @@ bool SVGFESpecularLightingElement::isSupportedAttribute(const QualifiedName& att
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFESpecularLightingElement::parseAttribute(Attribute* attr)
+void SVGFESpecularLightingElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::inAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::inAttr) {
         setIn1BaseValue(value);
         return;
     }
 
-    if (attr->name() == SVGNames::surfaceScaleAttr) {
+    if (attribute.name() == SVGNames::surfaceScaleAttr) {
         setSurfaceScaleBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::specularConstantAttr) {
+    if (attribute.name() == SVGNames::specularConstantAttr) {
         setSpecularConstantBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::specularExponentAttr) {
+    if (attribute.name() == SVGNames::specularExponentAttr) {
         setSpecularExponentBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::kernelUnitLengthAttr) {
+    if (attribute.name() == SVGNames::kernelUnitLengthAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y)) {
             setKernelUnitLengthXBaseValue(x);
diff --git a/Source/WebCore/svg/SVGFESpecularLightingElement.h b/Source/WebCore/svg/SVGFESpecularLightingElement.h
index c67fddcaa..fedb214c8 100644
--- a/Source/WebCore/svg/SVGFESpecularLightingElement.h
+++ b/Source/WebCore/svg/SVGFESpecularLightingElement.h
@@ -39,7 +39,7 @@ private:
     SVGFESpecularLightingElement(const QualifiedName&, Document*);
     
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName&);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
diff --git a/Source/WebCore/svg/SVGFETileElement.cpp b/Source/WebCore/svg/SVGFETileElement.cpp
index 8162eaa9b..e2947666c 100644
--- a/Source/WebCore/svg/SVGFETileElement.cpp
+++ b/Source/WebCore/svg/SVGFETileElement.cpp
@@ -60,15 +60,15 @@ bool SVGFETileElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFETileElement::parseAttribute(Attribute* attr)
+void SVGFETileElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::inAttr) {
-        setIn1BaseValue(attr->value());
+    if (attribute.name() == SVGNames::inAttr) {
+        setIn1BaseValue(attribute.value());
         return;
     }
 
diff --git a/Source/WebCore/svg/SVGFETileElement.h b/Source/WebCore/svg/SVGFETileElement.h
index 9094eb338..10cd8dbbf 100644
--- a/Source/WebCore/svg/SVGFETileElement.h
+++ b/Source/WebCore/svg/SVGFETileElement.h
@@ -35,7 +35,7 @@ private:
     SVGFETileElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 
diff --git a/Source/WebCore/svg/SVGFETurbulenceElement.cpp b/Source/WebCore/svg/SVGFETurbulenceElement.cpp
index 02756fe7d..aa177994a 100644
--- a/Source/WebCore/svg/SVGFETurbulenceElement.cpp
+++ b/Source/WebCore/svg/SVGFETurbulenceElement.cpp
@@ -88,29 +88,29 @@ bool SVGFETurbulenceElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFETurbulenceElement::parseAttribute(Attribute* attr)
+void SVGFETurbulenceElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGFilterPrimitiveStandardAttributes::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGFilterPrimitiveStandardAttributes::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::typeAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::typeAttr) {
         TurbulenceType propertyValue = SVGPropertyTraits<TurbulenceType>::fromString(value);
         if (propertyValue > 0)
             setTypeBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::stitchTilesAttr) {
+    if (attribute.name() == SVGNames::stitchTilesAttr) {
         SVGStitchOptions propertyValue = SVGPropertyTraits<SVGStitchOptions>::fromString(value);
         if (propertyValue > 0)
             setStitchTilesBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::baseFrequencyAttr) {
+    if (attribute.name() == SVGNames::baseFrequencyAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y)) {
             setBaseFrequencyXBaseValue(x);
@@ -119,12 +119,12 @@ void SVGFETurbulenceElement::parseAttribute(Attribute* attr)
         return;
     }
 
-    if (attr->name() == SVGNames::seedAttr) {
+    if (attribute.name() == SVGNames::seedAttr) {
         setSeedBaseValue(value.toFloat());
         return;
     }
 
-    if (attr->name() == SVGNames::numOctavesAttr) {
+    if (attribute.name() == SVGNames::numOctavesAttr) {
         setNumOctavesBaseValue(value.string().toUIntStrict());
         return;
     }
diff --git a/Source/WebCore/svg/SVGFETurbulenceElement.h b/Source/WebCore/svg/SVGFETurbulenceElement.h
index 9ee2a03a8..aa1a9fbdb 100644
--- a/Source/WebCore/svg/SVGFETurbulenceElement.h
+++ b/Source/WebCore/svg/SVGFETurbulenceElement.h
@@ -102,7 +102,7 @@ private:
     SVGFETurbulenceElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName& attrName);
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
diff --git a/Source/WebCore/svg/SVGFilterElement.cpp b/Source/WebCore/svg/SVGFilterElement.cpp
index 2f3e80a17..9b81667e0 100644
--- a/Source/WebCore/svg/SVGFilterElement.cpp
+++ b/Source/WebCore/svg/SVGFilterElement.cpp
@@ -121,42 +121,42 @@ bool SVGFilterElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFilterElement::parseAttribute(Attribute* attr)
+void SVGFilterElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
-    const AtomicString& value = attr->value();
+    const AtomicString& value = attribute.value();
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::filterUnitsAttr) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::filterUnitsAttr) {
         SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(value);
         if (propertyValue > 0)
             setFilterUnitsBaseValue(propertyValue);
-    } else if (attr->name() == SVGNames::primitiveUnitsAttr) {
+    } else if (attribute.name() == SVGNames::primitiveUnitsAttr) {
         SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(value);
         if (propertyValue > 0)
             setPrimitiveUnitsBaseValue(propertyValue);
-    } else if (attr->name() == SVGNames::xAttr)
+    } else if (attribute.name() == SVGNames::xAttr)
         setXBaseValue(SVGLength::construct(LengthModeWidth, value, parseError));
-    else if (attr->name() == SVGNames::yAttr)
+    else if (attribute.name() == SVGNames::yAttr)
         setYBaseValue(SVGLength::construct(LengthModeHeight, value, parseError));
-    else if (attr->name() == SVGNames::widthAttr)
+    else if (attribute.name() == SVGNames::widthAttr)
         setWidthBaseValue(SVGLength::construct(LengthModeWidth, value, parseError));
-    else if (attr->name() == SVGNames::heightAttr)
+    else if (attribute.name() == SVGNames::heightAttr)
         setHeightBaseValue(SVGLength::construct(LengthModeHeight, value, parseError));
-    else if (attr->name() == SVGNames::filterResAttr) {
+    else if (attribute.name() == SVGNames::filterResAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y)) {
             setFilterResXBaseValue(x);
             setFilterResYBaseValue(y);
         }
-    } else if (SVGURIReference::parseAttribute(attr)
-             || SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)) {
+    } else if (SVGURIReference::parseAttribute(attribute)
+             || SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGFilterElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGFilterElement.h b/Source/WebCore/svg/SVGFilterElement.h
index 603c69aaa..b54df401c 100644
--- a/Source/WebCore/svg/SVGFilterElement.h
+++ b/Source/WebCore/svg/SVGFilterElement.h
@@ -51,7 +51,7 @@ private:
     virtual bool needsPendingResourceHandling() const { return false; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index 1c9714364..baeea2364 100644
--- a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -77,27 +77,27 @@ bool SVGFilterPrimitiveStandardAttributes::isSupportedAttribute(const QualifiedN
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGFilterPrimitiveStandardAttributes::parseAttribute(Attribute* attr)
+void SVGFilterPrimitiveStandardAttributes::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
-    const AtomicString& value = attr->value();
+    const AtomicString& value = attribute.value();
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::xAttr)
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::xAttr)
         setXBaseValue(SVGLength::construct(LengthModeWidth, value, parseError));
-    else if (attr->name() == SVGNames::yAttr)
+    else if (attribute.name() == SVGNames::yAttr)
         setYBaseValue(SVGLength::construct(LengthModeHeight, value, parseError));
-    else if (attr->name() == SVGNames::widthAttr)
+    else if (attribute.name() == SVGNames::widthAttr)
         setWidthBaseValue(SVGLength::construct(LengthModeWidth, value, parseError));
-    else if (attr->name() == SVGNames::heightAttr)
+    else if (attribute.name() == SVGNames::heightAttr)
         setHeightBaseValue(SVGLength::construct(LengthModeHeight, value, parseError));
-    else if (attr->name() == SVGNames::resultAttr)
+    else if (attribute.name() == SVGNames::resultAttr)
         setResultBaseValue(value);
     else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 bool SVGFilterPrimitiveStandardAttributes::setFilterEffectAttribute(FilterEffect*, const QualifiedName&)
diff --git a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index f73441d0a..b619a4a96 100644
--- a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -49,7 +49,7 @@ protected:
     SVGFilterPrimitiveStandardAttributes(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/svg/SVGFitToViewBox.cpp b/Source/WebCore/svg/SVGFitToViewBox.cpp
index 2c7b106fd..e4df4ff3f 100644
--- a/Source/WebCore/svg/SVGFitToViewBox.cpp
+++ b/Source/WebCore/svg/SVGFitToViewBox.cpp
@@ -88,17 +88,19 @@ AffineTransform SVGFitToViewBox::viewBoxToViewTransform(const FloatRect& viewBox
     return preserveAspectRatio.getCTM(viewBoxRect.x(), viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(), viewWidth, viewHeight);
 }
 
-bool SVGFitToViewBox::parseAttribute(Document* document, Attribute* attr)
+bool SVGFitToViewBox::parseAttribute(Document* document, const Attribute& attribute)
 {
-    if (attr->name() == SVGNames::viewBoxAttr) {
+    if (attribute.name() == SVGNames::viewBoxAttr) {
         FloatRect viewBox;
-        if (!attr->value().isNull())
-            parseViewBox(document, attr->value(), viewBox);
+        if (!attribute.isNull())
+            parseViewBox(document, attribute.value(), viewBox);
         setViewBoxBaseValue(viewBox);
         return true;
-    } else if (attr->name() == SVGNames::preserveAspectRatioAttr) {
+    }
+
+    if (attribute.name() == SVGNames::preserveAspectRatioAttr) {
         SVGPreserveAspectRatio preserveAspectRatio;
-        preserveAspectRatio.parse(attr->value());
+        preserveAspectRatio.parse(attribute.value());
         setPreserveAspectRatioBaseValue(preserveAspectRatio);
         return true;
     }
diff --git a/Source/WebCore/svg/SVGFitToViewBox.h b/Source/WebCore/svg/SVGFitToViewBox.h
index 8ce5e9acf..d77144500 100644
--- a/Source/WebCore/svg/SVGFitToViewBox.h
+++ b/Source/WebCore/svg/SVGFitToViewBox.h
@@ -40,7 +40,7 @@ public:
     bool parseViewBox(Document*, const UChar*& start, const UChar* end, FloatRect& viewBox, bool validate = true);
     static AffineTransform viewBoxToViewTransform(const FloatRect& viewBoxRect, const SVGPreserveAspectRatio&, float viewWidth, float viewHeight);
 
-    bool parseAttribute(Document*, Attribute*);
+    bool parseAttribute(Document*, const Attribute&);
     bool isKnownAttribute(const QualifiedName&);
     void addSupportedAttributes(HashSet<QualifiedName>&);
 
diff --git a/Source/WebCore/svg/SVGFontElement.cpp b/Source/WebCore/svg/SVGFontElement.cpp
index 94e5b81fb..c8ea3c830 100644
--- a/Source/WebCore/svg/SVGFontElement.cpp
+++ b/Source/WebCore/svg/SVGFontElement.cpp
@@ -134,7 +134,7 @@ void SVGFontElement::ensureGlyphCache()
 
             // Register ligatures, if needed, don't mix up with surrogate pairs though!
             if (unicode.length() > 1 && !U16_IS_SURROGATE(unicode[0]))
-                ligatures.append(unicode);
+                ligatures.append(unicode.string());
         } else if (child->hasTagName(SVGNames::hkernTag)) {
             SVGHKernElement* hkern = static_cast<SVGHKernElement*>(child);
             hkern->buildHorizontalKerningPair(m_horizontalKerningPairs);
diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
index 0af0e5f6e..6d6bab2fd 100644
--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
@@ -109,16 +109,16 @@ static CSSPropertyID cssPropertyIdForSVGAttributeName(const QualifiedName& attrN
     return propertyNameToIdMap->get(attrName.localName().impl());
 }
 
-void SVGFontFaceElement::parseAttribute(Attribute* attr)
+void SVGFontFaceElement::parseAttribute(const Attribute& attribute)
 {    
-    CSSPropertyID propId = cssPropertyIdForSVGAttributeName(attr->name());
+    CSSPropertyID propId = cssPropertyIdForSVGAttributeName(attribute.name());
     if (propId > 0) {
-        m_fontFaceRule->properties()->setProperty(propId, attr->value(), false);
+        m_fontFaceRule->properties()->setProperty(propId, attribute.value(), false);
         rebuildFontFace();
         return;
     }
     
-    SVGElement::parseAttribute(attr);
+    SVGElement::parseAttribute(attribute);
 }
 
 unsigned SVGFontFaceElement::unitsPerEm() const
diff --git a/Source/WebCore/svg/SVGFontFaceElement.h b/Source/WebCore/svg/SVGFontFaceElement.h
index 7a21f3369..9d13202c3 100644
--- a/Source/WebCore/svg/SVGFontFaceElement.h
+++ b/Source/WebCore/svg/SVGFontFaceElement.h
@@ -54,7 +54,7 @@ public:
 private:
     SVGFontFaceElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
diff --git a/Source/WebCore/svg/SVGFontFaceUriElement.cpp b/Source/WebCore/svg/SVGFontFaceUriElement.cpp
index 0af98cce1..e21191096 100644
--- a/Source/WebCore/svg/SVGFontFaceUriElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceUriElement.cpp
@@ -61,13 +61,13 @@ PassRefPtr<CSSFontFaceSrcValue> SVGFontFaceUriElement::srcValue() const
     return src.release();
 }
 
-void SVGFontFaceUriElement::parseAttribute(Attribute* attr)
+void SVGFontFaceUriElement::parseAttribute(const Attribute& attribute)
 {
-    const QualifiedName& attrName = attr->name();
+    const QualifiedName& attrName = attribute.name();
     if (attrName == XLinkNames::hrefAttr)
         loadFont();
     else
-        SVGElement::parseAttribute(attr);
+        SVGElement::parseAttribute(attribute);
 }
 
 void SVGFontFaceUriElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
diff --git a/Source/WebCore/svg/SVGFontFaceUriElement.h b/Source/WebCore/svg/SVGFontFaceUriElement.h
index dd6f3aa6e..547f3000a 100644
--- a/Source/WebCore/svg/SVGFontFaceUriElement.h
+++ b/Source/WebCore/svg/SVGFontFaceUriElement.h
@@ -40,7 +40,7 @@ public:
 private:
     SVGFontFaceUriElement(const QualifiedName&, Document*);
     
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
 
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.cpp b/Source/WebCore/svg/SVGForeignObjectElement.cpp
index 1d7407931..f2376aff2 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/Source/WebCore/svg/SVGForeignObjectElement.cpp
@@ -85,28 +85,28 @@ bool SVGForeignObjectElement::isSupportedAttribute(const QualifiedName& attrName
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGForeignObjectElement::parseAttribute(Attribute* attr)
+void SVGForeignObjectElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
-    const AtomicString& value = attr->value();
+    const AtomicString& value = attribute.value();
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledTransformableElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::xAttr)
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledTransformableElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::xAttr)
         setXBaseValue(SVGLength::construct(LengthModeWidth, value, parseError));
-    else if (attr->name() == SVGNames::yAttr)
+    else if (attribute.name() == SVGNames::yAttr)
         setYBaseValue(SVGLength::construct(LengthModeHeight, value, parseError));
-    else if (attr->name() == SVGNames::widthAttr)
+    else if (attribute.name() == SVGNames::widthAttr)
         setWidthBaseValue(SVGLength::construct(LengthModeWidth, value, parseError));
-    else if (attr->name() == SVGNames::heightAttr)
+    else if (attribute.name() == SVGNames::heightAttr)
         setHeightBaseValue(SVGLength::construct(LengthModeHeight, value, parseError));
-    else if (SVGTests::parseAttribute(attr)
-               || SVGLangSpace::parseAttribute(attr)
-               || SVGExternalResourcesRequired::parseAttribute(attr)) {
+    else if (SVGTests::parseAttribute(attribute)
+               || SVGLangSpace::parseAttribute(attribute)
+               || SVGExternalResourcesRequired::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGForeignObjectElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.h b/Source/WebCore/svg/SVGForeignObjectElement.h
index 057ba0507..be23dd3b3 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.h
+++ b/Source/WebCore/svg/SVGForeignObjectElement.h
@@ -43,7 +43,7 @@ private:
 
     virtual bool isValid() const { return SVGTests::isValid(); }
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
diff --git a/Source/WebCore/svg/SVGGElement.cpp b/Source/WebCore/svg/SVGGElement.cpp
index 13fa57181..30bba5380 100644
--- a/Source/WebCore/svg/SVGGElement.cpp
+++ b/Source/WebCore/svg/SVGGElement.cpp
@@ -63,18 +63,18 @@ bool SVGGElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGGElement::parseAttribute(Attribute* attr)
+void SVGGElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledTransformableElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledTransformableElement::parseAttribute(attribute);
         return;
     }
 
-    if (SVGTests::parseAttribute(attr))
+    if (SVGTests::parseAttribute(attribute))
         return;
-    if (SVGLangSpace::parseAttribute(attr))
+    if (SVGLangSpace::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGGElement.h b/Source/WebCore/svg/SVGGElement.h
index 851c6a7a1..1f4ddda55 100644
--- a/Source/WebCore/svg/SVGGElement.h
+++ b/Source/WebCore/svg/SVGGElement.h
@@ -47,7 +47,7 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
diff --git a/Source/WebCore/svg/SVGGlyphElement.cpp b/Source/WebCore/svg/SVGGlyphElement.cpp
index 14d8e9d73..0ef7e495e 100644
--- a/Source/WebCore/svg/SVGGlyphElement.cpp
+++ b/Source/WebCore/svg/SVGGlyphElement.cpp
@@ -53,12 +53,12 @@ void SVGGlyphElement::invalidateGlyphCache()
     }
 }
 
-void SVGGlyphElement::parseAttribute(Attribute* attr)
+void SVGGlyphElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == SVGNames::dAttr)
+    if (attribute.name() == SVGNames::dAttr)
         invalidateGlyphCache();
     else
-        SVGStyledElement::parseAttribute(attr);
+        SVGStyledElement::parseAttribute(attribute);
 }
 
 Node::InsertionNotificationRequest SVGGlyphElement::insertedInto(Node* rootParent)
diff --git a/Source/WebCore/svg/SVGGlyphElement.h b/Source/WebCore/svg/SVGGlyphElement.h
index 8e2dd4010..c32b6d688 100644
--- a/Source/WebCore/svg/SVGGlyphElement.h
+++ b/Source/WebCore/svg/SVGGlyphElement.h
@@ -47,7 +47,7 @@ private:
     SVGGlyphElement(const QualifiedName&, Document*);
 
     // FIXME: svgAttributeChanged missing.
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void removedFrom(Node*) OVERRIDE;
diff --git a/Source/WebCore/svg/SVGGlyphRefElement.cpp b/Source/WebCore/svg/SVGGlyphRefElement.cpp
index cba83f235..ad5eb1d33 100644
--- a/Source/WebCore/svg/SVGGlyphRefElement.cpp
+++ b/Source/WebCore/svg/SVGGlyphRefElement.cpp
@@ -64,24 +64,24 @@ bool SVGGlyphRefElement::hasValidGlyphElement(String& glyphName) const
     return true;
 }
 
-void SVGGlyphRefElement::parseAttribute(Attribute* attr)
+void SVGGlyphRefElement::parseAttribute(const Attribute& attribute)
 {
-    const UChar* startPtr = attr->value().characters();
-    const UChar* endPtr = startPtr + attr->value().length();
+    const UChar* startPtr = attribute.value().characters();
+    const UChar* endPtr = startPtr + attribute.value().length();
 
     // FIXME: We need some error handling here.
-    if (attr->name() == SVGNames::xAttr)
+    if (attribute.name() == SVGNames::xAttr)
         parseNumber(startPtr, endPtr, m_x);
-    else if (attr->name() == SVGNames::yAttr)
+    else if (attribute.name() == SVGNames::yAttr)
         parseNumber(startPtr, endPtr, m_y);
-    else if (attr->name() == SVGNames::dxAttr)
+    else if (attribute.name() == SVGNames::dxAttr)
         parseNumber(startPtr, endPtr, m_dx);
-    else if (attr->name() == SVGNames::dyAttr)
+    else if (attribute.name() == SVGNames::dyAttr)
         parseNumber(startPtr, endPtr, m_dy);
     else {
-        if (SVGURIReference::parseAttribute(attr))
+        if (SVGURIReference::parseAttribute(attribute))
             return;
-        SVGStyledElement::parseAttribute(attr);
+        SVGStyledElement::parseAttribute(attribute);
     }
 }
 
diff --git a/Source/WebCore/svg/SVGGlyphRefElement.h b/Source/WebCore/svg/SVGGlyphRefElement.h
index f6641e3f4..524c0c509 100644
--- a/Source/WebCore/svg/SVGGlyphRefElement.h
+++ b/Source/WebCore/svg/SVGGlyphRefElement.h
@@ -32,7 +32,7 @@ public:
     static PassRefPtr<SVGGlyphRefElement> create(const QualifiedName&, Document*);
 
     bool hasValidGlyphElement(String& glyphName) const;
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     // DOM interface
     const AtomicString& glyphRef() const;
diff --git a/Source/WebCore/svg/SVGGradientElement.cpp b/Source/WebCore/svg/SVGGradientElement.cpp
index c45a5ba0f..b3dfe3dd4 100644
--- a/Source/WebCore/svg/SVGGradientElement.cpp
+++ b/Source/WebCore/svg/SVGGradientElement.cpp
@@ -75,38 +75,38 @@ bool SVGGradientElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGGradientElement::parseAttribute(Attribute* attr)
+void SVGGradientElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::gradientUnitsAttr) {
-        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attr->value());
+    if (attribute.name() == SVGNames::gradientUnitsAttr) {
+        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attribute.value());
         if (propertyValue > 0)
             setGradientUnitsBaseValue(propertyValue);
         return;
     }
 
-    if (attr->name() == SVGNames::gradientTransformAttr) {
+    if (attribute.name() == SVGNames::gradientTransformAttr) {
         SVGTransformList newList;
-        newList.parse(attr->value());
+        newList.parse(attribute.value());
         detachAnimatedGradientTransformListWrappers(newList.size());
         setGradientTransformBaseValue(newList);
         return;
     }
 
-    if (attr->name() == SVGNames::spreadMethodAttr) {
-        SVGSpreadMethodType propertyValue = SVGPropertyTraits<SVGSpreadMethodType>::fromString(attr->value());
+    if (attribute.name() == SVGNames::spreadMethodAttr) {
+        SVGSpreadMethodType propertyValue = SVGPropertyTraits<SVGSpreadMethodType>::fromString(attribute.value());
         if (propertyValue > 0)
             setSpreadMethodBaseValue(propertyValue);
         return;
     }
 
-    if (SVGURIReference::parseAttribute(attr))
+    if (SVGURIReference::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGGradientElement.h b/Source/WebCore/svg/SVGGradientElement.h
index 83b19ecd3..d11e71548 100644
--- a/Source/WebCore/svg/SVGGradientElement.h
+++ b/Source/WebCore/svg/SVGGradientElement.h
@@ -90,7 +90,7 @@ protected:
     SVGGradientElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
 private:
diff --git a/Source/WebCore/svg/SVGImageElement.cpp b/Source/WebCore/svg/SVGImageElement.cpp
index c73dcdba7..6e0af0245 100644
--- a/Source/WebCore/svg/SVGImageElement.cpp
+++ b/Source/WebCore/svg/SVGImageElement.cpp
@@ -98,42 +98,42 @@ bool SVGImageElement::isPresentationAttribute(const QualifiedName& name) const
     return SVGStyledTransformableElement::isPresentationAttribute(name);
 }
 
-void SVGImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void SVGImageElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledTransformableElement::collectStyleForAttribute(attr, style);
-    else if (attr->name() == SVGNames::widthAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyWidth, attr->value());
-    else if (attr->name() == SVGNames::heightAttr)
-        addPropertyToAttributeStyle(style, CSSPropertyHeight, attr->value());
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledTransformableElement::collectStyleForAttribute(attribute, style);
+    else if (attribute.name() == SVGNames::widthAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyWidth, attribute.value());
+    else if (attribute.name() == SVGNames::heightAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyHeight, attribute.value());
 }
 
-void SVGImageElement::parseAttribute(Attribute* attr)
+void SVGImageElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledTransformableElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::xAttr)
-        setXBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::yAttr)
-        setYBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::preserveAspectRatioAttr) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledTransformableElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::xAttr)
+        setXBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::yAttr)
+        setYBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::preserveAspectRatioAttr) {
         SVGPreserveAspectRatio preserveAspectRatio;
-        preserveAspectRatio.parse(attr->value());
+        preserveAspectRatio.parse(attribute.value());
         setPreserveAspectRatioBaseValue(preserveAspectRatio);
-    } else if (attr->name() == SVGNames::widthAttr)
-        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError, ForbidNegativeLengths));
-    else if (attr->name() == SVGNames::heightAttr)
-        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError, ForbidNegativeLengths));
-    else if (SVGTests::parseAttribute(attr)
-             || SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)
-             || SVGURIReference::parseAttribute(attr)) {
+    } else if (attribute.name() == SVGNames::widthAttr)
+        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (attribute.name() == SVGNames::heightAttr)
+        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (SVGTests::parseAttribute(attribute)
+             || SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)
+             || SVGURIReference::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGImageElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGImageElement.h b/Source/WebCore/svg/SVGImageElement.h
index 26f114c1e..bdae5d7d8 100644
--- a/Source/WebCore/svg/SVGImageElement.h
+++ b/Source/WebCore/svg/SVGImageElement.h
@@ -49,9 +49,9 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual void attach();
diff --git a/Source/WebCore/svg/SVGImageLoader.cpp b/Source/WebCore/svg/SVGImageLoader.cpp
index 944da1ab5..4f33d569e 100644
--- a/Source/WebCore/svg/SVGImageLoader.cpp
+++ b/Source/WebCore/svg/SVGImageLoader.cpp
@@ -47,12 +47,12 @@ void SVGImageLoader::dispatchLoadEvent()
     }
 }
 
-String SVGImageLoader::sourceURI(const AtomicString& attr) const
+String SVGImageLoader::sourceURI(const AtomicString& attribute) const
 {
     KURL base = element()->baseURI();
     if (base.isValid())
-        return KURL(base, stripLeadingAndTrailingHTMLSpaces(attr)).string();
-    return element()->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(attr));
+        return KURL(base, stripLeadingAndTrailingHTMLSpaces(attribute)).string();
+    return element()->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(attribute));
 }
 
 }
diff --git a/Source/WebCore/svg/SVGLangSpace.cpp b/Source/WebCore/svg/SVGLangSpace.cpp
index 58f18520b..445084537 100644
--- a/Source/WebCore/svg/SVGLangSpace.cpp
+++ b/Source/WebCore/svg/SVGLangSpace.cpp
@@ -50,14 +50,14 @@ void SVGLangSpace::setXmlspace(const AtomicString& xmlSpace)
     m_space = xmlSpace;
 }
 
-bool SVGLangSpace::parseAttribute(Attribute* attr)
+bool SVGLangSpace::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name().matches(XMLNames::langAttr)) {
-        setXmllang(attr->value());
+    if (attribute.name().matches(XMLNames::langAttr)) {
+        setXmllang(attribute.value());
         return true;
     }
-    if (attr->name().matches(XMLNames::spaceAttr)) {
-        setXmlspace(attr->value());
+    if (attribute.name().matches(XMLNames::spaceAttr)) {
+        setXmlspace(attribute.value());
         return true;
     }
 
diff --git a/Source/WebCore/svg/SVGLangSpace.h b/Source/WebCore/svg/SVGLangSpace.h
index 8a84b2f36..1ddfa1328 100644
--- a/Source/WebCore/svg/SVGLangSpace.h
+++ b/Source/WebCore/svg/SVGLangSpace.h
@@ -37,7 +37,7 @@ public:
     const AtomicString& xmlspace() const;
     void setXmlspace(const AtomicString& xmlSpace);
 
-    bool parseAttribute(Attribute*);
+    bool parseAttribute(const Attribute&);
     bool isKnownAttribute(const QualifiedName&);
     void addSupportedAttributes(HashSet<QualifiedName>&);
 
diff --git a/Source/WebCore/svg/SVGLineElement.cpp b/Source/WebCore/svg/SVGLineElement.cpp
index f057053ae..1c7795b64 100644
--- a/Source/WebCore/svg/SVGLineElement.cpp
+++ b/Source/WebCore/svg/SVGLineElement.cpp
@@ -81,27 +81,27 @@ bool SVGLineElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGLineElement::parseAttribute(Attribute* attr)
+void SVGLineElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledTransformableElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::x1Attr)
-        setX1BaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::y1Attr)
-        setY1BaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::x2Attr)
-        setX2BaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::y2Attr)
-        setY2BaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (SVGTests::parseAttribute(attr)
-             || SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledTransformableElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::x1Attr)
+        setX1BaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::y1Attr)
+        setY1BaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::x2Attr)
+        setX2BaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::y2Attr)
+        setY2BaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (SVGTests::parseAttribute(attribute)
+             || SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGLineElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGLineElement.h b/Source/WebCore/svg/SVGLineElement.h
index d706f75ae..ca1c446b9 100644
--- a/Source/WebCore/svg/SVGLineElement.h
+++ b/Source/WebCore/svg/SVGLineElement.h
@@ -45,7 +45,7 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool supportsMarkers() const { return true; }
diff --git a/Source/WebCore/svg/SVGLinearGradientElement.cpp b/Source/WebCore/svg/SVGLinearGradientElement.cpp
index 85022ca18..19793ccab 100644
--- a/Source/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/Source/WebCore/svg/SVGLinearGradientElement.cpp
@@ -83,24 +83,24 @@ bool SVGLinearGradientElement::isSupportedAttribute(const QualifiedName& attrNam
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGLinearGradientElement::parseAttribute(Attribute* attr)
+void SVGLinearGradientElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGGradientElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::x1Attr)
-        setX1BaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::y1Attr)
-        setY1BaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::x2Attr)
-        setX2BaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::y2Attr)
-        setY2BaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
+    if (!isSupportedAttribute(attribute.name()))
+        SVGGradientElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::x1Attr)
+        setX1BaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::y1Attr)
+        setY1BaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::x2Attr)
+        setX2BaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::y2Attr)
+        setY2BaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
     else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGLinearGradientElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGLinearGradientElement.h b/Source/WebCore/svg/SVGLinearGradientElement.h
index d89891291..941003815 100644
--- a/Source/WebCore/svg/SVGLinearGradientElement.h
+++ b/Source/WebCore/svg/SVGLinearGradientElement.h
@@ -39,7 +39,7 @@ private:
     SVGLinearGradientElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGMPathElement.cpp b/Source/WebCore/svg/SVGMPathElement.cpp
index eaea9814b..71056de34 100644
--- a/Source/WebCore/svg/SVGMPathElement.cpp
+++ b/Source/WebCore/svg/SVGMPathElement.cpp
@@ -59,16 +59,16 @@ bool SVGMPathElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGMPathElement::parseAttribute(Attribute* attr)
+void SVGMPathElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGElement::parseAttribute(attribute);
         return;
     }
 
-    if (SVGURIReference::parseAttribute(attr))
+    if (SVGURIReference::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGMPathElement.h b/Source/WebCore/svg/SVGMPathElement.h
index 1f3654a7c..8a9815c87 100644
--- a/Source/WebCore/svg/SVGMPathElement.h
+++ b/Source/WebCore/svg/SVGMPathElement.h
@@ -43,7 +43,7 @@ private:
 
     // FIXME: svgAttributeChanged missing.
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGMPathElement)
         DECLARE_ANIMATED_STRING(Href, href)
diff --git a/Source/WebCore/svg/SVGMarkerElement.cpp b/Source/WebCore/svg/SVGMarkerElement.cpp
index 718a8c068..9f9f197e3 100644
--- a/Source/WebCore/svg/SVGMarkerElement.cpp
+++ b/Source/WebCore/svg/SVGMarkerElement.cpp
@@ -125,39 +125,39 @@ bool SVGMarkerElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGMarkerElement::parseAttribute(Attribute* attr)
+void SVGMarkerElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
-    const AtomicString& value = attr->value();
+    const AtomicString& value = attribute.value();
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::markerUnitsAttr) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::markerUnitsAttr) {
         SVGMarkerUnitsType propertyValue = SVGPropertyTraits<SVGMarkerUnitsType>::fromString(value);
         if (propertyValue > 0)
             setMarkerUnitsBaseValue(propertyValue);
-    } else if (attr->name() == SVGNames::refXAttr)
+    } else if (attribute.name() == SVGNames::refXAttr)
         setRefXBaseValue(SVGLength::construct(LengthModeWidth, value, parseError));
-    else if (attr->name() == SVGNames::refYAttr)
+    else if (attribute.name() == SVGNames::refYAttr)
         setRefYBaseValue(SVGLength::construct(LengthModeHeight, value, parseError));
-    else if (attr->name() == SVGNames::markerWidthAttr)
+    else if (attribute.name() == SVGNames::markerWidthAttr)
         setMarkerWidthBaseValue(SVGLength::construct(LengthModeWidth, value, parseError));
-    else if (attr->name() == SVGNames::markerHeightAttr)
+    else if (attribute.name() == SVGNames::markerHeightAttr)
         setMarkerHeightBaseValue(SVGLength::construct(LengthModeHeight, value, parseError));
-    else if (attr->name() == SVGNames::orientAttr) {
+    else if (attribute.name() == SVGNames::orientAttr) {
         SVGAngle angle;
         SVGMarkerOrientType orientType = SVGPropertyTraits<SVGMarkerOrientType>::fromString(value, angle);
         if (orientType > 0)
             setOrientTypeBaseValue(orientType);
         if (orientType == SVGMarkerOrientAngle)
             setOrientAngleBaseValue(angle);
-    } else if (SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)
-             || SVGFitToViewBox::parseAttribute(document(), attr)) {
+    } else if (SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)
+             || SVGFitToViewBox::parseAttribute(document(), attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGMarkerElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGMarkerElement.h b/Source/WebCore/svg/SVGMarkerElement.h
index 1204be2e8..4ac90ff85 100644
--- a/Source/WebCore/svg/SVGMarkerElement.h
+++ b/Source/WebCore/svg/SVGMarkerElement.h
@@ -128,7 +128,7 @@ private:
     virtual bool needsPendingResourceHandling() const { return false; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/svg/SVGMaskElement.cpp b/Source/WebCore/svg/SVGMaskElement.cpp
index 90c5c65ff..fd36b04fd 100644
--- a/Source/WebCore/svg/SVGMaskElement.cpp
+++ b/Source/WebCore/svg/SVGMaskElement.cpp
@@ -94,37 +94,37 @@ bool SVGMaskElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGMaskElement::parseAttribute(Attribute* attr)
+void SVGMaskElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::maskUnitsAttr) {
-        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attr->value());
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::maskUnitsAttr) {
+        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attribute.value());
         if (propertyValue > 0)
             setMaskUnitsBaseValue(propertyValue);
         return;
-    } else if (attr->name() == SVGNames::maskContentUnitsAttr) {
-        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attr->value());
+    } else if (attribute.name() == SVGNames::maskContentUnitsAttr) {
+        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attribute.value());
         if (propertyValue > 0)
             setMaskContentUnitsBaseValue(propertyValue);
         return;
-    } else if (attr->name() == SVGNames::xAttr)
-        setXBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::yAttr)
-        setYBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::widthAttr)
-        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::heightAttr)
-        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (SVGTests::parseAttribute(attr)
-             || SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)) {
+    } else if (attribute.name() == SVGNames::xAttr)
+        setXBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::yAttr)
+        setYBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::widthAttr)
+        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::heightAttr)
+        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (SVGTests::parseAttribute(attribute)
+             || SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGMaskElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGMaskElement.h b/Source/WebCore/svg/SVGMaskElement.h
index c35c2897c..dced23fb7 100644
--- a/Source/WebCore/svg/SVGMaskElement.h
+++ b/Source/WebCore/svg/SVGMaskElement.h
@@ -46,7 +46,7 @@ private:
     virtual bool needsPendingResourceHandling() const { return false; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/svg/SVGPathElement.cpp b/Source/WebCore/svg/SVGPathElement.cpp
index ccac301e1..932951c22 100644
--- a/Source/WebCore/svg/SVGPathElement.cpp
+++ b/Source/WebCore/svg/SVGPathElement.cpp
@@ -217,31 +217,31 @@ bool SVGPathElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGPathElement::parseAttribute(Attribute* attr)
+void SVGPathElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledTransformableElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledTransformableElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::dAttr) {
-        if (!buildSVGPathByteStreamFromString(attr->value(), m_pathByteStream.get(), UnalteredParsing))
-            document()->accessSVGExtensions()->reportError("Problem parsing d=\"" + attr->value() + "\"");
+    if (attribute.name() == SVGNames::dAttr) {
+        if (!buildSVGPathByteStreamFromString(attribute.value(), m_pathByteStream.get(), UnalteredParsing))
+            document()->accessSVGExtensions()->reportError("Problem parsing d=\"" + attribute.value() + "\"");
         return;
     }
 
-    if (attr->name() == SVGNames::pathLengthAttr) {
-        setPathLengthBaseValue(attr->value().toFloat());
+    if (attribute.name() == SVGNames::pathLengthAttr) {
+        setPathLengthBaseValue(attribute.value().toFloat());
         if (pathLengthBaseValue() < 0)
             document()->accessSVGExtensions()->reportError("A negative value for path attribute <pathLength> is not allowed");
         return;
     }
 
-    if (SVGTests::parseAttribute(attr))
+    if (SVGTests::parseAttribute(attribute))
         return;
-    if (SVGLangSpace::parseAttribute(attr))
+    if (SVGLangSpace::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGPathElement.h b/Source/WebCore/svg/SVGPathElement.h
index 68558db43..9cc21f33f 100644
--- a/Source/WebCore/svg/SVGPathElement.h
+++ b/Source/WebCore/svg/SVGPathElement.h
@@ -108,7 +108,7 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual bool supportsMarkers() const { return true; }
 
diff --git a/Source/WebCore/svg/SVGPatternElement.cpp b/Source/WebCore/svg/SVGPatternElement.cpp
index 780f57b1a..b04f3b390 100644
--- a/Source/WebCore/svg/SVGPatternElement.cpp
+++ b/Source/WebCore/svg/SVGPatternElement.cpp
@@ -109,45 +109,45 @@ bool SVGPatternElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGPatternElement::parseAttribute(Attribute* attr)
+void SVGPatternElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::patternUnitsAttr) {
-        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attr->value());
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::patternUnitsAttr) {
+        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attribute.value());
         if (propertyValue > 0)
             setPatternUnitsBaseValue(propertyValue);
         return;
-    } else if (attr->name() == SVGNames::patternContentUnitsAttr) {
-        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attr->value());
+    } else if (attribute.name() == SVGNames::patternContentUnitsAttr) {
+        SVGUnitTypes::SVGUnitType propertyValue = SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::fromString(attribute.value());
         if (propertyValue > 0)
             setPatternContentUnitsBaseValue(propertyValue);
         return;
-    } else if (attr->name() == SVGNames::patternTransformAttr) {
+    } else if (attribute.name() == SVGNames::patternTransformAttr) {
         SVGTransformList newList;
-        newList.parse(attr->value());
+        newList.parse(attribute.value());
         detachAnimatedPatternTransformListWrappers(newList.size());
         setPatternTransformBaseValue(newList);
         return;
-    } else if (attr->name() == SVGNames::xAttr)
-        setXBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::yAttr)
-        setYBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::widthAttr)
-        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError, ForbidNegativeLengths));
-    else if (attr->name() == SVGNames::heightAttr)
-        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError, ForbidNegativeLengths));
-    else if (SVGURIReference::parseAttribute(attr)
-             || SVGTests::parseAttribute(attr)
-             || SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)
-             || SVGFitToViewBox::parseAttribute(document(), attr)) {
+    } else if (attribute.name() == SVGNames::xAttr)
+        setXBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::yAttr)
+        setYBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::widthAttr)
+        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (attribute.name() == SVGNames::heightAttr)
+        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (SVGURIReference::parseAttribute(attribute)
+             || SVGTests::parseAttribute(attribute)
+             || SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)
+             || SVGFitToViewBox::parseAttribute(document(), attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGPatternElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGPatternElement.h b/Source/WebCore/svg/SVGPatternElement.h
index a9cd40e4f..49259eb98 100644
--- a/Source/WebCore/svg/SVGPatternElement.h
+++ b/Source/WebCore/svg/SVGPatternElement.h
@@ -58,7 +58,7 @@ private:
     virtual bool needsPendingResourceHandling() const { return false; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/svg/SVGPolyElement.cpp b/Source/WebCore/svg/SVGPolyElement.cpp
index 2bb7cb2c3..57deccb2d 100644
--- a/Source/WebCore/svg/SVGPolyElement.cpp
+++ b/Source/WebCore/svg/SVGPolyElement.cpp
@@ -77,15 +77,15 @@ bool SVGPolyElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGPolyElement::parseAttribute(Attribute* attr)
+void SVGPolyElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledTransformableElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledTransformableElement::parseAttribute(attribute);
         return;
     }
 
-    const AtomicString& value = attr->value();
-    if (attr->name() == SVGNames::pointsAttr) {
+    const AtomicString& value = attribute.value();
+    if (attribute.name() == SVGNames::pointsAttr) {
         SVGPointList newList;
         if (!pointsListFromSVGData(newList, value))
             document()->accessSVGExtensions()->reportError("Problem parsing points=\"" + value + "\"");
@@ -97,11 +97,11 @@ void SVGPolyElement::parseAttribute(Attribute* attr)
         return;
     }
 
-    if (SVGTests::parseAttribute(attr))
+    if (SVGTests::parseAttribute(attribute))
         return;
-    if (SVGLangSpace::parseAttribute(attr))
+    if (SVGLangSpace::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGPolyElement.h b/Source/WebCore/svg/SVGPolyElement.h
index 4cb79f4be..94f1c11a5 100644
--- a/Source/WebCore/svg/SVGPolyElement.h
+++ b/Source/WebCore/svg/SVGPolyElement.h
@@ -51,7 +51,7 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE; 
+    virtual void parseAttribute(const Attribute&) OVERRIDE; 
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool supportsMarkers() const { return true; }
diff --git a/Source/WebCore/svg/SVGRadialGradientElement.cpp b/Source/WebCore/svg/SVGRadialGradientElement.cpp
index a244ef001..dcc4007b7 100644
--- a/Source/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/Source/WebCore/svg/SVGRadialGradientElement.cpp
@@ -87,26 +87,26 @@ bool SVGRadialGradientElement::isSupportedAttribute(const QualifiedName& attrNam
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGRadialGradientElement::parseAttribute(Attribute* attr)
+void SVGRadialGradientElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGGradientElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::cxAttr)
-        setCxBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::cyAttr)
-        setCyBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::rAttr)
-        setRBaseValue(SVGLength::construct(LengthModeOther, attr->value(), parseError, ForbidNegativeLengths));
-    else if (attr->name() == SVGNames::fxAttr)
-        setFxBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::fyAttr)
-        setFyBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
+    if (!isSupportedAttribute(attribute.name()))
+        SVGGradientElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::cxAttr)
+        setCxBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::cyAttr)
+        setCyBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::rAttr)
+        setRBaseValue(SVGLength::construct(LengthModeOther, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (attribute.name() == SVGNames::fxAttr)
+        setFxBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::fyAttr)
+        setFyBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
     else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGRadialGradientElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGRadialGradientElement.h b/Source/WebCore/svg/SVGRadialGradientElement.h
index 1952d7b5e..ec44aa7b3 100644
--- a/Source/WebCore/svg/SVGRadialGradientElement.h
+++ b/Source/WebCore/svg/SVGRadialGradientElement.h
@@ -39,7 +39,7 @@ private:
     SVGRadialGradientElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGRectElement.cpp b/Source/WebCore/svg/SVGRectElement.cpp
index 9797be739..3232fad2d 100644
--- a/Source/WebCore/svg/SVGRectElement.cpp
+++ b/Source/WebCore/svg/SVGRectElement.cpp
@@ -91,31 +91,31 @@ bool SVGRectElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGRectElement::parseAttribute(Attribute* attr)
+void SVGRectElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledTransformableElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::xAttr)
-        setXBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::yAttr)
-        setYBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::rxAttr)
-        setRxBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError, ForbidNegativeLengths));
-    else if (attr->name() == SVGNames::ryAttr)
-        setRyBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError, ForbidNegativeLengths));
-    else if (attr->name() == SVGNames::widthAttr)
-        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError, ForbidNegativeLengths));
-    else if (attr->name() == SVGNames::heightAttr)
-        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError, ForbidNegativeLengths));
-    else if (SVGTests::parseAttribute(attr)
-             || SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledTransformableElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::xAttr)
+        setXBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::yAttr)
+        setYBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::rxAttr)
+        setRxBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (attribute.name() == SVGNames::ryAttr)
+        setRyBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (attribute.name() == SVGNames::widthAttr)
+        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (attribute.name() == SVGNames::heightAttr)
+        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (SVGTests::parseAttribute(attribute)
+             || SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGRectElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGRectElement.h b/Source/WebCore/svg/SVGRectElement.h
index f13c7c7b2..033b8fed1 100644
--- a/Source/WebCore/svg/SVGRectElement.h
+++ b/Source/WebCore/svg/SVGRectElement.h
@@ -45,7 +45,7 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGSVGElement.cpp b/Source/WebCore/svg/SVGSVGElement.cpp
index 215c33e67..8e0f210ff 100644
--- a/Source/WebCore/svg/SVGSVGElement.cpp
+++ b/Source/WebCore/svg/SVGSVGElement.cpp
@@ -239,7 +239,7 @@ void SVGSVGElement::updateCurrentTranslate()
         document()->renderer()->repaint();
 }
 
-void SVGSVGElement::parseAttribute(Attribute* attr)
+void SVGSVGElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
@@ -247,14 +247,14 @@ void SVGSVGElement::parseAttribute(Attribute* attr)
         bool setListener = true;
 
         // Only handle events if we're the outermost <svg> element
-        if (attr->name() == HTMLNames::onunloadAttr)
-            document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
-        else if (attr->name() == HTMLNames::onresizeAttr)
-            document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
-        else if (attr->name() == HTMLNames::onscrollAttr)
-            document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attr));
-        else if (attr->name() == SVGNames::onzoomAttr)
-            document()->setWindowAttributeEventListener(eventNames().zoomEvent, createAttributeEventListener(document()->frame(), attr));
+        if (attribute.name() == HTMLNames::onunloadAttr)
+            document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attribute));
+        else if (attribute.name() == HTMLNames::onresizeAttr)
+            document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attribute));
+        else if (attribute.name() == HTMLNames::onscrollAttr)
+            document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attribute));
+        else if (attribute.name() == SVGNames::onzoomAttr)
+            document()->setWindowAttributeEventListener(eventNames().zoomEvent, createAttributeEventListener(document()->frame(), attribute));
         else
             setListener = false;
  
@@ -262,27 +262,27 @@ void SVGSVGElement::parseAttribute(Attribute* attr)
             return;
     }
 
-    if (attr->name() == HTMLNames::onabortAttr)
-        document()->setWindowAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == HTMLNames::onerrorAttr)
-        document()->setWindowAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(document()->frame(), attr));
-    else if (attr->name() == SVGNames::xAttr)
-        setXBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::yAttr)
-        setYBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::widthAttr)
-        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError, ForbidNegativeLengths));
-    else if (attr->name() == SVGNames::heightAttr)
-        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError, ForbidNegativeLengths));
-    else if (SVGTests::parseAttribute(attr)
-               || SVGLangSpace::parseAttribute(attr)
-               || SVGExternalResourcesRequired::parseAttribute(attr)
-               || SVGFitToViewBox::parseAttribute(document(), attr)
-               || SVGZoomAndPan::parseAttribute(attr)) {
+    if (attribute.name() == HTMLNames::onabortAttr)
+        document()->setWindowAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == HTMLNames::onerrorAttr)
+        document()->setWindowAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(document()->frame(), attribute));
+    else if (attribute.name() == SVGNames::xAttr)
+        setXBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::yAttr)
+        setYBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::widthAttr)
+        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (attribute.name() == SVGNames::heightAttr)
+        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (SVGTests::parseAttribute(attribute)
+               || SVGLangSpace::parseAttribute(attribute)
+               || SVGExternalResourcesRequired::parseAttribute(attribute)
+               || SVGFitToViewBox::parseAttribute(document(), attribute)
+               || SVGZoomAndPan::parseAttribute(attribute)) {
     } else
-        SVGStyledLocatableElement::parseAttribute(attr);
+        SVGStyledLocatableElement::parseAttribute(attribute);
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
@@ -371,11 +371,15 @@ PassRefPtr<NodeList> SVGSVGElement::getEnclosureList(const FloatRect& rect, SVGE
 
 bool SVGSVGElement::checkIntersection(SVGElement* element, const FloatRect& rect) const
 {
+    if (!element)
+        return false;
     return RenderSVGModelObject::checkIntersection(element->renderer(), rect);
 }
 
 bool SVGSVGElement::checkEnclosure(SVGElement* element, const FloatRect& rect) const
 {
+    if (!element)
+        return false;
     return RenderSVGModelObject::checkEnclosure(element->renderer(), rect);
 }
 
diff --git a/Source/WebCore/svg/SVGSVGElement.h b/Source/WebCore/svg/SVGSVGElement.h
index 6ee888750..6ead78bd2 100644
--- a/Source/WebCore/svg/SVGSVGElement.h
+++ b/Source/WebCore/svg/SVGSVGElement.h
@@ -140,7 +140,7 @@ private:
 
     virtual bool isSVG() const { return true; }
     
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext& context) { return StyledElement::rendererIsNeeded(context); }
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGScriptElement.cpp b/Source/WebCore/svg/SVGScriptElement.cpp
index a469ff1cb..8558b73fc 100644
--- a/Source/WebCore/svg/SVGScriptElement.cpp
+++ b/Source/WebCore/svg/SVGScriptElement.cpp
@@ -69,26 +69,26 @@ bool SVGScriptElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGScriptElement::parseAttribute(Attribute* attr)
+void SVGScriptElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::typeAttr) {
-        setType(attr->value());
+    if (attribute.name() == SVGNames::typeAttr) {
+        setType(attribute.value());
         return;
     }
 
-    if (attr->name() == HTMLNames::onerrorAttr) {
-        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
+    if (attribute.name() == HTMLNames::onerrorAttr) {
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attribute));
         return;
     }
 
-    if (SVGURIReference::parseAttribute(attr))
+    if (SVGURIReference::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGScriptElement.h b/Source/WebCore/svg/SVGScriptElement.h
index 57b748475..c88aaebab 100644
--- a/Source/WebCore/svg/SVGScriptElement.h
+++ b/Source/WebCore/svg/SVGScriptElement.h
@@ -45,7 +45,7 @@ private:
     SVGScriptElement(const QualifiedName&, Document*, bool wasInsertedByParser, bool alreadyStarted);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/svg/SVGStopElement.cpp b/Source/WebCore/svg/SVGStopElement.cpp
index 4818b8516..87143ee62 100644
--- a/Source/WebCore/svg/SVGStopElement.cpp
+++ b/Source/WebCore/svg/SVGStopElement.cpp
@@ -62,15 +62,15 @@ bool SVGStopElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGStopElement::parseAttribute(Attribute* attr)
+void SVGStopElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::offsetAttr) {
-        const String& value = attr->value();
+    if (attribute.name() == SVGNames::offsetAttr) {
+        const String& value = attribute.value();
         if (value.endsWith('%'))
             setOffsetBaseValue(value.left(value.length() - 1).toFloat() / 100.0f);
         else
@@ -106,6 +106,11 @@ RenderObject* SVGStopElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGGradientStop(this);
 }
 
+bool SVGStopElement::rendererIsNeeded(const NodeRenderingContext&)
+{
+    return true;
+}
+
 Color SVGStopElement::stopColorIncludingOpacity() const
 {
     ASSERT(renderer());
diff --git a/Source/WebCore/svg/SVGStopElement.h b/Source/WebCore/svg/SVGStopElement.h
index 375553dd4..25b9e3d80 100644
--- a/Source/WebCore/svg/SVGStopElement.h
+++ b/Source/WebCore/svg/SVGStopElement.h
@@ -37,12 +37,13 @@ private:
     SVGStopElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool isGradientStop() const { return true; }
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool rendererIsNeeded(const NodeRenderingContext&) OVERRIDE;
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGStopElement)
         DECLARE_ANIMATED_NUMBER(Offset, offset)
diff --git a/Source/WebCore/svg/SVGStringList.cpp b/Source/WebCore/svg/SVGStringList.cpp
index 7dc4b96f2..a0d9e3b19 100644
--- a/Source/WebCore/svg/SVGStringList.cpp
+++ b/Source/WebCore/svg/SVGStringList.cpp
@@ -42,7 +42,7 @@ void SVGStringList::reset(const String& string)
 
     // Add empty string, if list is empty.
     if (isEmpty())
-        append(String(""));
+        append(emptyString());
 }
 
 void SVGStringList::parse(const String& data, UChar delimiter)
diff --git a/Source/WebCore/svg/SVGStyleElement.cpp b/Source/WebCore/svg/SVGStyleElement.cpp
index 4e14d54b4..905b686f9 100644
--- a/Source/WebCore/svg/SVGStyleElement.cpp
+++ b/Source/WebCore/svg/SVGStyleElement.cpp
@@ -109,20 +109,20 @@ bool SVGStyleElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGStyleElement::parseAttribute(Attribute* attr)
+void SVGStyleElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::titleAttr) {
+    if (attribute.name() == SVGNames::titleAttr) {
         if (m_sheet)
-            m_sheet->setTitle(attr->value());
+            m_sheet->setTitle(attribute.value());
         return;
     }
 
-    if (SVGLangSpace::parseAttribute(attr))
+    if (SVGLangSpace::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGStyleElement.h b/Source/WebCore/svg/SVGStyleElement.h
index 1b036ffac..bbf288d71 100644
--- a/Source/WebCore/svg/SVGStyleElement.h
+++ b/Source/WebCore/svg/SVGStyleElement.h
@@ -53,7 +53,7 @@ private:
     SVGStyleElement(const QualifiedName&, Document*, bool createdByParser);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void removedFrom(Node*) OVERRIDE;
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index 353187922..c171ffa86 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -296,26 +296,26 @@ bool SVGStyledElement::isPresentationAttribute(const QualifiedName& name) const
     return SVGElement::isPresentationAttribute(name);
 }
 
-void SVGStyledElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void SVGStyledElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    CSSPropertyID propertyID = SVGStyledElement::cssPropertyIdForSVGAttributeName(attr->name());
+    CSSPropertyID propertyID = SVGStyledElement::cssPropertyIdForSVGAttributeName(attribute.name());
     if (propertyID > 0)
-        addPropertyToAttributeStyle(style, propertyID, attr->value());
+        addPropertyToAttributeStyle(style, propertyID, attribute.value());
 }
 
-void SVGStyledElement::parseAttribute(Attribute* attr)
+void SVGStyledElement::parseAttribute(const Attribute& attribute)
 {
     // SVG animation has currently requires special storage of values so we set
     // the className here.  svgAttributeChanged actually causes the resulting
     // style updates (instead of StyledElement::parseAttribute). We don't
     // tell StyledElement about the change to avoid parsing the class list twice
-    if (attr->name() == HTMLNames::classAttr) {
-        setClassNameBaseValue(attr->value());
+    if (attribute.name() == HTMLNames::classAttr) {
+        setClassNameBaseValue(attribute.value());
         return;
     }
 
     // id is handled by StyledElement which SVGElement inherits from
-    SVGElement::parseAttribute(attr);
+    SVGElement::parseAttribute(attribute);
 }
 
 bool SVGStyledElement::isKnownAttribute(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGStyledElement.h b/Source/WebCore/svg/SVGStyledElement.h
index 551f1be0a..87a5b48d5 100644
--- a/Source/WebCore/svg/SVGStyledElement.h
+++ b/Source/WebCore/svg/SVGStyledElement.h
@@ -66,9 +66,9 @@ protected:
     SVGStyledElement(const QualifiedName&, Document*, ConstructionType = CreateSVGElement);
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual void attach();
diff --git a/Source/WebCore/svg/SVGStyledTransformableElement.cpp b/Source/WebCore/svg/SVGStyledTransformableElement.cpp
index 7e6f1dd53..d4b8c5cdd 100644
--- a/Source/WebCore/svg/SVGStyledTransformableElement.cpp
+++ b/Source/WebCore/svg/SVGStyledTransformableElement.cpp
@@ -98,16 +98,16 @@ bool SVGStyledTransformableElement::isSupportedAttribute(const QualifiedName& at
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGStyledTransformableElement::parseAttribute(Attribute* attr)
+void SVGStyledTransformableElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledLocatableElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledLocatableElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::transformAttr) {
+    if (attribute.name() == SVGNames::transformAttr) {
         SVGTransformList newList;
-        newList.parse(attr->value());
+        newList.parse(attribute.value());
         detachAnimatedTransformListWrappers(newList.size());
         setTransformBaseValue(newList);
         return;
diff --git a/Source/WebCore/svg/SVGStyledTransformableElement.h b/Source/WebCore/svg/SVGStyledTransformableElement.h
index 0321f9b14..891374e84 100644
--- a/Source/WebCore/svg/SVGStyledTransformableElement.h
+++ b/Source/WebCore/svg/SVGStyledTransformableElement.h
@@ -55,7 +55,7 @@ protected:
     SVGStyledTransformableElement(const QualifiedName&, Document*, ConstructionType = CreateSVGElement);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGStyledTransformableElement)
diff --git a/Source/WebCore/svg/SVGSymbolElement.cpp b/Source/WebCore/svg/SVGSymbolElement.cpp
index 3cf5f5ec1..9c2f68639 100644
--- a/Source/WebCore/svg/SVGSymbolElement.cpp
+++ b/Source/WebCore/svg/SVGSymbolElement.cpp
@@ -65,18 +65,18 @@ bool SVGSymbolElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGSymbolElement::parseAttribute(Attribute* attr)
+void SVGSymbolElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledElement::parseAttribute(attribute);
         return;
     }
 
-    if (SVGLangSpace::parseAttribute(attr))
+    if (SVGLangSpace::parseAttribute(attribute))
         return;
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
-    if (SVGFitToViewBox::parseAttribute(document(), attr))
+    if (SVGFitToViewBox::parseAttribute(document(), attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGSymbolElement.h b/Source/WebCore/svg/SVGSymbolElement.h
index 4154919be..1ebcf86fa 100644
--- a/Source/WebCore/svg/SVGSymbolElement.h
+++ b/Source/WebCore/svg/SVGSymbolElement.h
@@ -45,7 +45,7 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index 455e8278d..6b858f317 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -129,7 +129,7 @@ private:
     SVGShadowText(Document* document, const String& data)
         : Text(document, data)
     {
-         setHasCustomWillOrDidRecalcStyle();
+        setHasCustomCallbacks();
     }
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void willRecalcTextStyle(StyleChange);
@@ -200,14 +200,14 @@ bool SVGTRefElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGTRefElement::parseAttribute(Attribute* attr)
+void SVGTRefElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGTextPositioningElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGTextPositioningElement::parseAttribute(attribute);
         return;
     }
 
-    if (SVGURIReference::parseAttribute(attr)) {
+    if (SVGURIReference::parseAttribute(attribute)) {
         return;
     }
 
diff --git a/Source/WebCore/svg/SVGTRefElement.h b/Source/WebCore/svg/SVGTRefElement.h
index 2f209f1ed..85c0684a9 100644
--- a/Source/WebCore/svg/SVGTRefElement.h
+++ b/Source/WebCore/svg/SVGTRefElement.h
@@ -43,7 +43,7 @@ private:
     void createShadowSubtree();
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGTests.cpp b/Source/WebCore/svg/SVGTests.cpp
index b6da35782..991893835 100644
--- a/Source/WebCore/svg/SVGTests.cpp
+++ b/Source/WebCore/svg/SVGTests.cpp
@@ -120,18 +120,18 @@ bool SVGTests::isValid() const
     return true;
 }
 
-bool SVGTests::parseAttribute(Attribute* attr)
+bool SVGTests::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == SVGNames::requiredFeaturesAttr) {
-        m_requiredFeatures.value.reset(attr->value());
+    if (attribute.name() == SVGNames::requiredFeaturesAttr) {
+        m_requiredFeatures.value.reset(attribute.value());
         return true;
     }
-    if (attr->name() == SVGNames::requiredExtensionsAttr) {
-        m_requiredExtensions.value.reset(attr->value());
+    if (attribute.name() == SVGNames::requiredExtensionsAttr) {
+        m_requiredExtensions.value.reset(attribute.value());
         return true;
     }
-    if (attr->name() == SVGNames::systemLanguageAttr) {
-        m_systemLanguage.value.reset(attr->value());
+    if (attribute.name() == SVGNames::systemLanguageAttr) {
+        m_systemLanguage.value.reset(attribute.value());
         return true;
     }
     
diff --git a/Source/WebCore/svg/SVGTests.h b/Source/WebCore/svg/SVGTests.h
index 185178651..d6aa8bf86 100644
--- a/Source/WebCore/svg/SVGTests.h
+++ b/Source/WebCore/svg/SVGTests.h
@@ -41,7 +41,7 @@ public:
     bool hasExtension(const String&) const;
     bool isValid() const;
 
-    bool parseAttribute(Attribute*);
+    bool parseAttribute(const Attribute&);
     bool isKnownAttribute(const QualifiedName&);
 
     void addSupportedAttributes(HashSet<QualifiedName>&);
diff --git a/Source/WebCore/svg/SVGTextContentElement.cpp b/Source/WebCore/svg/SVGTextContentElement.cpp
index cb84e29b7..612b605e4 100644
--- a/Source/WebCore/svg/SVGTextContentElement.cpp
+++ b/Source/WebCore/svg/SVGTextContentElement.cpp
@@ -235,39 +235,39 @@ bool SVGTextContentElement::isPresentationAttribute(const QualifiedName& name) c
     return SVGStyledElement::isPresentationAttribute(name);
 }
 
-void SVGTextContentElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+void SVGTextContentElement::collectStyleForAttribute(const Attribute& attribute, StylePropertySet* style)
 {
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledElement::collectStyleForAttribute(attr, style);
-    else if (attr->name().matches(XMLNames::spaceAttr)) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledElement::collectStyleForAttribute(attribute, style);
+    else if (attribute.name().matches(XMLNames::spaceAttr)) {
         DEFINE_STATIC_LOCAL(const AtomicString, preserveString, ("preserve"));
 
-        if (attr->value() == preserveString)
+        if (attribute.value() == preserveString)
             addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValuePre);
         else
             addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValueNowrap);
     }
 }
 
-void SVGTextContentElement::parseAttribute(Attribute* attr)
+void SVGTextContentElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::lengthAdjustAttr) {
-        SVGLengthAdjustType propertyValue = SVGPropertyTraits<SVGLengthAdjustType>::fromString(attr->value());
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::lengthAdjustAttr) {
+        SVGLengthAdjustType propertyValue = SVGPropertyTraits<SVGLengthAdjustType>::fromString(attribute.value());
         if (propertyValue > 0)
             setLengthAdjustBaseValue(propertyValue);
-    } else if (attr->name() == SVGNames::textLengthAttr) {
-        m_textLength.value = SVGLength::construct(LengthModeOther, attr->value(), parseError, ForbidNegativeLengths);
-    } else if (SVGTests::parseAttribute(attr)
-               || SVGExternalResourcesRequired::parseAttribute(attr)) {
-    } else if (SVGLangSpace::parseAttribute(attr)) {
+    } else if (attribute.name() == SVGNames::textLengthAttr) {
+        m_textLength.value = SVGLength::construct(LengthModeOther, attribute.value(), parseError, ForbidNegativeLengths);
+    } else if (SVGTests::parseAttribute(attribute)
+               || SVGExternalResourcesRequired::parseAttribute(attribute)) {
+    } else if (SVGLangSpace::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGTextContentElement::svgAttributeChanged(const QualifiedName& attrName)
@@ -321,19 +321,6 @@ SVGTextContentElement* SVGTextContentElement::elementFromRenderer(RenderObject*
     return static_cast<SVGTextContentElement*>(node);
 }
 
-void SVGTextContentElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
-{
-    SVGStyledElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-
-    if (changedByParser || !renderer())
-        return;
-
-    // Invalidate the TextPosition cache in SVGTextLayoutAttributesBuilder as it may now point
-    // to no-longer existing SVGTextPositioningElements and thus needs to be rebuilt.
-    if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer()))
-        textRenderer->invalidateTextPositioningElements();
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGTextContentElement.h b/Source/WebCore/svg/SVGTextContentElement.h
index 0975abc37..892f9f023 100644
--- a/Source/WebCore/svg/SVGTextContentElement.h
+++ b/Source/WebCore/svg/SVGTextContentElement.h
@@ -103,13 +103,12 @@ protected:
     virtual bool isValid() const { return SVGTests::isValid(); }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
-    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+    virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool selfHasRelativeLengths() const;
-    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
 private:
     virtual bool isTextContent() const { return true; }
diff --git a/Source/WebCore/svg/SVGTextElement.cpp b/Source/WebCore/svg/SVGTextElement.cpp
index 91d314418..b9cb36696 100644
--- a/Source/WebCore/svg/SVGTextElement.cpp
+++ b/Source/WebCore/svg/SVGTextElement.cpp
@@ -64,16 +64,16 @@ bool SVGTextElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGTextElement::parseAttribute(Attribute* attr)
+void SVGTextElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGTextPositioningElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGTextPositioningElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::transformAttr) {
+    if (attribute.name() == SVGNames::transformAttr) {
         SVGTransformList newList;
-        newList.parse(attr->value());
+        newList.parse(attribute.value());
         detachAnimatedTransformListWrappers(newList.size());
         setTransformBaseValue(newList);
         return;
diff --git a/Source/WebCore/svg/SVGTextElement.h b/Source/WebCore/svg/SVGTextElement.h
index 32118f5bb..0ed8ea3b7 100644
--- a/Source/WebCore/svg/SVGTextElement.h
+++ b/Source/WebCore/svg/SVGTextElement.h
@@ -47,7 +47,7 @@ private:
     virtual bool supportsFocus() const { return true; }
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual AffineTransform* supplementalTransform();
     virtual AffineTransform localCoordinateSpaceTransform(SVGLocatable::CTMScope mode) const { return SVGTransformable::localCoordinateSpaceTransform(mode); }
diff --git a/Source/WebCore/svg/SVGTextPathElement.cpp b/Source/WebCore/svg/SVGTextPathElement.cpp
index 2b2f387aa..8b59f4e88 100644
--- a/Source/WebCore/svg/SVGTextPathElement.cpp
+++ b/Source/WebCore/svg/SVGTextPathElement.cpp
@@ -73,28 +73,28 @@ bool SVGTextPathElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGTextPathElement::parseAttribute(Attribute* attr)
+void SVGTextPathElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
-    const AtomicString& value = attr->value();
+    const AtomicString& value = attribute.value();
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGTextContentElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::startOffsetAttr)
+    if (!isSupportedAttribute(attribute.name()))
+        SVGTextContentElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::startOffsetAttr)
         setStartOffsetBaseValue(SVGLength::construct(LengthModeOther, value, parseError));
-    else if (attr->name() == SVGNames::methodAttr) {
+    else if (attribute.name() == SVGNames::methodAttr) {
         SVGTextPathMethodType propertyValue = SVGPropertyTraits<SVGTextPathMethodType>::fromString(value);
         if (propertyValue > 0)
             setMethodBaseValue(propertyValue);
-    } else if (attr->name() == SVGNames::spacingAttr) {
+    } else if (attribute.name() == SVGNames::spacingAttr) {
         SVGTextPathSpacingType propertyValue = SVGPropertyTraits<SVGTextPathSpacingType>::fromString(value);
         if (propertyValue > 0)
             setSpacingBaseValue(propertyValue);
-    } else if (SVGURIReference::parseAttribute(attr)) {
+    } else if (SVGURIReference::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 void SVGTextPathElement::svgAttributeChanged(const QualifiedName& attrName)
diff --git a/Source/WebCore/svg/SVGTextPathElement.h b/Source/WebCore/svg/SVGTextPathElement.h
index 42cadad70..452e60e00 100644
--- a/Source/WebCore/svg/SVGTextPathElement.h
+++ b/Source/WebCore/svg/SVGTextPathElement.h
@@ -118,7 +118,7 @@ private:
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/svg/SVGTextPositioningElement.cpp b/Source/WebCore/svg/SVGTextPositioningElement.cpp
index 746888ace..42b2cd8d0 100644
--- a/Source/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/Source/WebCore/svg/SVGTextPositioningElement.cpp
@@ -68,48 +68,48 @@ bool SVGTextPositioningElement::isSupportedAttribute(const QualifiedName& attrNa
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGTextPositioningElement::parseAttribute(Attribute* attr)
+void SVGTextPositioningElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGTextContentElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGTextContentElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::xAttr) {
+    if (attribute.name() == SVGNames::xAttr) {
         SVGLengthList newList;
-        newList.parse(attr->value(), LengthModeWidth);
+        newList.parse(attribute.value(), LengthModeWidth);
         detachAnimatedXListWrappers(newList.size());
         setXBaseValue(newList);
         return;
     }
 
-    if (attr->name() == SVGNames::yAttr) {
+    if (attribute.name() == SVGNames::yAttr) {
         SVGLengthList newList;
-        newList.parse(attr->value(), LengthModeHeight);
+        newList.parse(attribute.value(), LengthModeHeight);
         detachAnimatedYListWrappers(newList.size());
         setYBaseValue(newList);
         return;
     }
 
-    if (attr->name() == SVGNames::dxAttr) {
+    if (attribute.name() == SVGNames::dxAttr) {
         SVGLengthList newList;
-        newList.parse(attr->value(), LengthModeWidth);
+        newList.parse(attribute.value(), LengthModeWidth);
         detachAnimatedDxListWrappers(newList.size());
         setDxBaseValue(newList);
         return;
     }
 
-    if (attr->name() == SVGNames::dyAttr) {
+    if (attribute.name() == SVGNames::dyAttr) {
         SVGLengthList newList;
-        newList.parse(attr->value(), LengthModeHeight);
+        newList.parse(attribute.value(), LengthModeHeight);
         detachAnimatedDyListWrappers(newList.size());
         setDyBaseValue(newList);
         return;
     }
 
-    if (attr->name() == SVGNames::rotateAttr) {
+    if (attribute.name() == SVGNames::rotateAttr) {
         SVGNumberList newList;
-        newList.parse(attr->value());
+        newList.parse(attribute.value());
         detachAnimatedRotateListWrappers(newList.size());
         setRotateBaseValue(newList);
         return;
diff --git a/Source/WebCore/svg/SVGTextPositioningElement.h b/Source/WebCore/svg/SVGTextPositioningElement.h
index 47b1a8af6..7f5847d1c 100644
--- a/Source/WebCore/svg/SVGTextPositioningElement.h
+++ b/Source/WebCore/svg/SVGTextPositioningElement.h
@@ -36,7 +36,7 @@ protected:
     SVGTextPositioningElement(const QualifiedName&, Document*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGTextPositioningElement)
diff --git a/Source/WebCore/svg/SVGURIReference.cpp b/Source/WebCore/svg/SVGURIReference.cpp
index 7bcc0da8f..1736312fc 100755
--- a/Source/WebCore/svg/SVGURIReference.cpp
+++ b/Source/WebCore/svg/SVGURIReference.cpp
@@ -30,10 +30,10 @@
 
 namespace WebCore {
 
-bool SVGURIReference::parseAttribute(Attribute* attr)
+bool SVGURIReference::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name().matches(XLinkNames::hrefAttr)) {
-        setHrefBaseValue(attr->value());
+    if (attribute.name().matches(XLinkNames::hrefAttr)) {
+        setHrefBaseValue(attribute.value());
         return true;
     }
 
diff --git a/Source/WebCore/svg/SVGURIReference.h b/Source/WebCore/svg/SVGURIReference.h
index 1a320dc24..a6dcb449a 100755
--- a/Source/WebCore/svg/SVGURIReference.h
+++ b/Source/WebCore/svg/SVGURIReference.h
@@ -35,7 +35,7 @@ class SVGURIReference {
 public:
     virtual ~SVGURIReference() { }
 
-    bool parseAttribute(Attribute*);
+    bool parseAttribute(const Attribute&);
     bool isKnownAttribute(const QualifiedName&);
     void addSupportedAttributes(HashSet<QualifiedName>&);
 
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index 0b82fadf9..24f1b3ed9 100755
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -90,10 +90,9 @@ inline SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* docu
     , m_haveFiredLoadEvent(false)
     , m_needsShadowTreeRecreation(false)
 {
+    ASSERT(hasCustomCallbacks());
     ASSERT(hasTagName(SVGNames::useTag));
     registerAnimatedPropertiesForSVGUseElement();
-
-    setHasCustomWillOrDidRecalcStyle();
 }
 
 PassRefPtr<SVGUseElement> SVGUseElement::create(const QualifiedName& tagName, Document* document, bool wasInsertedByParser)
@@ -144,28 +143,28 @@ bool SVGUseElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGUseElement::parseAttribute(Attribute* attr)
+void SVGUseElement::parseAttribute(const Attribute& attribute)
 {
     SVGParsingError parseError = NoError;
 
-    if (!isSupportedAttribute(attr->name()))
-        SVGStyledTransformableElement::parseAttribute(attr);
-    else if (attr->name() == SVGNames::xAttr)
-        setXBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError));
-    else if (attr->name() == SVGNames::yAttr)
-        setYBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
-    else if (attr->name() == SVGNames::widthAttr)
-        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError, ForbidNegativeLengths));
-    else if (attr->name() == SVGNames::heightAttr)
-        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError, ForbidNegativeLengths));
-    else if (SVGTests::parseAttribute(attr)
-             || SVGLangSpace::parseAttribute(attr)
-             || SVGExternalResourcesRequired::parseAttribute(attr)
-             || SVGURIReference::parseAttribute(attr)) {
+    if (!isSupportedAttribute(attribute.name()))
+        SVGStyledTransformableElement::parseAttribute(attribute);
+    else if (attribute.name() == SVGNames::xAttr)
+        setXBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::yAttr)
+        setYBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError));
+    else if (attribute.name() == SVGNames::widthAttr)
+        setWidthBaseValue(SVGLength::construct(LengthModeWidth, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (attribute.name() == SVGNames::heightAttr)
+        setHeightBaseValue(SVGLength::construct(LengthModeHeight, attribute.value(), parseError, ForbidNegativeLengths));
+    else if (SVGTests::parseAttribute(attribute)
+             || SVGLangSpace::parseAttribute(attribute)
+             || SVGExternalResourcesRequired::parseAttribute(attribute)
+             || SVGURIReference::parseAttribute(attribute)) {
     } else
         ASSERT_NOT_REACHED();
 
-    reportAttributeParsingError(parseError, attr);
+    reportAttributeParsingError(parseError, attribute);
 }
 
 static inline bool isWellFormedDocument(Document* document)
@@ -767,8 +766,8 @@ void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
         // 'svg' element will use values of 100% for these attributes.
         RefPtr<SVGSVGElement> svgElement = SVGSVGElement::create(SVGNames::svgTag, referencedDocument());
 
-        // Transfer all attributes from <symbol> to the new <svg> element
-        svgElement->setAttributesFromElement(*toElement(element));
+        // Transfer all data (attributes, etc.) from <symbol> to the new <svg> element.
+        svgElement->cloneDataFromElement(*toElement(element));
 
         // Only clone symbol children, and add them to the new <svg> element
         for (Node* child = element->firstChild(); child; child = child->nextSibling()) {
@@ -899,7 +898,7 @@ void SVGUseElement::transferUseAttributesToReplacedElement(SVGElement* from, SVG
     ASSERT(from);
     ASSERT(to);
 
-    to->setAttributesFromElement(*from);
+    to->cloneDataFromElement(*from);
 
     to->removeAttribute(SVGNames::xAttr);
     to->removeAttribute(SVGNames::yAttr);
diff --git a/Source/WebCore/svg/SVGUseElement.h b/Source/WebCore/svg/SVGUseElement.h
index 3faea9000..e42b61dae 100755
--- a/Source/WebCore/svg/SVGUseElement.h
+++ b/Source/WebCore/svg/SVGUseElement.h
@@ -64,7 +64,7 @@ private:
     virtual void buildPendingResource();
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool willRecalcStyle(StyleChange);
diff --git a/Source/WebCore/svg/SVGViewElement.cpp b/Source/WebCore/svg/SVGViewElement.cpp
index b0e9c5b6c..2a2fef171 100644
--- a/Source/WebCore/svg/SVGViewElement.cpp
+++ b/Source/WebCore/svg/SVGViewElement.cpp
@@ -68,23 +68,23 @@ bool SVGViewElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGViewElement::parseAttribute(Attribute* attr)
+void SVGViewElement::parseAttribute(const Attribute& attribute)
 {
-    if (!isSupportedAttribute(attr->name())) {
-        SVGStyledElement::parseAttribute(attr);
+    if (!isSupportedAttribute(attribute.name())) {
+        SVGStyledElement::parseAttribute(attribute);
         return;
     }
 
-    if (attr->name() == SVGNames::viewTargetAttr) {
-        viewTarget().reset(attr->value());
+    if (attribute.name() == SVGNames::viewTargetAttr) {
+        viewTarget().reset(attribute.value());
         return;
     }
 
-    if (SVGExternalResourcesRequired::parseAttribute(attr))
+    if (SVGExternalResourcesRequired::parseAttribute(attribute))
         return;
-    if (SVGFitToViewBox::parseAttribute(document(), attr))
+    if (SVGFitToViewBox::parseAttribute(document(), attribute))
         return;
-    if (SVGZoomAndPan::parseAttribute(attr))
+    if (SVGZoomAndPan::parseAttribute(attribute))
         return;
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/svg/SVGViewElement.h b/Source/WebCore/svg/SVGViewElement.h
index 624f4d910..6d8089ea2 100644
--- a/Source/WebCore/svg/SVGViewElement.h
+++ b/Source/WebCore/svg/SVGViewElement.h
@@ -47,7 +47,7 @@ private:
 
     // FIXME: svgAttributeChanged missing.
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&) { return false; }
 
diff --git a/Source/WebCore/svg/SVGZoomAndPan.cpp b/Source/WebCore/svg/SVGZoomAndPan.cpp
index 9b6cbf972..e706affda 100644
--- a/Source/WebCore/svg/SVGZoomAndPan.cpp
+++ b/Source/WebCore/svg/SVGZoomAndPan.cpp
@@ -34,11 +34,11 @@ void SVGZoomAndPan::setZoomAndPan(unsigned short zoomAndPan)
     m_zoomAndPan = zoomAndPan;
 }
 
-bool SVGZoomAndPan::parseAttribute(Attribute* attr)
+bool SVGZoomAndPan::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == SVGNames::zoomAndPanAttr) {
-        const UChar* start = attr->value().characters();
-        const UChar* end = start + attr->value().length();
+    if (attribute.name() == SVGNames::zoomAndPanAttr) {
+        const UChar* start = attribute.value().characters();
+        const UChar* end = start + attribute.value().length();
         parseZoomAndPan(start, end);
         return true;
     }
diff --git a/Source/WebCore/svg/SVGZoomAndPan.h b/Source/WebCore/svg/SVGZoomAndPan.h
index 3e91d8e33..e2d52f64d 100644
--- a/Source/WebCore/svg/SVGZoomAndPan.h
+++ b/Source/WebCore/svg/SVGZoomAndPan.h
@@ -44,7 +44,7 @@ public:
     unsigned short zoomAndPan() const { return m_zoomAndPan; }
     virtual void setZoomAndPan(unsigned short zoomAndPan);
 
-    bool parseAttribute(Attribute*);
+    bool parseAttribute(const Attribute&);
     bool isKnownAttribute(const QualifiedName&);
     void addSupportedAttributes(HashSet<QualifiedName>&);
 
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index e75d0fa41..8695974fd 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -420,28 +420,28 @@ bool SVGSMILElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-void SVGSMILElement::parseAttribute(Attribute* attr)
+void SVGSMILElement::parseAttribute(const Attribute& attribute)
 {
-    if (attr->name() == SVGNames::beginAttr) {
+    if (attribute.name() == SVGNames::beginAttr) {
         if (!m_conditions.isEmpty()) {
             disconnectConditions();
             m_conditions.clear();
             parseBeginOrEnd(fastGetAttribute(SVGNames::endAttr), End);
         }
-        parseBeginOrEnd(attr->value().string(), Begin);
+        parseBeginOrEnd(attribute.value().string(), Begin);
         if (inDocument())
             connectConditions();
-    } else if (attr->name() == SVGNames::endAttr) {
+    } else if (attribute.name() == SVGNames::endAttr) {
         if (!m_conditions.isEmpty()) {
             disconnectConditions();
             m_conditions.clear();
             parseBeginOrEnd(fastGetAttribute(SVGNames::beginAttr), Begin);
         }
-        parseBeginOrEnd(attr->value().string(), End);
+        parseBeginOrEnd(attribute.value().string(), End);
         if (inDocument())
             connectConditions();
     } else
-        SVGElement::parseAttribute(attr);
+        SVGElement::parseAttribute(attribute);
 }
 
 void SVGSMILElement::svgAttributeChanged(const QualifiedName& attrName)
@@ -466,9 +466,13 @@ void SVGSMILElement::svgAttributeChanged(const QualifiedName& attrName)
             beginListChanged(elapsed());
         else if (attrName == SVGNames::endAttr)
             endListChanged(elapsed());
-        else if (attrName == SVGNames::attributeNameAttr)
+        else if (attrName == SVGNames::attributeNameAttr) {
             m_attributeName = constructQualifiedName(this, fastGetAttribute(SVGNames::attributeNameAttr));
-        else if (attrName.matches(XLinkNames::hrefAttr)) {
+            if (m_targetElement) {
+                resetTargetElement();
+                return;
+            }
+        } else if (attrName.matches(XLinkNames::hrefAttr)) {
             if (SVGElement* targetElement = this->targetElement())
                 document()->accessSVGExtensions()->removeAllAnimationElementsFromTarget(targetElement);
         }
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.h b/Source/WebCore/svg/animation/SVGSMILElement.h
index 0f7c6ae95..8e8cd6c08 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.h
+++ b/Source/WebCore/svg/animation/SVGSMILElement.h
@@ -45,7 +45,7 @@ public:
     static bool isSMILElement(Node*);
 
     bool isSupportedAttribute(const QualifiedName&);
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&) OVERRIDE;
     virtual InsertionNotificationRequest insertedInto(Node*) OVERRIDE;
     virtual void removedFrom(Node*) OVERRIDE;
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index bf7deb9f0..e17185fc2 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -634,6 +634,22 @@ void Internals::setSuggestedValue(Element* element, const String& value, Excepti
     inputElement->setSuggestedValue(value);
 }
 
+void Internals::setEditingValue(Element* element, const String& value, ExceptionCode& ec)
+{
+    if (!element) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    HTMLInputElement* inputElement = element->toInputElement();
+    if (!inputElement) {
+        ec = INVALID_NODE_TYPE_ERR;
+        return;
+    }
+
+    inputElement->setEditingValue(value);
+}
+
 void Internals::scrollElementToRect(Element* element, long x, long y, long w, long h, ExceptionCode& ec)
 {
     if (!element || !element->document() || !element->document()->view()) {
@@ -725,11 +741,12 @@ PassRefPtr<WebKitPoint> Internals::touchPositionAdjustedToBestClickableNode(long
 
     Node* targetNode;
     IntPoint adjustedPoint;
-    document->frame()->eventHandler()->bestClickableNodeForTouchPoint(point, radius, adjustedPoint, targetNode);
-    if (targetNode)
-        adjustedPoint = targetNode->document()->view()->contentsToWindow(adjustedPoint);
 
-    return WebKitPoint::create(adjustedPoint.x(), adjustedPoint.y());
+    bool foundNode = document->frame()->eventHandler()->bestClickableNodeForTouchPoint(point, radius, adjustedPoint, targetNode);
+    if (foundNode)
+        return WebKitPoint::create(adjustedPoint.x(), adjustedPoint.y());
+
+    return 0;
 }
 
 Node* Internals::touchNodeAdjustedToBestClickableNode(long x, long y, long width, long height, Document* document, ExceptionCode& ec)
@@ -760,9 +777,11 @@ PassRefPtr<ClientRect> Internals::bestZoomableAreaForTouchPoint(long x, long y,
 
     Node* targetNode;
     IntRect zoomableArea;
-    document->frame()->eventHandler()->bestZoomableAreaForTouchPoint(point, radius, zoomableArea, targetNode);
+    bool foundNode = document->frame()->eventHandler()->bestZoomableAreaForTouchPoint(point, radius, zoomableArea, targetNode);
+    if (foundNode)
+        return ClientRect::create(zoomableArea);
 
-    return ClientRect::create(zoomableArea);
+    return 0;
 }
 #endif
 
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index fd8747daa..89faeac50 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -113,6 +113,7 @@ public:
     bool wasLastChangeUserEdit(Element* textField, ExceptionCode&);
     String suggestedValue(Element* inputElement, ExceptionCode&);
     void setSuggestedValue(Element* inputElement, const String&, ExceptionCode&);
+    void setEditingValue(Element* inputElement, const String&, ExceptionCode&);
     void scrollElementToRect(Element*, long x, long y, long w, long h, ExceptionCode&);
 
     void paintControlTints(Document*, ExceptionCode&);
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index 7f5a2114d..6c9e88e38 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -85,6 +85,7 @@ module window {
         boolean wasLastChangeUserEdit(in Element textField) raises (DOMException);
         DOMString suggestedValue(in Element inputElement) raises (DOMException);
         void setSuggestedValue(in Element inputElement, in DOMString value) raises (DOMException);
+        void setEditingValue(in Element inputElement, in DOMString value) raises (DOMException);
 
         void paintControlTints(in Document document) raises (DOMException);
 
diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
index a71c44555..059672b22 100644
--- a/Source/WebCore/xml/XMLHttpRequest.cpp
+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
@@ -478,7 +478,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, Exc
         return;
     }
 
-    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectFromSource(url)) {
+    if (!scriptExecutionContext()->contentSecurityPolicy()->allowConnectToSource(url)) {
         // FIXME: Should this be throwing an exception?
         ec = SECURITY_ERR;
         return;
diff --git a/Source/WebCore/xml/parser/MarkupTokenBase.h b/Source/WebCore/xml/parser/MarkupTokenBase.h
index c962a6aba..acb5d73a0 100644
--- a/Source/WebCore/xml/parser/MarkupTokenBase.h
+++ b/Source/WebCore/xml/parser/MarkupTokenBase.h
@@ -409,7 +409,7 @@ public:
         }
     }
 
-    AtomicMarkupTokenBase(typename Token::Type::Type type, AtomicString name, const Vector<Attribute>& attributes = Vector<Attribute>())
+    AtomicMarkupTokenBase(typename Token::Type::Type type, const AtomicString& name, const Vector<Attribute>& attributes = Vector<Attribute>())
         : m_type(type)
         , m_name(name)
         , m_externalCharacters(0)
diff --git a/Source/WebCore/xml/parser/XMLToken.h b/Source/WebCore/xml/parser/XMLToken.h
index ecf12b137..73b9b0111 100644
--- a/Source/WebCore/xml/parser/XMLToken.h
+++ b/Source/WebCore/xml/parser/XMLToken.h
@@ -431,7 +431,7 @@ public:
         }
     }
 
-    AtomicXMLToken(XMLTokenTypes::Type type, AtomicString name, const Vector<Attribute>& attributes = Vector<Attribute>())
+    AtomicXMLToken(XMLTokenTypes::Type type, const AtomicString& name, const Vector<Attribute>& attributes = Vector<Attribute>())
         : AtomicMarkupTokenBase<XMLToken>(type, name, attributes)
     {
     }